# Cortex Documentation Portal ## Home - [Home](https://cortex-docs.paloaltonetworks.com/readme.md): Welcome to your team’s developer platform - [1. Mapping Authentication Events](https://cortex-docs.paloaltonetworks.com/1.-mapping-authentication-events.md): Map SSO and SaaS application logs to the XDM authentication schema to automatically build authentication stories. ## Cortex XSIAM - [Cortex XSIAM Documentation](https://cortex-docs.paloaltonetworks.com/cortex-xsiam-docs/cortex-xsiam-documentation.md): Find Cortex XSIAM product guides, references, and release information. ## Cortex XDR - [Cortex XDR Documentation](https://cortex-docs.paloaltonetworks.com/cortex-xdr-docs/readme.md): Find Cortex XDR product guides, references, and release information. ## Cortex Cloud - [Cortex Cloud Documentation](https://cortex-docs.paloaltonetworks.com/cortex-cloud-docs/readme.md): Find Cortex Cloud product documentation, references, and release information. ## Cortex XDR Agent - [Cortex XDR Agent](https://cortex-docs.paloaltonetworks.com/cortex-xdr-agent-docs/readme.md): Cortex XDR Agent guides, releases, compatibility, and reference information. ## Cortex AgentiX - [Cortex AgentiX](https://cortex-docs.paloaltonetworks.com/cortex-agentix-docs/cortex-agentix.md): Cortex AgentiX documentation, release notes, and API references. - [What's New](https://cortex-docs.paloaltonetworks.com/cortex-agentix-docs/whats-new.md): Latest Cortex AgentiX release notes. - [Cortex Gateway Admin Guide](https://cortex-docs.paloaltonetworks.com/cortex-agentix-docs/cortex-gateway-admin-guide.md): Manage permissions, RBAC, and user groups across Cortex products. - [Release Notes](https://cortex-docs.paloaltonetworks.com/cortex-agentix-docs/release-notes.md): Latest Cortex AgentiX features and known issues. - [Cortex AgentiX Documentation](https://cortex-docs.paloaltonetworks.com/cortex-agentix-docs/cortex-agentix-documentation.md): Product guides for Cortex AgentiX. - [API Reference Guide](https://cortex-docs.paloaltonetworks.com/cortex-agentix-docs/api-reference-guide.md): Cortex AgentiX API reference. ## Cortex Data Security - [Cortex Data Security](https://cortex-docs.paloaltonetworks.com/cortex-data-security-docs/cortex-data-security.md) ## Cortex XSOAR - [Cortex XSOAR Documentation](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-docs/readme.md): Explore Cortex XSOAR guides, releases, and product resources. ## Cortex Xpanse - [Cortex Xpanse Expander](https://cortex-docs.paloaltonetworks.com/cortex-xpanse-docs/readme.md): Find Cortex Xpanse Expander guides, APIs, and release information. ## Cortex XSIAM Documentation - [Navigate the Cortex XSIAM docs](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/learn-about-cortex-xsiam/readme.md): Start here for a visual overview of the main Cortex XSIAM documentation areas. - [Get started with Cortex XSIAM](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/learn-about-cortex-xsiam/get-started-cortex-xsiam.md): Learn about Cortex XSIAM and the key integrated capabilities. - [Cortex XSIAM architecture](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/learn-about-cortex-xsiam/get-started-cortex-xsiam/cortex-xsiam-architecture.md): Explore the Cortex XSIAM architecture, including SIEM, XDR, SOAR, cloud security, XDL data ingestion, and Broker VM. - [Agentic AI in Cortex XSIAM](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/learn-about-cortex-xsiam/agentic-ai-in-cortex-xsiam.md): Use the Cortex Agentic Assistant in Cortex XSIAM to investigate cases, perform threat hunting, and create scripts. Embed and run LLM prompts in playbooks. View AI case summaries. - [Agentic Assistant use cases](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/learn-about-cortex-xsiam/agentic-ai-in-cortex-xsiam/agentic-assistant-use-cases.md): Recommended prompts to automate your SOC using the Cortex Agentic Assistant in Cortex XSIAM. - [Compare Agentic Assistant with Cortex Assistant](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/learn-about-cortex-xsiam/agentic-ai-in-cortex-xsiam/compare-agentic-assistant-with-cortex-assistant.md): Feature comparison between Cortex Agentic Assistant and Cortex Assistant in Cortex XSIAM. - [Agentic Assistant security](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/learn-about-cortex-xsiam/agentic-ai-in-cortex-xsiam/agentic-assistant-security.md): Learn about how the Agentic Assistant is built using responsible AI principles in Cortex XSIAM. - [Cortex XSIAM license tiers and product licenses](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/learn-about-cortex-xsiam/cortex-xsiam-product-licenses.md): Compare Cortex XSIAM license tiers and product licenses: NG-SIEM, Enterprise, Premium, included capabilities, and add-ons. - [Data retention](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/learn-about-cortex-xsiam/cortex-xsiam-product-licenses/data-retention.md): Learn more about the default retention periods for all Cortex XSIAM licenses and the available retention add-ons. - [Data storage lifecycle](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/learn-about-cortex-xsiam/cortex-xsiam-product-licenses/data-storage-lifecycle.md): Understand the Cortex XSIAM data storage lifecycle, including hot and cold storage, retention extensions, and Event Forwarding exports. - [License allocation](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/learn-about-cortex-xsiam/cortex-xsiam-product-licenses/license-allocation.md): Learn more about how Cortex XSIAM regulates licenses. - [License expiration](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/learn-about-cortex-xsiam/cortex-xsiam-product-licenses/license-expiration.md): Learn more about the Cortex XSIAM license expiration and validation period. - [Upgrade your tenant](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/learn-about-cortex-xsiam/cortex-xsiam-product-licenses/upgrade-your-tenant.md): If you have purchased new entitlements, Cortex XSIAM automatically upgrades your tenant to provide product upgrades and new license entitlements. - [In-product support ticket creation](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/learn-about-cortex-xsiam/in-product-support-case-creation.md): Open a support ticket directly in Cortex XSIAM and record your console to capture your issues and have the ticket handled efficiently. - [Supported web browsers](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/learn-about-cortex-xsiam/supported-web-browsers.md): View the web browsers and minimum browser versions supported for Cortex XSIAM. - [Use the Cortex XSIAM interface](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/learn-about-cortex-xsiam/use-the-interface.md): Learn Cortex XSIAM interface navigation, filtering, saved views, result exports, system tools, and product areas. - [Manage API keys](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/learn-about-cortex-xsiam/manage-api-keys.md): Learn to create and manage Cortex XSIAM API keys, roles, expiration, scopes, and credential permissions. - [How to onboard Cortex XSIAM](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/onboard-cortex-xsiam/onboard-cortex-xsiam.md): Learn about the deployment preparation and procedures for onboarding and configuring Cortex XSIAM. - [Plan and prepare](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/onboard-cortex-xsiam/plan-and-prepare.md): Plan your Cortex XSIAM deployment, including storage, region, licensing, XDR agents, data sources, and user roles. - [Plan your agent deployment](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/onboard-cortex-xsiam/plan-and-prepare/plan-your-agent-deployment.md): Plan phased Cortex XDR agent deployment, from pilot testing to organization-wide Cortex XSIAM rollout. - [Deployment steps](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/onboard-cortex-xsiam/deployment-steps.md): Review the plan and prepare considerations, and then follow the steps in the onboarding checklist to successfully deploy and onboard Cortex XSIAM. - [Cortex XSIAM onboarding checklist](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/onboard-cortex-xsiam/deployment-steps/cortex-xsiam-onboarding-checklist.md): Cortex XSIAM onboarding checklist for activation, data source configuration, XDR agent deployment, and analytics setup. - [Activate Cortex XSIAM](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/onboard-cortex-xsiam/deployment-steps/activate-cortex-xsiam.md): Activate Cortex XSIAM tenants in Cortex Gateway, including prerequisites, encryption, and access configuration. - [Bring your own keys](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/onboard-cortex-xsiam/deployment-steps/activate-cortex-xsiam/bring-your-own-keys.md): Set up, import, rotate, and disable Cortex BYOK encryption keys for Cortex XSIAM tenant data. - [Cortex XSIAM supported regions and data residency](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/onboard-cortex-xsiam/deployment-steps/activate-cortex-xsiam/cortex-xsiam-supported-regions.md): View Cortex XSIAM supported hosting regions and data residency locations in Americas, EMEA, and JPAC. - [Enable access to required PANW resources](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/onboard-cortex-xsiam/deployment-steps/activate-cortex-xsiam/enable-access-to-required-panw-resources.md): Configure firewall access to Cortex XSIAM resources using required FQDNs, IP addresses, ports, and App-IDs. - [Cortex XSIAM regional egress resources](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/onboard-cortex-xsiam/deployment-steps/activate-cortex-xsiam/enable-access-to-required-panw-resources/regional-egress-resources.md): Configure Cortex XSIAM firewall egress access with regional FQDNs, IP addresses, ports, and App-IDs. - [Cortex XSIAM engine outbound IP addresses](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/onboard-cortex-xsiam/deployment-steps/activate-cortex-xsiam/enable-access-to-required-panw-resources/engine-ip-addresses-outbound.md): Configure firewall allowlists for Cortex XSIAM engine outbound IP addresses by deployment region. - [Cortex XSIAM inbound source IP addresses](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/onboard-cortex-xsiam/deployment-steps/activate-cortex-xsiam/enable-access-to-required-panw-resources/inbound-source-resources.md): Configure firewall allowlists for Cortex XSIAM inbound source IP addresses by deployment region. - [FedRAMP and US federal Cortex XSIAM required resources](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/onboard-cortex-xsiam/deployment-steps/activate-cortex-xsiam/enable-access-to-required-panw-resources/fedramp-and-the-us-federal-government-required-resources.md): Configure required Cortex XSIAM network resources for FedRAMP and US federal government deployments. - [Set up users, groups, and roles](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/onboard-cortex-xsiam/deployment-steps/set-up-users-and-roles.md): Learn how to set up users and roles in Cortex XSIAM. - [Manage Cortex XSIAM user groups](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/onboard-cortex-xsiam/deployment-steps/set-up-users-and-roles/user-group-management.md): Manage Cortex XSIAM user groups for RBAC, SBAC scoping, SAML mapping, and Active Directory synchronization. - [Assign user roles and groups](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/onboard-cortex-xsiam/deployment-steps/set-up-users-and-roles/assign-user-roles-and-groups.md): Assign Cortex XSIAM roles and groups, configure RBAC permissions, and apply SBAC granular access. - [Set up authentication](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/onboard-cortex-xsiam/deployment-steps/set-up-authentication.md): Authenticate Cortex XSIAM users using SAML 2.0 or Customer Support Portal (CSP). - [Authenticate users through the Customer Support Portal](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/onboard-cortex-xsiam/deployment-steps/set-up-authentication/authenticate-users-through-the-customer-support-portal.md): Authenticate Cortex XSIAM users through Customer Support Portal and assign Gateway or tenant access roles. - [Authenticate users using SSO](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/onboard-cortex-xsiam/deployment-steps/set-up-authentication/authenticate-users-using-sso.md): Configure Cortex XSIAM SAML 2.0 single sign-on with identity providers, group mapping, and user provisioning. - [Set up Okta as the Identity Provider Using SAML 2.0](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/onboard-cortex-xsiam/deployment-steps/set-up-authentication/set-up-okta-as-the-identity-provider-using-saml-2.0.md): Configure Okta SAML 2.0 single sign-on and group mapping for Cortex XSIAM users. - [Set up Microsoft Entra ID as the Identity Provider Using SAML 2.0](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/onboard-cortex-xsiam/deployment-steps/set-up-authentication/set-up-microsoft-entra-id-as-the-identity-provider-using-saml-2.0.md): Configure Microsoft Entra ID SAML 2.0 single sign-on, security group claims, and user group mapping for Cortex XSIAM. - [Configure content](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/onboard-cortex-xsiam/deployment-steps/configure-content.md): Configure Cortex XSIAM data sources with standard collectors, Broker VM applets, XDR Collectors, CSP onboarding, and content packs. - [Set up Cloud Identity Engine](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/onboard-cortex-xsiam/deployment-steps/set-up-cloud-identity-engine.md): Learn how to set up Cloud Identity Engine to use with Cortex XSIAM. - [Install Cortex XDR agents](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/onboard-cortex-xsiam/deployment-steps/install-cortex-xdr-agents.md): Install Cortex XDR agents with agent installation packages to monitor endpoints and collect Cortex XSIAM endpoint data. - [Create an agent installation package](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/onboard-cortex-xsiam/deployment-steps/install-cortex-xdr-agents/create-an-agent-installation-package.md): Create Cortex XDR agent installation packages for endpoints, Kubernetes, container, and serverless workloads in Cortex XSIAM. - [Deploy installation packages](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/onboard-cortex-xsiam/deployment-steps/install-cortex-xdr-agents/deploy-installation-packages.md): Deploy Cortex XDR agent installation packages to Windows, macOS, Linux, Kubernetes, and Android endpoints using manual or software distribution methods in Cortex XSIAM. - [Endpoint data collection](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/onboard-cortex-xsiam/deployment-steps/install-cortex-xdr-agents/endpoint-data-collection.md): Review endpoint metadata, EDR events, Windows event logs, and performance metrics collected by Cortex XDR agents for Cortex XSIAM. - [Configure global agent settings](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/onboard-cortex-xsiam/deployment-steps/install-cortex-xdr-agents/configure-global-agent-settings.md): Configure global Cortex XDR agent settings for uninstall passwords, content bandwidth, upgrades, advanced analysis, and endpoint cleanup for Cortex XSIAM. - [Define endpoint groups](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/onboard-cortex-xsiam/deployment-steps/install-cortex-xdr-agents/define-endpoint-groups.md): Create and manage static or dynamic Cortex XDR Agent endpoint groups to target security policies and actions by endpoint attributes for Cortex XSIAM. - [Manage endpoint profiles](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/onboard-cortex-xsiam/deployment-steps/install-cortex-xdr-agents/manage-endpoint-profiles.md): Manage Cortex XSIAM endpoint security profiles and policy mappings to apply reusable threat protection settings across endpoint groups. - [Guidelines for keeping Cortex XDR agents and content updated](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/onboard-cortex-xsiam/deployment-steps/install-cortex-xdr-agents/guidelines-for-keeping-cortex-xdr-agents-and-content-updated.md): Plan phased Cortex XDR agent upgrades and content updates with rollout schedules, staging content, and bandwidth controls in Cortex XSIAM. - [Cortex XSIAM - Analytics](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/onboard-cortex-xsiam/deployment-steps/cortex-xsiam-analytics.md): Learn how to enable Cortex XSIAM - Analytics, which allows Cortex XSIAM to analyze data from a variety of sensors and develop a baseline to raise analytics alerts. - [Configure Cortex XSIAM network parameters](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/onboard-cortex-xsiam/deployment-steps/cortex-xsiam-analytics/configure-cortex-xsiam-network-parameters.md): Configure Cortex XSIAM internal IP address ranges and domain suffixes for network asset identification, tracking, and analysis. - [Enable the Analytics Engine and Identity Analytics](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/onboard-cortex-xsiam/deployment-steps/cortex-xsiam-analytics/enable-the-analytics-engine-and-identity-analytics.md): Enable Cortex XSIAM Analytics Engine and Identity Analytics to baseline activity and detect anomalous endpoint and user behavior. - [FedRAMP overview](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/onboard-cortex-xsiam/deployment-steps/fedramp-overview.md): Learn how FedRAMP standardizes cloud security assessment, authorization, and continuous monitoring for U.S. government agencies. - [Cortex XSIAM FedRAMP compliance for federal agencies](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/onboard-cortex-xsiam/deployment-steps/fedramp-overview/cortex-xsiam-federal-compliance.md): Learn how FedRAMP-authorized Cortex XSIAM supports U.S. federal agencies with isolated tenants, U.S. data residency, and government cloud infrastructure. - [Onboard and configure government cloud environments](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/onboard-cortex-xsiam/deployment-steps/fedramp-overview/onboarding-and-configuration.md): Onboard government cloud environments to Cortex XSIAM with the CSP wizard, Government tenant settings, and compliant scan modes. - [FedRAMP limitations and supported government cloud regions](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/onboard-cortex-xsiam/deployment-steps/fedramp-overview/limitations-and-supported-regions.md): Review Cortex XSIAM FedRAMP feature limitations and supported AWS GovCloud and Azure Government regions for federal deployments. - [Post-deployment](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/onboard-cortex-xsiam/post-deployment.md): Complete Cortex XSIAM post-deployment tasks, including health checks, automations, and reviews of security cases and issues. - [Cortex XSIAM post-deployment checklist](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/onboard-cortex-xsiam/post-deployment/post-deployment-checklist.md): Use this Cortex XSIAM post-deployment checklist for health checks, automations, case triage, XDR agent rollout, and integrations. - [Perform health checks](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/onboard-cortex-xsiam/post-deployment/perform-health-checks.md): Perform Cortex XSIAM health checks for prevention policies, Cortex XDR agents, WildFire testing, alerts, cases, and log ingestion. - [Monitor agent operational status in Cortex XSIAM](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/onboard-cortex-xsiam/post-deployment/perform-health-checks/monitor-agent-operational-status-in-cortex-xsiam.md): Monitor Cortex XDR agent operational status in Cortex XSIAM, including protected, partially protected, unprotected, and resource-impact states. - [Cortex Marketplace](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/onboard-cortex-xsiam/post-deployment/cortex-marketplace.md): Discover Cortex Marketplace content packs for integrations, playbooks, automations, correlation rules, dashboards, and security use cases. - [Content packs](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/onboard-cortex-xsiam/post-deployment/cortex-marketplace/content-packs.md): Explore pre-installed and recommended Cortex Marketplace content packs for integrations, playbooks, scripts, widgets, and security workflows. - [Install content packs](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/onboard-cortex-xsiam/post-deployment/cortex-marketplace/install-content-packs.md): Install Cortex Marketplace content packs, review dependencies, and configure integrations and data sources in Cortex XSIAM. - [Manage user roles and access management](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/onboard-cortex-xsiam/post-deployment/manage-user-roles-and-access-management.md): Learn how to manage access for users, user roles, user groups, and Single Sign-On (SSO) for users on a specific Cortex XSIAM tenant. - [Manage user roles](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/onboard-cortex-xsiam/post-deployment/manage-user-roles-and-access-management/manage-user-roles.md): Create and manage Cortex XSIAM user roles with RBAC permissions, XQL dataset access controls, and scoped access settings. - [Manage user access](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/onboard-cortex-xsiam/post-deployment/manage-user-roles-and-access-management/manage-user-access.md): Manage Cortex XSIAM user access with roles, user groups, RBAC permissions, SBAC scopes, and XQL dataset row controls. - [User access reference information](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/onboard-cortex-xsiam/post-deployment/manage-user-roles-and-access-management/manage-user-access/user-access-reference-information.md): Reference Cortex XSIAM Users page fields for user types, direct roles, groups, group roles, and granular access scopes. - [Manage user scope](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/onboard-cortex-xsiam/post-deployment/manage-user-roles-and-access-management/manage-user-scope.md): Configure Cortex XSIAM Scope-Based Access Control (SBAC) for users, groups, and API keys across assets, cases, endpoints, and dataset rows. - [Manage access to objects](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/onboard-cortex-xsiam/post-deployment/manage-user-roles-and-access-management/manage-access-to-objects.md): Manage Cortex XSIAM per-object access for dashboards, reports, playbooks, scripts, and saved XQL queries using owner, editor, and viewer roles. - [Manage access to custom dashboards](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/onboard-cortex-xsiam/post-deployment/manage-user-roles-and-access-management/manage-access-to-objects/manage-access-to-custom-dashboards.md): Manage Cortex XSIAM custom dashboard access with role permissions, object sharing, owners, editors, viewers, and SBAC data scopes. - [Manage access to report templates](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/onboard-cortex-xsiam/post-deployment/manage-user-roles-and-access-management/manage-access-to-objects/manage-access-to-report-templates.md): Manage Cortex XSIAM report template access with role permissions, ownership, sharing, public visibility, and SBAC data scopes. - [Manage access to playbooks and scripts](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/onboard-cortex-xsiam/post-deployment/manage-user-roles-and-access-management/manage-access-to-objects/manage-access-to-playbooks-and-scripts.md): Manage Cortex XSIAM playbook and script access with role permissions, ownership, sharing, public visibility, and automation controls. - [Manage access to saved queries](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/onboard-cortex-xsiam/post-deployment/manage-user-roles-and-access-management/manage-access-to-objects/manage-access-to-saved-queries.md): Manage Cortex XSIAM saved XQL query access with role permissions, ownership, sharing, public visibility, and Query Library controls. - [Dashboards and reports](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/onboard-cortex-xsiam/post-deployment/dashboards-and-reports.md): Use Cortex XSIAM dashboards, widgets, reports, and report templates to visualize security data and monitor system activity. - [Configure server settings](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/onboard-cortex-xsiam/post-deployment/configure-server-settings.md): Configure Cortex XSIAM server settings for localization, branding, AI, access control, data ingestion, security, and support access. - [Configure security settings](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/onboard-cortex-xsiam/post-deployment/configure-security-settings.md): Configure Cortex XSIAM security settings for session expiration, login domains, approved IP ranges, inactive users, cookies, and report emails. - [Data and log forwarding](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/onboard-cortex-xsiam/post-deployment/data-and-log-forwarding.md): Configure Cortex XSIAM notifications and forward logs, alerts, cases, and issues to email, Slack, syslog, and third-party services. - [Forward logs and data from Cortex XSIAM to external services](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/onboard-cortex-xsiam/post-deployment/data-and-log-forwarding/forward-logs-and-data-from-cortex-xsiam-to-external-services.md): Forward Cortex XSIAM logs, cases, and issues to email, Slack, syslog, Splunk, Amazon SQS, Amazon S3, or webhooks. - [Configure external applications for forwarding](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/onboard-cortex-xsiam/post-deployment/data-and-log-forwarding/forward-logs-and-data-from-cortex-xsiam-to-external-services/configure-external-applications-for-forwarding.md): Configure external applications in Cortex XSIAM to forward cases, issues, and logs to email, Slack, syslog, Amazon S3, Amazon SQS, Splunk, and webhooks. - [Forward notifications to Amazon SQS](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/onboard-cortex-xsiam/post-deployment/data-and-log-forwarding/forward-logs-and-data-from-cortex-xsiam-to-external-services/configure-external-applications-for-forwarding/forward-notifications-to-amazon-sqs.md): Configure Cortex XSIAM notification forwarding to Amazon SQS with Cortex Gateway egress, an AWS SQS queue, IAM role or access keys, and queue permissions. - [Forward notifications to Amazon S3](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/onboard-cortex-xsiam/post-deployment/data-and-log-forwarding/forward-logs-and-data-from-cortex-xsiam-to-external-services/configure-external-applications-for-forwarding/forward-notifications-to-amazon-s3.md): Configure Cortex XSIAM notification forwarding to Amazon S3 with Cortex Gateway egress, AWS IAM roles, bucket permissions, and file rollup. - [Forward notifications to Splunk](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/onboard-cortex-xsiam/post-deployment/data-and-log-forwarding/forward-logs-and-data-from-cortex-xsiam-to-external-services/configure-external-applications-for-forwarding/forward-notifications-to-splunk.md): Configure Cortex XSIAM notification forwarding to Splunk with firewall access, Cortex Gateway egress, HTTPS Event Collector, and authentication tokens. - [Forward notifications to webhook](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/onboard-cortex-xsiam/post-deployment/data-and-log-forwarding/forward-logs-and-data-from-cortex-xsiam-to-external-services/configure-external-applications-for-forwarding/forward-notifications-to-webhook.md): Configure Cortex XSIAM case and issue notifications to HTTPS webhooks with firewall access, Gateway egress, authentication, and JSON payload support. - [Integrate a syslog receiver](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/onboard-cortex-xsiam/post-deployment/data-and-log-forwarding/forward-logs-and-data-from-cortex-xsiam-to-external-services/configure-external-applications-for-forwarding/integrate-a-syslog-receiver.md): Integrate a syslog receiver for Cortex XSIAM notifications with regional firewall access, TCP or UDP transport, TLS certificates, and troubleshooting. - [Integrate Slack for outbound notifications](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/onboard-cortex-xsiam/post-deployment/data-and-log-forwarding/forward-logs-and-data-from-cortex-xsiam-to-external-services/configure-external-applications-for-forwarding/integrate-slack-for-outbound-notifications.md): Integrate Cortex XSIAM with Slack to forward issue and report notifications to dedicated workspace channels. - [Configure notification forwarding](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/onboard-cortex-xsiam/post-deployment/data-and-log-forwarding/forward-logs-and-data-from-cortex-xsiam-to-external-services/configure-notification-forwarding.md): Configure Cortex XSIAM forwarding notifications for issues, cases, and audit logs with scoped filters, formats, grouping, and external destinations. - [Set up email notifications for tenant updates](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/onboard-cortex-xsiam/post-deployment/data-and-log-forwarding/forward-logs-and-data-from-cortex-xsiam-to-external-services/set-up-email-notifications-for-tenant-updates.md): Set up Cortex XSIAM email notifications for tenant upgrades, hotfixes, downtime warnings, and Management Audit Log events. - [Monitor administrative activity](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/onboard-cortex-xsiam/post-deployment/data-and-log-forwarding/forward-logs-and-data-from-cortex-xsiam-to-external-services/monitor-administrative-activity.md): Monitor Cortex XSIAM administrative and investigative activity with Management Audit Logs, filters, 365-day retention, and notification forwarding. - [Data and log notification formats](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/onboard-cortex-xsiam/post-deployment/data-and-log-forwarding/data-and-log-notification-formats.md): Understand Cortex XSIAM notification formats for forwarded cases, issues, and logs, including optional alert formatting for email, syslog, and Slack. - [Management audit log messages](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/onboard-cortex-xsiam/post-deployment/data-and-log-forwarding/data-and-log-notification-formats/management-audit-log-messages.md): Reference Cortex XSIAM Management Audit Log message types for administrative, authentication, automation, endpoint, policy, and integration activity. - [Cortex XSIAM issue notification format](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/onboard-cortex-xsiam/post-deployment/data-and-log-forwarding/data-and-log-notification-formats/issue-notification-format.md): Reference Cortex XSIAM issue notification formats and payloads for email, Slack, syslog, Splunk, Amazon S3, Amazon SQS, and webhooks. - [Agent Audit log notification format](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/onboard-cortex-xsiam/post-deployment/data-and-log-forwarding/data-and-log-notification-formats/agent-audit-log-notification-format.md): Reference Cortex XDR Agent Audit Log notification formats for email and syslog, including CEF field mappings and payload examples. - [Management Audit log notification format](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/onboard-cortex-xsiam/post-deployment/data-and-log-forwarding/data-and-log-notification-formats/management-audit-log-notification-format.md): Reference Cortex XSIAM Management Audit Log notification formats for email and syslog, including CEF field mappings and payload examples. - [Log format for IOC and BIOC issues](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/onboard-cortex-xsiam/post-deployment/data-and-log-forwarding/data-and-log-notification-formats/log-format-for-ioc-and-bioc-issues.md): Reference legacy Cortex XSIAM IOC and BIOC issue log formats for email and syslog, including fields, prefixes, and categories. - [Analytics log format](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/onboard-cortex-xsiam/post-deployment/data-and-log-forwarding/data-and-log-notification-formats/analytics-log-format.md): Reference legacy Cortex XSIAM Analytics issue log formats for email and syslog, including detection, network activity, user, device, and file fields. - [Configure Cortex XSIAM](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/configure-cortex-xsiam.md): Plan Cortex XSIAM configuration for data, integrations, AI, automation, and operations. - [Data management](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/data-management.md): Manage Cortex XSIAM data with Analytics and Data Lake tiers, Federated Search, retention settings, datasets, and data lifecycle controls. - [Optimize data management in Cortex XSIAM](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/data-management/optimize-data-management-in-cortex-xsiam.md): Learn more about the differences between the Cortex XSIAM data management solutions. - [Configure Cortex Data Lake tier](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/data-management/configure-cortex-data-lake-tier.md): Configure the Cortex Data Lake tier in Cortex XSIAM. - [Broker VM](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/data-management/broker-vm.md): Manage Broker VMs that collect and forward data to Cortex XSIAM. - [What is the Broker VM?](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/data-management/broker-vm/what-is-the-broker-vm.md): Learn how Broker VM securely connects data sources to Cortex XSIAM. - [Set up and configure Broker VM](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/data-management/broker-vm/set-up-and-configure-broker-vm.md): Install and configure a Broker VM to collect data for Cortex XSIAM. - [Broker VM image installations](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/data-management/broker-vm/set-up-and-configure-broker-vm/broker-vm-image-installations.md): Install a Cortex XSIAM Broker VM image on supported cloud and virtual platforms. - [Set up Broker VM on Alibaba Cloud](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/data-management/broker-vm/set-up-and-configure-broker-vm/broker-vm-image-installations/set-up-broker-vm-on-alibaba-cloud.md): Deploy a Cortex XSIAM Broker VM on Alibaba Cloud. - [Set up Broker VM on Amazon Web Services](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/data-management/broker-vm/set-up-and-configure-broker-vm/broker-vm-image-installations/set-up-broker-vm-on-amazon-web-services.md): Deploy a Cortex XSIAM Broker VM on Amazon Web Services. - [Set up Broker VM on Google Cloud Platform (GCP)](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/data-management/broker-vm/set-up-and-configure-broker-vm/broker-vm-image-installations/set-up-broker-vm-on-google-cloud-platform-gcp.md): Deploy a Cortex XSIAM Broker VM on Google Cloud Platform. - [Set up Broker VM on KVM using Ubuntu](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/data-management/broker-vm/set-up-and-configure-broker-vm/broker-vm-image-installations/set-up-broker-vm-on-kvm-using-ubuntu.md): Deploy a Cortex XSIAM Broker VM on Ubuntu with KVM. - [Set up Broker VM on Microsoft Azure](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/data-management/broker-vm/set-up-and-configure-broker-vm/broker-vm-image-installations/set-up-broker-vm-on-microsoft-azure.md): Deploy a Cortex XSIAM Broker VM on Microsoft Azure. - [Set up Broker VM on Microsoft Hyper-V](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/data-management/broker-vm/set-up-and-configure-broker-vm/broker-vm-image-installations/set-up-broker-vm-on-microsoft-hyper-v.md): Deploy a Cortex XSIAM Broker VM on Microsoft Hyper-V. - [Set up Broker VM on Nutanix Hypervisor](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/data-management/broker-vm/set-up-and-configure-broker-vm/broker-vm-image-installations/set-up-broker-vm-on-nutanix-hypervisor.md): Deploy a Cortex XSIAM Broker VM on Nutanix Hypervisor. - [Set up Broker VM on VMware ESXi using vSphere Client](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/data-management/broker-vm/set-up-and-configure-broker-vm/broker-vm-image-installations/set-up-broker-vm-on-vmware-esxi-using-vsphere-client.md): Deploy a Cortex XSIAM Broker VM on VMware ESXi. - [Broker VM data collector applets](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/data-management/broker-vm/set-up-and-configure-broker-vm/broker-vm-data-collector-applets.md): Configure Broker VM data collector applets for Cortex XSIAM. - [Manage Broker VM](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/data-management/broker-vm/manage-broker-vm.md): Manage Broker VM configuration, capacity, updates, and clusters in Cortex XSIAM. - [Edit Broker VM Configuration](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/data-management/broker-vm/manage-broker-vm/edit-broker-vm-configuration.md): Update Broker VM settings for Cortex XSIAM data collection. - [Increase Broker VM storage allocated for data caching](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/data-management/broker-vm/manage-broker-vm/increase-broker-vm-storage-allocated-for-data-caching.md): Increase Broker VM cache storage for Cortex XSIAM data collection. - [Monitor Broker VM using Prometheus](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/data-management/broker-vm/manage-broker-vm/monitor-broker-vm-using-prometheus.md): Monitor Cortex XSIAM Broker VM metrics with Prometheus. - [Collect Broker VM Logs](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/data-management/broker-vm/manage-broker-vm/collect-broker-vm-logs.md): Collect Broker VM logs for Cortex XSIAM troubleshooting. - [Upgrade Broker VM](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/data-management/broker-vm/manage-broker-vm/upgrade-broker-vm.md): Upgrade a Broker VM that supports Cortex XSIAM data collection. - [Update Broker VM applets independently](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/data-management/broker-vm/manage-broker-vm/update-broker-vm-applets-independently.md): Update Cortex XSIAM Broker VM applets independently. - [Import Broker VM Configuration](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/data-management/broker-vm/manage-broker-vm/import-broker-vm-configuration.md): Import Broker VM configuration for Cortex XSIAM data collection. - [Open Live Terminal](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/data-management/broker-vm/manage-broker-vm/open-live-terminal.md): Access a live terminal for a Cortex XSIAM Broker VM. - [Add Broker VM to cluster](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/data-management/broker-vm/manage-broker-vm/add-broker-vm-to-cluster.md): Add a Cortex XSIAM Broker VM to a cluster. - [Switchover Primary Node in Cluster](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/data-management/broker-vm/manage-broker-vm/switchover-primary-node-in-cluster.md): Switch the primary node in a Cortex XSIAM Broker VM cluster. - [Remove from Cluster](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/data-management/broker-vm/manage-broker-vm/remove-from-cluster.md): Remove a Broker VM from a Cortex XSIAM cluster. - [Manage Broker VM data collector applets](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/data-management/broker-vm/manage-broker-vm-data-collector-applets.md): Manage data collector applets on Cortex XSIAM Broker VMs. - [Broker VM High Availability Cluster](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/data-management/broker-vm/broker-vm-high-availability-cluster.md): Configure highly available Broker VM clusters for Cortex XSIAM. - [Configure High Availability Cluster](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/data-management/broker-vm/broker-vm-high-availability-cluster/configure-high-availability-cluster.md): Configure a high availability Broker VM cluster for Cortex XSIAM. - [Manage Broker VM clusters](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/data-management/broker-vm/broker-vm-high-availability-cluster/manage-broker-vm-clusters.md): Manage high availability Broker VM clusters in Cortex XSIAM. - [View cluster details](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/data-management/broker-vm/broker-vm-high-availability-cluster/manage-broker-vm-clusters/view-cluster-details.md): View details for a Cortex XSIAM Broker VM cluster. - [Edit cluster](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/data-management/broker-vm/broker-vm-high-availability-cluster/manage-broker-vm-clusters/edit-cluster.md): Edit configuration for a Cortex XSIAM Broker VM cluster. - [Add applet to cluster](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/data-management/broker-vm/broker-vm-high-availability-cluster/manage-broker-vm-clusters/add-applet-to-cluster.md): Add a data collector applet to a Cortex XSIAM Broker VM cluster. - [Add Broker VM to cluster](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/data-management/broker-vm/broker-vm-high-availability-cluster/manage-broker-vm-clusters/add-broker-vm-to-cluster.md): Add a Broker VM to a Cortex XSIAM high availability cluster. - [Remove cluster](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/data-management/broker-vm/broker-vm-high-availability-cluster/manage-broker-vm-clusters/remove-cluster.md): Remove a Cortex XSIAM Broker VM cluster. - [Broker VM notifications](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/data-management/broker-vm/broker-vm-notifications.md): Configure notifications for Cortex XSIAM Broker VM events. - [Monitor Broker VM activity](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/data-management/broker-vm/monitor-broker-vm-activity.md): Monitor Broker VM activity in Cortex XSIAM. - [Troubleshoot Broker VM applet errors](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/data-management/broker-vm/troubleshoot-broker-vm-applet-errors.md): Troubleshoot data collector applet errors on Cortex XSIAM Broker VMs. - [Dataset management](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/data-management/dataset-management.md): Manage Cortex XSIAM datasets, storage, and period-based retention. - [What are datasets?](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/data-management/dataset-management/what-are-datasets.md): Learn how Cortex XSIAM datasets store and organize your data. - [Lookup datasets](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/data-management/dataset-management/lookup-datasets.md): Create and manage lookup datasets in Cortex XSIAM. - [Import a lookup dataset](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/data-management/dataset-management/lookup-datasets/import-a-lookup-dataset.md): Import a lookup dataset into Cortex XSIAM. - [Download JSON file of lookup dataset](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/data-management/dataset-management/lookup-datasets/download-json-file-of-lookup-dataset.md): Download a lookup dataset as JSON from Cortex XSIAM. - [Set time to live for lookup datasets](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/data-management/dataset-management/lookup-datasets/set-time-to-live-for-lookup-datasets.md): Set retention periods for Cortex XSIAM lookup datasets. - [Monitor datasets and dataset views activity](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/data-management/dataset-management/monitor-datasets-and-dataset-views-activity.md): Monitor dataset and dataset view activity in Cortex XSIAM. - [Archived data](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/data-management/archived-data.md): Learn more about archived data in Cortex XSIAM. - [Import historical data into cold storage](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/data-management/archived-data/import-historical-data-into-cold-storage.md): Import historical data into Cortex XSIAM cold storage. - [Building XQL archived data queries](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/data-management/archived-data/building-xql-archived-data-queries.md): Build XQL queries for archived data in Cortex XSIAM. - [Success and failure code responses to your HTTP POST requests](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/data-management/archived-data/success-and-failure-code-responses-to-your-http-post-requests.md): Interpret HTTP POST responses when importing Cortex XSIAM archived data. - [Parsing Rules](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/data-management/parsing-rules.md): Learn more about Cortex XSIAM Parsing Rules. - [Parsing Rules editor views](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/data-management/parsing-rules/parsing-rules-editor-views.md): Navigate the Cortex XSIAM Parsing Rules editor. - [Parsing Rules file structure and syntax](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/data-management/parsing-rules/parsing-rules-file-structure-and-syntax.md): Learn Cortex XSIAM Parsing Rules file structure and XQLp syntax. - [INGEST](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/data-management/parsing-rules/parsing-rules-file-structure-and-syntax/ingest.md): Define INGEST sections in Cortex XSIAM Parsing Rules. - [fields](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/data-management/parsing-rules/parsing-rules-file-structure-and-syntax/ingest/fields.md): Use 'fields' in Cortex XSIAM Parsing Rules. - [parse\_cef](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/data-management/parsing-rules/parsing-rules-file-structure-and-syntax/ingest/parse_cef.md): Use \`parse\_cef\` in Cortex XSIAM Parsing Rules. - [parse\_cisco](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/data-management/parsing-rules/parsing-rules-file-structure-and-syntax/ingest/parse_cisco.md): Use \`parse\_cisco\` in Cortex XSIAM Parsing Rules. - [parse\_json](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/data-management/parsing-rules/parsing-rules-file-structure-and-syntax/ingest/parse_json.md): Use \`parse\_json\` in Cortex XSIAM Parsing Rules. - [COLLECT](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/data-management/parsing-rules/parsing-rules-file-structure-and-syntax/collect.md): Define COLLECT sections in Cortex XSIAM Parsing Rules. - [CONST](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/data-management/parsing-rules/parsing-rules-file-structure-and-syntax/const.md): Define reusable constants in Cortex XSIAM Parsing Rules. - [RULE](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/data-management/parsing-rules/parsing-rules-file-structure-and-syntax/rule.md): Define reusable rules in Cortex XSIAM Parsing Rules. - [EXTEND](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/data-management/parsing-rules/parsing-rules-file-structure-and-syntax/extend.md): Extend default rule logic in Cortex XSIAM Parsing Rules. - [Create Parsing Rules](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/data-management/parsing-rules/create-parsing-rules.md): Create custom Parsing Rules for Cortex XSIAM data. - [Troubleshooting Parsing rules errors](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/data-management/parsing-rules/troubleshooting-parsing-rules-errors.md): Troubleshoot parsing rule errors in Cortex XSIAM. - [Parsing Rules Raw Dataset](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/data-management/parsing-rules/parsing-rules-raw-dataset.md): Work with the raw dataset used by Cortex XSIAM Parsing Rules. - [Data Model Rules](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/data-management/data-model-rules.md): Map source data to the Cortex XSIAM data model using default or custom rules. - [Data Model Rules editor views](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/data-management/data-model-rules/data-model-rules-editor-views.md): Navigate the Cortex XSIAM Data Model Rules editor. - [Data Model Rules file structure and syntax](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/data-management/data-model-rules/data-model-rules-file-structure-and-syntax.md): Learn Cortex XSIAM Data Model Rules file structure and syntax. - [MODEL](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/data-management/data-model-rules/data-model-rules-file-structure-and-syntax/model.md): Define models in Cortex XSIAM Data Model Rules. - [RULE](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/data-management/data-model-rules/data-model-rules-file-structure-and-syntax/rule.md): Define rules in Cortex XSIAM Data Model Rules. - [Field structure](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/data-management/data-model-rules/data-model-rules-file-structure-and-syntax/field-structure.md): Define field structures in Cortex XSIAM Data Model Rules. - [How to map authentication events for analytics](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/data-management/data-model-rules/how-to-map-authentication-story-events.md): Map authentication events for Cortex XSIAM analytics. - [How to map network events for analytics](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/data-management/data-model-rules/how-to-map-network-events-for-analytics.md): Map network events for Cortex XSIAM analytics. - [Generate data model rules with AI (preview)](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/data-management/data-model-rules/generate-data-model-rules-with-ai-preview.md): Generate Cortex XSIAM Data Model Rules with AI. - [Create Data Model Rules](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/data-management/data-model-rules/create-data-model-rules.md): Create custom Data Model Rules in Cortex XSIAM. - [Troubleshooting Data Model Rules](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/data-management/data-model-rules/troubleshooting-data-model-rules.md): Troubleshoot Data Model Rules in Cortex XSIAM. - [Using data enrichment](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/data-management/data-model-rules/using-data-enrichment.md): Use data enrichment with Cortex XSIAM Data Model Rules. - [Data Model Rules notifications](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/data-management/data-model-rules/data-model-rules-notifications.md): Configure notifications for Cortex XSIAM Data Model Rules. - [Monitor Data Model Rules activity](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/data-management/data-model-rules/monitor-data-model-rules-activity.md): Monitor Data Model Rules activity in Cortex XSIAM. - [Manage Event Forwarding](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/data-management/manage-event-forwarding.md): Export Cortex XSIAM event logs to a temporary GCP storage bucket. - [Endpoints Event Forwarding - included/excluded fields by event type](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/data-management/manage-event-forwarding/endpoints-event-forwarding-included-excluded-fields-by-event-type.md): Review event forwarding fields by Cortex XSIAM event type. - [Manage compute units](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/data-management/manage-compute-units.md): Manage Cortex XSIAM compute units for API, Apps, and Cold Storage XQL queries. - [Manage compute unit usage](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/data-management/manage-compute-units/compute-units-usage.md): View compute unit consumption, set daily limits, and investigate XQL API query usage in Cortex XSIAM. - [Cortex XSIAM Data Sources and Connectors](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/cortex-xsiam-data-sources.md) - [What are Cortex XSIAM data sources and connectors?](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/cortex-xsiam-data-sources/what-are-cortex-xsiam-data-sources.md): Learn more about Cortex XSIAM Data Sources and connectors with a unified approach to integrations. - [What is the data source and connector catalog?](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/cortex-xsiam-data-sources/complete-data-source-catalog.md): Learn more about the complete data source and connector catalog available in Cortex XSIAM. - [Vendor-specific data sources and connectors](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/cortex-xsiam-data-sources/vendor-specific-data-sources-and-connectors.md): Browse vendor-specific data sources and connectors for Cortex XSIAM. - [1Password](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/cortex-xsiam-data-sources/vendor-specific-data-sources-and-connectors/1password.md): Configure the 1Password connector for Cortex XSIAM. - [1Password](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/cortex-xsiam-data-sources/vendor-specific-data-sources-and-connectors/1password/1password.md): Use 1Password data with Cortex XSIAM. - [Abnormal Security](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/cortex-xsiam-data-sources/vendor-specific-data-sources-and-connectors/abnormal-security.md): Configure the Abnormal Security connector for Cortex XSIAM. - [Abnormal Security](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/cortex-xsiam-data-sources/vendor-specific-data-sources-and-connectors/abnormal-security/abnormal-security.md): Use Abnormal Security data with Cortex XSIAM. - [Absolute](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/cortex-xsiam-data-sources/vendor-specific-data-sources-and-connectors/absolute.md): Configure the Absolute connector for Cortex XSIAM. - [Absolute](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/cortex-xsiam-data-sources/vendor-specific-data-sources-and-connectors/absolute/absolute.md): Use Absolute data with Cortex XSIAM. - [abuse.ch](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/cortex-xsiam-data-sources/vendor-specific-data-sources-and-connectors/abuse.ch.md): Configure the abuse.ch connector for Cortex XSIAM. - [abuse.ch](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/cortex-xsiam-data-sources/vendor-specific-data-sources-and-connectors/abuse.ch/abuse.ch.md): Use abuse.ch threat intelligence with Cortex XSIAM. - [AbuseIPDB](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/cortex-xsiam-data-sources/vendor-specific-data-sources-and-connectors/abuseipdb.md): Configure the AbuseIPDB connector for Cortex XSIAM. - [AbuseIPDB](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/cortex-xsiam-data-sources/vendor-specific-data-sources-and-connectors/abuseipdb/abuseipdb.md): Use AbuseIPDB data with Cortex XSIAM. - [Accenture](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/cortex-xsiam-data-sources/vendor-specific-data-sources-and-connectors/accenture.md): Configure the Accenture connector for Cortex XSIAM. - [Accenture](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/cortex-xsiam-data-sources/vendor-specific-data-sources-and-connectors/accenture/accenture.md): Use Accenture data with Cortex XSIAM. - [AdminByRequest](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/cortex-xsiam-data-sources/vendor-specific-data-sources-and-connectors/adminbyrequest.md): Configure the AdminByRequest connector for Cortex XSIAM. - [AdminByRequest](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/cortex-xsiam-data-sources/vendor-specific-data-sources-and-connectors/adminbyrequest/adminbyrequest.md): Use AdminByRequest data with Cortex XSIAM. - [Aha](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/cortex-xsiam-data-sources/vendor-specific-data-sources-and-connectors/aha.md): Configure the Aha connectors for Cortex XSIAM. - [Aha!](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/cortex-xsiam-data-sources/vendor-specific-data-sources-and-connectors/aha/aha.md): Use Aha! data with Cortex XSIAM. - [Aha](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/cortex-xsiam-data-sources/vendor-specific-data-sources-and-connectors/aha/aha-1.md): Use Aha data with Cortex XSIAM. - [AIOps](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/cortex-xsiam-data-sources/vendor-specific-data-sources-and-connectors/aiops.md): Configure the AIOps connector for Cortex XSIAM. - [AIOps](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/cortex-xsiam-data-sources/vendor-specific-data-sources-and-connectors/aiops/aiops.md): Use AIOps data with Cortex XSIAM. - [Akamai](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/cortex-xsiam-data-sources/vendor-specific-data-sources-and-connectors/akamai.md): Configure the Akamai connector for Cortex XSIAM. - [Akamai](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/cortex-xsiam-data-sources/vendor-specific-data-sources-and-connectors/akamai/akamai.md): Use Akamai data with Cortex XSIAM. - [AlgoSec](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/cortex-xsiam-data-sources/vendor-specific-data-sources-and-connectors/algosec.md): Configure the AlgoSec connector for Cortex XSIAM. - [AlgoSec](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/cortex-xsiam-data-sources/vendor-specific-data-sources-and-connectors/algosec/algosec.md): Use AlgoSec data with Cortex XSIAM. - [Alibaba Cloud](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/cortex-xsiam-data-sources/vendor-specific-data-sources-and-connectors/alibaba-cloud.md): Configure the Alibaba Cloud connector for Cortex XSIAM. - [Alibaba Cloud](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/cortex-xsiam-data-sources/vendor-specific-data-sources-and-connectors/alibaba-cloud/alibaba-cloud.md): Use Alibaba Cloud data with Cortex XSIAM. - [AlienVault](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/cortex-xsiam-data-sources/vendor-specific-data-sources-and-connectors/alienvault.md): Configure the AlienVault connector for Cortex XSIAM. - [AlienVault](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/cortex-xsiam-data-sources/vendor-specific-data-sources-and-connectors/alienvault/alienvault.md): Use AlienVault data with Cortex XSIAM. - [Amazon](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/cortex-xsiam-data-sources/vendor-specific-data-sources-and-connectors/amazon.md): Configure the Amazon data sources and connectors for Cortex XSIAM. - [Amazon Cloud Watch](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/cortex-xsiam-data-sources/vendor-specific-data-sources-and-connectors/amazon/amazon-cloud-watch.md): Use Amazon Cloud Watch data with Cortex XSIAM. - [Ingest logs from Amazon CloudWatch](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/cortex-xsiam-data-sources/vendor-specific-data-sources-and-connectors/amazon/amazon-cloud-watch/ingest-logs-from-amazon-cloudwatch.md): Ingest logs from Amazon CloudWatch in Cortex XSIAM. - [Amazon S3](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/cortex-xsiam-data-sources/vendor-specific-data-sources-and-connectors/amazon/amazon-s3.md): Use Amazon S3 data in Cortex XSIAM. - [Ingest audit logs from AWS CloudTrail](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/cortex-xsiam-data-sources/vendor-specific-data-sources-and-connectors/amazon/amazon-s3/ingest-audit-logs-from-aws-cloudtrail.md): Collect audit logs from AWS CloudTrail in Cortex XSIAM. - [Ingest network flow logs from Amazon S3](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/cortex-xsiam-data-sources/vendor-specific-data-sources-and-connectors/amazon/amazon-s3/ingest-network-flow-logs-from-amazon-s3.md): Collect network flow logs from Amazon S3 in Cortex XSIAM. - [Ingest generic logs from Amazon S3](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/cortex-xsiam-data-sources/vendor-specific-data-sources-and-connectors/amazon/amazon-s3/ingest-generic-logs-from-amazon-s3.md): Collect generic logs from Amazon S3 in Cortex XSIAM. - [Ingest network Route 53 logs from Amazon S3](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/cortex-xsiam-data-sources/vendor-specific-data-sources-and-connectors/amazon/amazon-s3/ingest-network-route-53-logs-from-amazon-s3.md): Collect network Route 53 logs from Amazon S3 in Cortex XSIAM. - [Create an assumed role](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/cortex-xsiam-data-sources/vendor-specific-data-sources-and-connectors/amazon/amazon-s3/create-an-assumed-role.md): Learn more about creating an assumed role in Cortex XSIAM. - [Create a Workload Federated Identity role](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/cortex-xsiam-data-sources/vendor-specific-data-sources-and-connectors/amazon/amazon-s3/create-a-workload-federated-identity-role.md): Learn more about creating a Workload Federated Identity role in Cortex XSIAM. - [Configure data collection from Amazon S3 manually](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/cortex-xsiam-data-sources/vendor-specific-data-sources-and-connectors/amazon/amazon-s3/configure-data-collection-from-amazon-s3-manually.md): Collect data from Amazon S3 manually in Cortex XSIAM. - [Amazon Web Services](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/cortex-xsiam-data-sources/vendor-specific-data-sources-and-connectors/amazon/amazon-web-services.md): Use Amazon Web Services in Cortex XSIAM. - [AWS Automation and Collection](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/cortex-xsiam-data-sources/vendor-specific-data-sources-and-connectors/amazon/aws-automation-and-collection.md): Use AWS Automation and Collection in Cortex XSIAM. - [Anomali](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/cortex-xsiam-data-sources/vendor-specific-data-sources-and-connectors/anomali.md): Configure the Anomali connector for Cortex XSIAM. - [Anomali](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/cortex-xsiam-data-sources/vendor-specific-data-sources-and-connectors/anomali/anomali.md): Use Anomali data with Cortex XSIAM. - [Anthropic](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/cortex-xsiam-data-sources/vendor-specific-data-sources-and-connectors/anthropic.md): Configure the Anthropic connectors for Cortex XSIAM. - [Claude Automation and Collection](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/cortex-xsiam-data-sources/vendor-specific-data-sources-and-connectors/anthropic/claude-automation-and-collection.md): Use Claude automation and collection with Cortex XSIAM. - [Claude](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/cortex-xsiam-data-sources/vendor-specific-data-sources-and-connectors/anthropic/claude.md): Use Claude with Cortex XSIAM. - [Apache](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/cortex-xsiam-data-sources/vendor-specific-data-sources-and-connectors/apache.md): Configure the Apache connector for Cortex XSIAM. - [Apache](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/cortex-xsiam-data-sources/vendor-specific-data-sources-and-connectors/apache/apache.md): Use Apache data with Cortex XSIAM. - [API Security](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/cortex-xsiam-data-sources/vendor-specific-data-sources-and-connectors/api-security.md): Use API data in Cortex XSIAM. - [Ingest data for API security](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/cortex-xsiam-data-sources/vendor-specific-data-sources-and-connectors/api-security/ingest-data-for-api-security.md): Collect API Security data with Cortex XSIAM. - [Ingest AWS API Gateway](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/cortex-xsiam-data-sources/vendor-specific-data-sources-and-connectors/api-security/ingest-data-for-api-security/ingest-aws-api-gateway.md): Collect AWS API Gateway data with Cortex XSIAM. - [Ingest Azure APIM](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/cortex-xsiam-data-sources/vendor-specific-data-sources-and-connectors/api-security/ingest-data-for-api-security/ingest-azure-apim.md): Collect Azure APIM data with Cortex XSIAM. - [Ingest Apigee Proxy](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/cortex-xsiam-data-sources/vendor-specific-data-sources-and-connectors/api-security/ingest-data-for-api-security/ingest-apigee-proxy.md): Collect Apigee Proxy data with Cortex XSIAM. - [Ingest Kong](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/cortex-xsiam-data-sources/vendor-specific-data-sources-and-connectors/api-security/ingest-data-for-api-security/ingest-kong.md): Collect Kong data with Cortex XSIAM. - [Ingest F5](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/cortex-xsiam-data-sources/vendor-specific-data-sources-and-connectors/api-security/ingest-data-for-api-security/ingest-f5.md): Collect F5 data with Cortex XSIAM. - [APIVoid](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/cortex-xsiam-data-sources/vendor-specific-data-sources-and-connectors/apivoid.md): Configure the APIVoid connector for Cortex XSIAM. - [APIVoid](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/cortex-xsiam-data-sources/vendor-specific-data-sources-and-connectors/apivoid/apivoid.md): Use APIVoid data with Cortex XSIAM. - [Apollo.io](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/cortex-xsiam-data-sources/vendor-specific-data-sources-and-connectors/apollo.io.md): Configure the Apollo.io connector for Cortex XSIAM. - [Apollo.io](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/cortex-xsiam-data-sources/vendor-specific-data-sources-and-connectors/apollo.io/apollo.io.md): Use Apollo.io data with Cortex XSIAM. - [AppSentinels](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/cortex-xsiam-data-sources/vendor-specific-data-sources-and-connectors/appsentinels.md): Configure the AppSentinels connector for Cortex XSIAM. - [AppSentinels](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/cortex-xsiam-data-sources/vendor-specific-data-sources-and-connectors/appsentinels/appsentinels.md): Use AppSentinels data with Cortex XSIAM. - [ArcSight](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/cortex-xsiam-data-sources/vendor-specific-data-sources-and-connectors/arcsight.md): Configure the ArcSight connector for Cortex XSIAM. - [ArcSight](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/cortex-xsiam-data-sources/vendor-specific-data-sources-and-connectors/arcsight/arcsight.md): Use ArcSight data with Cortex XSIAM. - [Arista Networks](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/cortex-xsiam-data-sources/vendor-specific-data-sources-and-connectors/arista-networks.md): Configure the Arista Networks connector for Cortex XSIAM. - [Arista Networks](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/cortex-xsiam-data-sources/vendor-specific-data-sources-and-connectors/arista-networks/arista-networks.md): Use Arista Networks data with Cortex XSIAM. - [Arkime](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/cortex-xsiam-data-sources/vendor-specific-data-sources-and-connectors/arkime.md): Configure the Arkime connector for Cortex XSIAM. - [Arkime](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/cortex-xsiam-data-sources/vendor-specific-data-sources-and-connectors/arkime/arkime.md): Use Arkime data with Cortex XSIAM. - [Armis](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/cortex-xsiam-data-sources/vendor-specific-data-sources-and-connectors/armis.md): Configure the Armis connector for Cortex XSIAM. - [Armis](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/cortex-xsiam-data-sources/vendor-specific-data-sources-and-connectors/armis/armis.md): Use Armis data with Cortex XSIAM. - [Articulate Global](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/cortex-xsiam-data-sources/vendor-specific-data-sources-and-connectors/articulate-global.md): Configure the Articulate Global connector for Cortex XSIAM. - [Articulate Global](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/cortex-xsiam-data-sources/vendor-specific-data-sources-and-connectors/articulate-global/articulate-global.md): Use Articulate Global data with Cortex XSIAM. - [Asana](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/cortex-xsiam-data-sources/vendor-specific-data-sources-and-connectors/asana.md): Configure the Asana connector for Cortex XSIAM. - [Asana](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/cortex-xsiam-data-sources/vendor-specific-data-sources-and-connectors/asana/asana.md): Use Asana data with Cortex XSIAM. - [Atlassian](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/cortex-xsiam-data-sources/vendor-specific-data-sources-and-connectors/atlassian.md): Configure the Atlassian connectors for Cortex XSIAM. - [Atlassian](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/cortex-xsiam-data-sources/vendor-specific-data-sources-and-connectors/atlassian/atlassian.md): Use Atlassian data with Cortex XSIAM. - [Atlassian Automation and Collection](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/cortex-xsiam-data-sources/vendor-specific-data-sources-and-connectors/atlassian/atlassian-automation-and-collection.md): Use Atlassian Automation and Collection data with Cortex XSIAM. - [AttackIQ](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/cortex-xsiam-data-sources/vendor-specific-data-sources-and-connectors/attackiq.md): Configure the AttackIQ connector for Cortex XSIAM. - [AttackIQ](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/cortex-xsiam-data-sources/vendor-specific-data-sources-and-connectors/attackiq/attackiq.md): Use AttackIQ data with Cortex XSIAM. - [Aurora Endpoint Security](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/cortex-xsiam-data-sources/vendor-specific-data-sources-and-connectors/aurora-endpoint-security.md): Configure the Aurora Endpoint Security connector for Cortex XSIAM. - [Aurora Endpoint Security](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/cortex-xsiam-data-sources/vendor-specific-data-sources-and-connectors/aurora-endpoint-security/aurora-endpoint-security.md): Use Aurora Endpoint Security data with Cortex XSIAM. - [Automox](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/cortex-xsiam-data-sources/vendor-specific-data-sources-and-connectors/automox.md): Configure the Automox connector for Cortex XSIAM. - [Automox](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/cortex-xsiam-data-sources/vendor-specific-data-sources-and-connectors/automox/automox.md): Use Automox data with Cortex XSIAM. - [BeyondTrust](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/cortex-xsiam-data-sources/vendor-specific-data-sources-and-connectors/beyondtrust.md): Configure the BeyondTrust data source and connector for Cortex XSIAM. - [BeyondTrust Privilege Management Cloud](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/cortex-xsiam-data-sources/vendor-specific-data-sources-and-connectors/beyondtrust/beyondtrust-privilege-management-cloud.md): Use BeyondTrust Privilege Management Cloud data with Cortex XSIAM. - [Ingest logs from BeyondTrust Privilege Management Cloud](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/cortex-xsiam-data-sources/vendor-specific-data-sources-and-connectors/beyondtrust/beyondtrust-privilege-management-cloud/ingest-logs-from-beyondtrust-privilege-management-cloud.md): Collect BeyondTrust Privilege Management Cloud data with Cortex XSIAM. - [BeyondTrust](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/cortex-xsiam-data-sources/vendor-specific-data-sources-and-connectors/beyondtrust/beyondtrust.md): Use BeyondTrust data with Cortex XSIAM. - [BitSight](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/cortex-xsiam-data-sources/vendor-specific-data-sources-and-connectors/bitsight.md): Configure the BitSight connector for Cortex XSIAM. - [BitSight](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/cortex-xsiam-data-sources/vendor-specific-data-sources-and-connectors/bitsight/bitsight.md): Use BitSight data with Cortex XSIAM. - [bitwarden](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/cortex-xsiam-data-sources/vendor-specific-data-sources-and-connectors/bitwarden.md): Configure the bitwarden connector for Cortex XSIAM. - [bitwarden](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/cortex-xsiam-data-sources/vendor-specific-data-sources-and-connectors/bitwarden/bitwarden.md): Use bitwarden data with Cortex XSIAM. - [Blocklist.de](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/cortex-xsiam-data-sources/vendor-specific-data-sources-and-connectors/blocklist.de.md): Configure the Blocklist.de connector for Cortex XSIAM. - [Blocklist.de](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/cortex-xsiam-data-sources/vendor-specific-data-sources-and-connectors/blocklist.de/blocklist.de.md): Use Blocklist.de data with Cortex XSIAM. - [BloodHound Enterprise](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/cortex-xsiam-data-sources/vendor-specific-data-sources-and-connectors/bloodhound-enterprise.md): Configure the BloodHound Enterprise connector for Cortex XSIAM. - [BloodHound Enterprise](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/cortex-xsiam-data-sources/vendor-specific-data-sources-and-connectors/bloodhound-enterprise/bloodhound-enterprise.md): Use BloodHound Enterprise data with Cortex XSIAM. - [BlueCat Address Manager](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/cortex-xsiam-data-sources/vendor-specific-data-sources-and-connectors/bluecat-address-manager.md): Configure the BlueCat Address Manager connector for Cortex XSIAM. - [BlueCat Address Manager](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/cortex-xsiam-data-sources/vendor-specific-data-sources-and-connectors/bluecat-address-manager/bluecat-address-manager.md): Use BlueCat Address Manager data with Cortex XSIAM. - [BMC](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/cortex-xsiam-data-sources/vendor-specific-data-sources-and-connectors/bmc.md): Configure the BMC connector for Cortex XSIAM. - [BMC](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/cortex-xsiam-data-sources/vendor-specific-data-sources-and-connectors/bmc/bmc.md): Use BMC data with Cortex XSIAM. - [Box](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/cortex-xsiam-data-sources/vendor-specific-data-sources-and-connectors/box.md): Configure the Box data source and connectors for Cortex XSIAM. - [Ingest logs and data from Box](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/cortex-xsiam-data-sources/vendor-specific-data-sources-and-connectors/box/ingest-logs-and-data-from-box.md): Collect Box data from Cortex XSIAM. - [Box Automation and Collection](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/cortex-xsiam-data-sources/vendor-specific-data-sources-and-connectors/box/box-automation-and-collection.md): Use BMC Automation and Collection data with Cortex XSIAM. - [Box](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/cortex-xsiam-data-sources/vendor-specific-data-sources-and-connectors/box/box.md): Use Box data with Cortex XSIAM. - [Broadcom](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/cortex-xsiam-data-sources/vendor-specific-data-sources-and-connectors/broadcom.md): Configure the Broadcom connector for Cortex XSIAM. - [Broadcom](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/cortex-xsiam-data-sources/vendor-specific-data-sources-and-connectors/broadcom/broadcom.md): Use Broadcom data with Cortex XSIAM. - [BruteForceBlocker](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/cortex-xsiam-data-sources/vendor-specific-data-sources-and-connectors/bruteforceblocker.md): Configure the BruteForceBlocker connector for Cortex XSIAM. - [BruteForceBlocker](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/cortex-xsiam-data-sources/vendor-specific-data-sources-and-connectors/bruteforceblocker/bruteforceblocker.md): Use BruteForceBlocker data with Cortex XSIAM. - [Businessmap](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/cortex-xsiam-data-sources/vendor-specific-data-sources-and-connectors/businessmap.md): Configure the Businessmap connector for Cortex XSIAM. - [Businessmap](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/cortex-xsiam-data-sources/vendor-specific-data-sources-and-connectors/businessmap/businessmap.md): Use Businessmap data with Cortex XSIAM. - [C2SEC](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/cortex-xsiam-data-sources/vendor-specific-data-sources-and-connectors/c2sec.md): Configure the C2SEC connector for Cortex XSIAM. - [C2SEC](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/cortex-xsiam-data-sources/vendor-specific-data-sources-and-connectors/c2sec/c2sec.md): Use C2SEC data with Cortex XSIAM. - [CAPESandbox](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/cortex-xsiam-data-sources/vendor-specific-data-sources-and-connectors/capesandbox.md): Configure the CAPESandbox connector for Cortex XSIAM. - [CAPESandbox](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/cortex-xsiam-data-sources/vendor-specific-data-sources-and-connectors/capesandbox/capesandbox.md): Use CAPESandbox data with Cortex XSIAM. - [Carbon Black](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/cortex-xsiam-data-sources/vendor-specific-data-sources-and-connectors/carbon-black.md): Configure the Carbon Black connector for Cortex XSIAM. - [Carbon Black](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/cortex-xsiam-data-sources/vendor-specific-data-sources-and-connectors/carbon-black/carbon-black.md): Use Carbon Black data with Cortex XSIAM. - [Celonis](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/cortex-xsiam-data-sources/vendor-specific-data-sources-and-connectors/celonis.md): Configure the Celonis connectors for Cortex XSIAM. - [Celonis Collection](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/cortex-xsiam-data-sources/vendor-specific-data-sources-and-connectors/celonis/celonis-collection.md): Use Celonis Collection data with Cortex XSIAM. - [Celonis](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/cortex-xsiam-data-sources/vendor-specific-data-sources-and-connectors/celonis/celonis.md): Use Celonis data with Cortex XSIAM. - [Centreon](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/cortex-xsiam-data-sources/vendor-specific-data-sources-and-connectors/centreon.md): Configure the Centreon connector for Cortex XSIAM. - [Centreon](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/cortex-xsiam-data-sources/vendor-specific-data-sources-and-connectors/centreon/centreon.md): Use Centreon data with Cortex XSIAM. - [ChatGPT Enterprise](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/cortex-xsiam-data-sources/vendor-specific-data-sources-and-connectors/chatgpt-enterprise.md): Configure the ChatGPT Enterprise connector for Cortex XSIAM. - [ChatGPT Enterprise](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/cortex-xsiam-data-sources/vendor-specific-data-sources-and-connectors/chatgpt-enterprise/chatgpt-enterprise.md): Use ChatGPT Enterprise data with Cortex XSIAM. - [Check Point](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/cortex-xsiam-data-sources/vendor-specific-data-sources-and-connectors/check-point.md): Configure the Check Point data source and connector for Cortex XSIAM. - [Check Point FW1/VPN1](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/cortex-xsiam-data-sources/vendor-specific-data-sources-and-connectors/check-point/check-point-fw1-vpn1.md): Use Check Point FW1/VPN1 data with Cortex XSIAM. - [Checkpoint Firewall](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/cortex-xsiam-data-sources/vendor-specific-data-sources-and-connectors/check-point/checkpoint-firewall.md): Use Checkpoint Firewall data with Cortex XSIAM. - [CheckPhish](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/cortex-xsiam-data-sources/vendor-specific-data-sources-and-connectors/checkphish.md): Configure the CheckPhish connector for Cortex XSIAM. - [CheckPhish](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/cortex-xsiam-data-sources/vendor-specific-data-sources-and-connectors/checkphish/checkphish.md): Use CheckPhish data with Cortex XSIAM. - [CipherTrust](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/cortex-xsiam-data-sources/vendor-specific-data-sources-and-connectors/ciphertrust.md): Configure the CipherTrust connector for Cortex XSIAM. - [CipherTrust](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/cortex-xsiam-data-sources/vendor-specific-data-sources-and-connectors/ciphertrust/ciphertrust.md): Use CipherTrust data with Cortex XSIAM. - [CIRCL](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/cortex-xsiam-data-sources/vendor-specific-data-sources-and-connectors/circl.md): Configure the CIRCL connector for Cortex XSIAM. - [CIRCL](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/cortex-xsiam-data-sources/vendor-specific-data-sources-and-connectors/circl/circl.md): Use CIRCL data with Cortex XSIAM. - [CircleCI](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/cortex-xsiam-data-sources/vendor-specific-data-sources-and-connectors/circleci.md): Configure the CircleCI connector for Cortex XSIAM. - [CircleCI](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/cortex-xsiam-data-sources/vendor-specific-data-sources-and-connectors/circleci/circleci.md): Use CircleCI data with Cortex XSIAM. - [Cisco](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/cortex-xsiam-data-sources/vendor-specific-data-sources-and-connectors/cisco.md): Configure the Cisco data sources and connectors for Cortex XSIAM. - [Cisco ASA firewalls and AnyConnect](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/cortex-xsiam-data-sources/vendor-specific-data-sources-and-connectors/cisco/cisco-asa-firewalls-and-anyconnect.md): Use Cisco ASA firewalls and AnyConnect data with Cortex XSIAM. - [Cisco ASA](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/cortex-xsiam-data-sources/vendor-specific-data-sources-and-connectors/cisco/cisco-asa.md): Use Cisco ASA data with Cortex XSIAM. - [Cisco Duo](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/cortex-xsiam-data-sources/vendor-specific-data-sources-and-connectors/cisco/cisco-duo.md): Use Cisco Duo data with Cortex XSIAM. - [Cisco DUO Automation and Collection](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/cortex-xsiam-data-sources/vendor-specific-data-sources-and-connectors/cisco/cisco-duo-automation-and-collection.md): Use Cisco DUO Automation and Collection data with Cortex XSIAM. - [Cisco Firepower](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/cortex-xsiam-data-sources/vendor-specific-data-sources-and-connectors/cisco/cisco-firepower.md): Use Cisco Firepower data with Cortex XSIAM. - [Cisco ISE](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/cortex-xsiam-data-sources/vendor-specific-data-sources-and-connectors/cisco/cisco-ise.md): Use Cisco ISE data with Cortex XSIAM. - [Cisco Meraki](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/cortex-xsiam-data-sources/vendor-specific-data-sources-and-connectors/cisco/cisco-meraki.md): Use Cisco Meraki data with Cortex XSIAM. - [Cisco Meraki Automation and Remediation](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/cortex-xsiam-data-sources/vendor-specific-data-sources-and-connectors/cisco/cisco-meraki-automation-and-remediation.md): Use Cisco Meraki Automation and Remediation data with Cortex XSIAM. - [Cisco Security](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/cortex-xsiam-data-sources/vendor-specific-data-sources-and-connectors/cisco/cisco-security.md): Use Cisco Security data with Cortex XSIAM. - [Cisco Umbrella](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/cortex-xsiam-data-sources/vendor-specific-data-sources-and-connectors/cisco/cisco-umbrella.md): Use Cisco Umbrella data with Cortex XSIAM. - [Citrix](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/cortex-xsiam-data-sources/vendor-specific-data-sources-and-connectors/citrix.md): Configure the Citrix connector for Cortex XSIAM. - [Citrix](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/cortex-xsiam-data-sources/vendor-specific-data-sources-and-connectors/citrix/citrix.md): Use Citrix data with Cortex XSIAM. - [ClickUp](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/cortex-xsiam-data-sources/vendor-specific-data-sources-and-connectors/clickup.md): Configure the ClickUp connector for Cortex XSIAM. - [ClickUp](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/cortex-xsiam-data-sources/vendor-specific-data-sources-and-connectors/clickup/clickup.md): Use ClickUp data with Cortex XSIAM. - [Cloaken](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/cortex-xsiam-data-sources/vendor-specific-data-sources-and-connectors/cloaken.md): Configure the Cloaken connector for Cortex XSIAM. - [Cloaken](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/cortex-xsiam-data-sources/vendor-specific-data-sources-and-connectors/cloaken/cloaken.md): Use Cloaken data with Cortex XSIAM. - [CloudConvert](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/cortex-xsiam-data-sources/vendor-specific-data-sources-and-connectors/cloudconvert.md): Configure the CloudConvert connector for Cortex XSIAM. - [CloudConvert](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/cortex-xsiam-data-sources/vendor-specific-data-sources-and-connectors/cloudconvert/cloudconvert.md): Use CloudConvert data with Cortex XSIAM. - [Cloudflare](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/cortex-xsiam-data-sources/vendor-specific-data-sources-and-connectors/cloudflare.md): Configure the Cloudflare connector for Cortex XSIAM. - [Cloudflare](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/cortex-xsiam-data-sources/vendor-specific-data-sources-and-connectors/cloudflare/cloudflare.md): Use Cloudflate with Cortex XSIAM. - [Code42](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/cortex-xsiam-data-sources/vendor-specific-data-sources-and-connectors/code42.md): Configure the Code42 connector for Cortex XSIAM. - [Code42](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/cortex-xsiam-data-sources/vendor-specific-data-sources-and-connectors/code42/code42.md): Use Code42 data with Cortex XSIAM. - [Cohesity](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/cortex-xsiam-data-sources/vendor-specific-data-sources-and-connectors/cohesity.md): Configure the Cohesity connector for Cortex XSIAM. - [Cohesity](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/cortex-xsiam-data-sources/vendor-specific-data-sources-and-connectors/cohesity/cohesity.md): Use Cohesity data with Cortex XSIAM. - [Contentful](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/cortex-xsiam-data-sources/vendor-specific-data-sources-and-connectors/contentful.md): Configure the Contentful connector for Cortex XSIAM. - [Contentful](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/cortex-xsiam-data-sources/vendor-specific-data-sources-and-connectors/contentful/contentful.md): Use Contentful data with Cortex XSIAM. - [Corelight](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/cortex-xsiam-data-sources/vendor-specific-data-sources-and-connectors/corelight.md): Configure the Corelight data source for Cortex XSIAM. - [Corelight Zeek](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/cortex-xsiam-data-sources/vendor-specific-data-sources-and-connectors/corelight/corelight-zeek.md): Use Corelight Zeek data with Cortex XSIAM. - [Couchbase](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/cortex-xsiam-data-sources/vendor-specific-data-sources-and-connectors/couchbase.md): Configure the Couchbase connector for Cortex XSIAM. - [Couchbase](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/cortex-xsiam-data-sources/vendor-specific-data-sources-and-connectors/couchbase/couchbase.md): Use Couchbase data with Cortex XSIAM. - [CounterTack](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/cortex-xsiam-data-sources/vendor-specific-data-sources-and-connectors/countertack.md): Configure the CounterTrack connector for Cortex XSIAM. - [CounterTack](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/cortex-xsiam-data-sources/vendor-specific-data-sources-and-connectors/countertack/countertack.md): Use CounterTrack data with Cortex XSIAM. - [Coveo](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/cortex-xsiam-data-sources/vendor-specific-data-sources-and-connectors/coveo.md): Configure the Coveo connector for Cortex XSIAM. - [Coveo](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/cortex-xsiam-data-sources/vendor-specific-data-sources-and-connectors/coveo/coveo.md): Use Coveo data with Cortex XSIAM. - [Cribl](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/cortex-xsiam-data-sources/vendor-specific-data-sources-and-connectors/cribl.md): Configure the Cribl data source and connector for Cortex XSIAM. - [Ingest data from Cribl](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/cortex-xsiam-data-sources/vendor-specific-data-sources-and-connectors/cribl/ingest-data-from-cribl.md): Collect Cribl data with Cortex XSIAM. - [Disable or delete Cribl integration](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/cortex-xsiam-data-sources/vendor-specific-data-sources-and-connectors/cribl/ingest-data-from-cribl/disable-or-delete-cribl-integration.md): Learn more on disabling or deleting Cribl integrations in Cortex XSIAM. - [Data source UUIDs](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/cortex-xsiam-data-sources/vendor-specific-data-sources-and-connectors/cribl/ingest-data-from-cribl/data-souce-uuids.md): View the Cribl catalog for the supported collectors. - [Collect Windows Event Logs for Cortex XSIAM via Cribl](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/cortex-xsiam-data-sources/vendor-specific-data-sources-and-connectors/cribl/ingest-data-from-cribl/collect-windows-event-logs-for-cortex-xsiam-via-cribl.md): Learn more on collecting Windows Event Logs for Cortex XSIAM using Cribl. - [Cribl connector](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/cortex-xsiam-data-sources/vendor-specific-data-sources-and-connectors/cribl/cribl-connector.md): Use Cribl connector data with Cortex XSIAM. - [CrowdStrike](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/cortex-xsiam-data-sources/vendor-specific-data-sources-and-connectors/crowdstrike.md): Configure the CrowdStrike data sources and connector for Cortex XSIAM. - [Crowdstrike APIs](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/cortex-xsiam-data-sources/vendor-specific-data-sources-and-connectors/crowdstrike/crowdstrike-apis.md): Use Crowdstrike APIs data with Cortex XSIAM. - [Ingest alerts and metadata from Crowdstrike APIs](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/cortex-xsiam-data-sources/vendor-specific-data-sources-and-connectors/crowdstrike/crowdstrike-apis/ingest-alerts-and-metadata-from-crowdstrike-apis.md): Collect Crowdstrike APIs data with Cortex XSIAM. - [CrowdStrike Falcon Data Replicator](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/cortex-xsiam-data-sources/vendor-specific-data-sources-and-connectors/crowdstrike/crowdstrike-falcon-data-replicator.md): Use Crowdstrike Falcom Data Replicator data with Cortex XSIAM. - [Ingest raw EDR events from CrowdStrike Falcon Data Replicator](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/cortex-xsiam-data-sources/vendor-specific-data-sources-and-connectors/crowdstrike/crowdstrike-falcon-data-replicator/ingest-raw-edr-events-from-crowdstrike-falcon-data-replicator.md): Collect CrowdStrike Falcon Data Replicator data with Cortex XSIAM. - [CrowdStrike](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/cortex-xsiam-data-sources/vendor-specific-data-sources-and-connectors/crowdstrike/crowdstrike.md): Use CrowdStrike data with Cortex XSIAM. - [CryptoCurrency](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/cortex-xsiam-data-sources/vendor-specific-data-sources-and-connectors/cryptocurrency.md): Configure the CryptoCurrency connector for Cortex XSIAM. - [CryptoCurrency](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/cortex-xsiam-data-sources/vendor-specific-data-sources-and-connectors/cryptocurrency/cryptocurrency.md): Use CryptoCurrency data with Cortex XSIAM. - [Cuckoo Sandbox](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/cortex-xsiam-data-sources/vendor-specific-data-sources-and-connectors/cuckoo-sandbox.md): Configure the Cuckoo Sandbox connector for Cortex XSIAM. - [Cuckoo Sandbox](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/cortex-xsiam-data-sources/vendor-specific-data-sources-and-connectors/cuckoo-sandbox/cuckoo-sandbox.md): Use Cuckoo Sandbox data with Cortex XSIAM. - [Cursor](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/cortex-xsiam-data-sources/vendor-specific-data-sources-and-connectors/cursor.md): Configure the Cursor connector for Cortex XSIAM. - [Cursor](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/cortex-xsiam-data-sources/vendor-specific-data-sources-and-connectors/cursor/cursor.md): Use Cursor data with Cortex XSIAM. - [CybelAngel](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/cortex-xsiam-data-sources/vendor-specific-data-sources-and-connectors/cybelangel.md): Configure the CybelAngel connector for Cortex XSIAM. - [CybelAngel](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/cortex-xsiam-data-sources/vendor-specific-data-sources-and-connectors/cybelangel/cybelangel.md): Use CyberAngel data with Cortex XSIAM. - [CyberArk](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/cortex-xsiam-data-sources/vendor-specific-data-sources-and-connectors/cyberark.md): Configure the CyberArk connector for Cortex XSIAM. - [CyberArk](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/cortex-xsiam-data-sources/vendor-specific-data-sources-and-connectors/cyberark/cyberark.md): Use CyberArk data with Cortex XSIAM. - [Cyber Triage](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/cortex-xsiam-data-sources/vendor-specific-data-sources-and-connectors/cyber-triage.md): Configure the Cyber Triage connector for Cortex XSIAM. - [Cyber Triage](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/cortex-xsiam-data-sources/vendor-specific-data-sources-and-connectors/cyber-triage/cyber-triage.md): Use Cyber Triage data with Cortex XSIAM. - [CYFIRMA](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/cortex-xsiam-data-sources/vendor-specific-data-sources-and-connectors/cyfirma.md) - [CYFIRMA](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/cortex-xsiam-data-sources/vendor-specific-data-sources-and-connectors/cyfirma/cyfirma.md) - [Darktrace](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/cortex-xsiam-data-sources/vendor-specific-data-sources-and-connectors/darktrace.md): Configure the Darktrace connector for Cortex XSIAM. - [Darktrace](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/cortex-xsiam-data-sources/vendor-specific-data-sources-and-connectors/darktrace/darktrace.md): Use Darktrace data with Cortex XSIAM. - [Databricks](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/cortex-xsiam-data-sources/vendor-specific-data-sources-and-connectors/databricks.md): Configure the Databricks data source and connector for Cortex XSIAM. - [How to onboard Databricks](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/cortex-xsiam-data-sources/vendor-specific-data-sources-and-connectors/databricks/how-to-onboard-databricks.md): Collect Databricks data in Cortex XSIAM. - [Databricks](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/cortex-xsiam-data-sources/vendor-specific-data-sources-and-connectors/databricks/databricks.md): Use Databricks data with Cortex XSIAM. - [DataDog](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/cortex-xsiam-data-sources/vendor-specific-data-sources-and-connectors/datadog.md) - [DataDog](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/cortex-xsiam-data-sources/vendor-specific-data-sources-and-connectors/datadog/datadog.md): Use DataDog data with Cortex XSIAM. - [DeHashed](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/cortex-xsiam-data-sources/vendor-specific-data-sources-and-connectors/dehashed.md): Configure the DeHashed connector for Cortex XSIAM. - [DeHashed](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/cortex-xsiam-data-sources/vendor-specific-data-sources-and-connectors/dehashed/dehashed.md): Use DeHashed data with Cortex XSIAM. - [DHS](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/cortex-xsiam-data-sources/vendor-specific-data-sources-and-connectors/dhs.md): Configure the DHS connector for Cortex XSIAM. - [DHS](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/cortex-xsiam-data-sources/vendor-specific-data-sources-and-connectors/dhs/dhs.md): Use DHS data with Cortex XSIAM. - [digicert](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/cortex-xsiam-data-sources/vendor-specific-data-sources-and-connectors/digicert.md): Configure the digicert connector for Cortex XSIAM. - [digicert](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/cortex-xsiam-data-sources/vendor-specific-data-sources-and-connectors/digicert/digicert.md): Use digicert data with Cortex XSIAM. - [dnstwist](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/cortex-xsiam-data-sources/vendor-specific-data-sources-and-connectors/dnstwist.md): Configure the dnstwist connector for Cortex XSIAM. - [dnstwist](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/cortex-xsiam-data-sources/vendor-specific-data-sources-and-connectors/dnstwist/dnstwist.md): Use dnstwist data with Cortex XSIAM. - [Docker](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/cortex-xsiam-data-sources/vendor-specific-data-sources-and-connectors/docker.md): Configure the Docker data sources for Cortex XSIAM. - [Connect Docker Hub registry](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/cortex-xsiam-data-sources/vendor-specific-data-sources-and-connectors/docker/connect-docker-hub-registry.md): Connect a Docker Hub registry to Cortex XSIAM for container image scanning. - [Manage a Docker Hub connector](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/cortex-xsiam-data-sources/vendor-specific-data-sources-and-connectors/docker/connect-docker-hub-registry/manage-a-docker-hub-connector.md): Manage the Docker Hub registry connector in Cortex XSIAM. - [Connect Docker V2 compliant container registry](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/cortex-xsiam-data-sources/vendor-specific-data-sources-and-connectors/docker/connect-docker-v2-compliant-container-registry.md): Connect a Docker V2-compliant registry to Cortex XSIAM for container image scanning. - [Manage a Docker V2 connector](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/cortex-xsiam-data-sources/vendor-specific-data-sources-and-connectors/docker/connect-docker-v2-compliant-container-registry/manage-a-docker-v2-connector.md): Manage the Docker V2-compliant registry connector in Cortex XSIAM. - [DocuSign](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/cortex-xsiam-data-sources/vendor-specific-data-sources-and-connectors/docusign.md): Configure the DocuSign connector for Cortex XSIAM. - [DocuSign](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/cortex-xsiam-data-sources/vendor-specific-data-sources-and-connectors/docusign/docusign.md): Use DocuSign data with Cortex XSIAM. - [Dropbox](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/cortex-xsiam-data-sources/vendor-specific-data-sources-and-connectors/dropbox.md): Configure the Dropbox data source and connector for Cortex XSIAM. - [Ingest logs and data from Dropbox](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/cortex-xsiam-data-sources/vendor-specific-data-sources-and-connectors/dropbox/ingest-logs-and-data-from-dropbox.md): Collect dropbox data in Cortex XSIAM. - [Dropbox](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/cortex-xsiam-data-sources/vendor-specific-data-sources-and-connectors/dropbox/dropbox.md): Use Dropbox data with Cortex XSIAM. - [Druva](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/cortex-xsiam-data-sources/vendor-specific-data-sources-and-connectors/druva.md): Configure the Druva connector for Cortex XSIAM. - [Druva](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/cortex-xsiam-data-sources/vendor-specific-data-sources-and-connectors/druva/druva.md): Use Druva data with Cortex XSIAM. - [EasyVista](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/cortex-xsiam-data-sources/vendor-specific-data-sources-and-connectors/easyvista.md): Configure the EasyVista connector for Cortex XSIAM. - [EasyVista](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/cortex-xsiam-data-sources/vendor-specific-data-sources-and-connectors/easyvista/easyvista.md): Use EasyVista data with Cortex XSIAM. - [Email Hippo](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/cortex-xsiam-data-sources/vendor-specific-data-sources-and-connectors/email-hippo.md): Configure the Email Hippo connector for Cortex XSIAM. - [Email Hippo](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/cortex-xsiam-data-sources/vendor-specific-data-sources-and-connectors/email-hippo/email-hippo.md): Use Email Hippo data with Cortex XSIAM. - [Elastic](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/cortex-xsiam-data-sources/vendor-specific-data-sources-and-connectors/elastic.md): Configure the Elastic data sources and connectors for Cortex XSIAM. - [Elasticsearch Filebeat](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/cortex-xsiam-data-sources/vendor-specific-data-sources-and-connectors/elastic/elasticsearch-filebeat.md): Use Elasticsearch Filebeat data with Cortex XSIAM. - [Ingest logs from Elasticsearch Filebeat](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/cortex-xsiam-data-sources/vendor-specific-data-sources-and-connectors/elastic/elasticsearch-filebeat/ingest-logs-from-elasticsearch-filebeat.md): Collect Elasticsearch Filebeat data with Cortex XSIAM. - [Windows DHCP via Elasticsearch Filebeat](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/cortex-xsiam-data-sources/vendor-specific-data-sources-and-connectors/elastic/windows-dhcp-via-elasticsearch-filebeat.md): Use Windows DHCP data using Elasticsearch Filebeat with Cortex XSIAM. - [Ingest logs from Windows DHCP using Elasticsearch Filebeat](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/cortex-xsiam-data-sources/vendor-specific-data-sources-and-connectors/elastic/windows-dhcp-via-elasticsearch-filebeat/ingest-logs-from-windows-dhcp-using-elasticsearch-filebeat.md): Collect Windows DHCP data using Elasticsearch Filebeat with Cortex XSIAM. - [ElasticSearch](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/cortex-xsiam-data-sources/vendor-specific-data-sources-and-connectors/elastic/elasticsearch.md): Use ElasticSearch data with Cortex XSIAM. - [Endgame](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/cortex-xsiam-data-sources/vendor-specific-data-sources-and-connectors/endgame.md): Configure the Endgame connector for Cortex XSIAM. - [Endgame](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/cortex-xsiam-data-sources/vendor-specific-data-sources-and-connectors/endgame/endgame.md): Use Endgame data with Cortex XSIAM. - [Envoy](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/cortex-xsiam-data-sources/vendor-specific-data-sources-and-connectors/envoy.md): Configure the Envoy connector for Cortex XSIAM. - [Envoy](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/cortex-xsiam-data-sources/vendor-specific-data-sources-and-connectors/envoy/envoy.md): Use Envoy data with Cortex XSIAM. - [Exabeam](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/cortex-xsiam-data-sources/vendor-specific-data-sources-and-connectors/exabeam.md): Configure the Exabeam connector for Cortex XSIAM. - [Exabeam](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/cortex-xsiam-data-sources/vendor-specific-data-sources-and-connectors/exabeam/exabeam.md): Use Exabeam data with Cortex XSIAM. - [ExtraHop](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/cortex-xsiam-data-sources/vendor-specific-data-sources-and-connectors/extrahop.md): Configure the ExtraHop connector for Cortex XSIAM. - [ExtraHop](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/cortex-xsiam-data-sources/vendor-specific-data-sources-and-connectors/extrahop/extrahop.md): Use ExtraHop data with Cortex XSIAM. - [F5](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/cortex-xsiam-data-sources/vendor-specific-data-sources-and-connectors/f5.md): Configure the F5 connector for Cortex XSIAM. - [F5 Automation and Remediation](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/cortex-xsiam-data-sources/vendor-specific-data-sources-and-connectors/f5/f5-automation-and-remediation.md): Use F5 Automation and Remediation data with Cortex XSIAM. - [Fastly](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/cortex-xsiam-data-sources/vendor-specific-data-sources-and-connectors/fastly.md): Configure the Fastly connector for Cortex XSIAM. - [Fastly](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/cortex-xsiam-data-sources/vendor-specific-data-sources-and-connectors/fastly/fastly.md): Use Fastly data with Cortex XSIAM. - [Fidelis](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/cortex-xsiam-data-sources/vendor-specific-data-sources-and-connectors/fidelis.md): Configure the Fidelis connector for Cortex XSIAM. - [Fidelis](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/cortex-xsiam-data-sources/vendor-specific-data-sources-and-connectors/fidelis/fidelis.md): Use Fidelis data with Cortex XSIAM. - [Filigran](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/cortex-xsiam-data-sources/vendor-specific-data-sources-and-connectors/filigran.md): Configure the Filigran connector for Cortex XSIAM. - [Filigran OpenCTI](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/cortex-xsiam-data-sources/vendor-specific-data-sources-and-connectors/filigran/filigran-opencti.md): Use Filigran OpenCTI data with Cortex XSIAM. - [Forcepoint](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/cortex-xsiam-data-sources/vendor-specific-data-sources-and-connectors/forcepoint.md): Configure the Forcepoint data source and connector for Cortex XSIAM. - [Forcepoint DLP](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/cortex-xsiam-data-sources/vendor-specific-data-sources-and-connectors/forcepoint/forcepoint-dlp.md): Use Forcepoint DLP data with Cortex XSIAM. - [Forcepoint](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/cortex-xsiam-data-sources/vendor-specific-data-sources-and-connectors/forcepoint/forcepoint.md): Use Forcepoint data with Cortex XSIAM. - [ForeScout](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/cortex-xsiam-data-sources/vendor-specific-data-sources-and-connectors/forescout.md): Configure the ForeScout connector for Cortex XSIAM. - [ForeScout](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/cortex-xsiam-data-sources/vendor-specific-data-sources-and-connectors/forescout/forescout.md): Use ForeScout data with Cortex XSIAM. - [Fortinet](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/cortex-xsiam-data-sources/vendor-specific-data-sources-and-connectors/fortinet.md): Configure the Fortinet data source and connectors for Cortex XSIAM. - [Fortinet Fortigate](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/cortex-xsiam-data-sources/vendor-specific-data-sources-and-connectors/fortinet/fortinet-fortigate.md): Collect Fortinet Fortigate data with Cortex XSIAM. - [Fortinet FortiGate connector](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/cortex-xsiam-data-sources/vendor-specific-data-sources-and-connectors/fortinet/fortinet-fortigate/fortinet-fortigate-connector.md): Use Fortinet FortiGate data with Cortex XSIAM. - [Fortinet](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/cortex-xsiam-data-sources/vendor-specific-data-sources-and-connectors/fortinet/fortinet.md): Use Fortinet data with Cortex XSIAM. - [Fortinet FortiWeb VM](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/cortex-xsiam-data-sources/vendor-specific-data-sources-and-connectors/fortinet/fortinet-fortiweb-vm.md): Use Fortinet FortiWeb VM data with Cortex XSIAM. - [Fortra](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/cortex-xsiam-data-sources/vendor-specific-data-sources-and-connectors/fortra.md): Configure the Fortra connector for Cortex XSIAM. - [Fortra](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/cortex-xsiam-data-sources/vendor-specific-data-sources-and-connectors/fortra/fortra.md): Use Fortra data with Cortex XSIAM. - [FraudWatch](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/cortex-xsiam-data-sources/vendor-specific-data-sources-and-connectors/fraudwatch.md): Configure the FraudWatch connector for Cortex XSIAM. - [FraudWatch](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/cortex-xsiam-data-sources/vendor-specific-data-sources-and-connectors/fraudwatch/fraudwatch.md): Use FraudWatch data with Cortex XSIAM. - [Freshworks](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/cortex-xsiam-data-sources/vendor-specific-data-sources-and-connectors/freshworks.md): Configure the Freshworks connector for Cortex XSIAM. - [Freshworks](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/cortex-xsiam-data-sources/vendor-specific-data-sources-and-connectors/freshworks/freshworks.md): Use Freshworks data with Cortex XSIAM. - [Gainsight](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/cortex-xsiam-data-sources/vendor-specific-data-sources-and-connectors/gainsight.md): Configure the Gainsight connector for Cortex XSIAM. - [Gainsight](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/cortex-xsiam-data-sources/vendor-specific-data-sources-and-connectors/gainsight/gainsight.md): Use Gainsight data with Cortex XSIAM. - [Gamma.AI](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/cortex-xsiam-data-sources/vendor-specific-data-sources-and-connectors/gamma.ai.md): Configure the Gamma.AI connector for Cortex XSIAM. - [Gamma.AI](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/cortex-xsiam-data-sources/vendor-specific-data-sources-and-connectors/gamma.ai/gamma.ai.md): Use Gamma.AI data with Cortex XSIAM. - [Gemini Enterprise](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/cortex-xsiam-data-sources/vendor-specific-data-sources-and-connectors/gemini-enterprise.md): Configure the Gemini Enterprise connector for Cortex XSIAM. - [Gemini Enterprise](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/cortex-xsiam-data-sources/vendor-specific-data-sources-and-connectors/gemini-enterprise/gemini-enterprise.md): Use Gemini Enterprise data with Cortex XSIAM. - [Genetec](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/cortex-xsiam-data-sources/vendor-specific-data-sources-and-connectors/genetec.md): Configure the Genetec connector for Cortex XSIAM. - [Genetec Security Center](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/cortex-xsiam-data-sources/vendor-specific-data-sources-and-connectors/genetec/genetec-security-center.md): Use Genetec Security Center data with Cortex XSIAM. - [Generic](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/cortex-xsiam-data-sources/vendor-specific-data-sources-and-connectors/generic.md): Configure the Generic connectors for Cortex XSIAM. - [Generic Intel Feed](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/cortex-xsiam-data-sources/vendor-specific-data-sources-and-connectors/generic/generic-intel-feed.md): Use Generic Intel Feed data with Cortex XSIAM. - [Generic API Event Collector](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/cortex-xsiam-data-sources/vendor-specific-data-sources-and-connectors/generic/generic-api-event-collector.md): Use Generic API Event Collector data with Cortex XSIAM. - [Generic MCP](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/cortex-xsiam-data-sources/vendor-specific-data-sources-and-connectors/generic/generic-mcp.md): Use Generic MCP data with Cortex XSIAM. - [Generic SQL](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/cortex-xsiam-data-sources/vendor-specific-data-sources-and-connectors/generic/generic-sql.md): Use Generic SQL data with Cortex XSIAM. - [Genesys](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/cortex-xsiam-data-sources/vendor-specific-data-sources-and-connectors/genesys.md): Configure the Genesys connector for Cortex XSIAM. - [Genesys](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/cortex-xsiam-data-sources/vendor-specific-data-sources-and-connectors/genesys/genesys.md): Use Genesys data with Cortex XSIAM. - [Gigamon](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/cortex-xsiam-data-sources/vendor-specific-data-sources-and-connectors/gigamon.md): Configure the Gigamon connector for Cortex XSIAM. - [Gigamon](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/cortex-xsiam-data-sources/vendor-specific-data-sources-and-connectors/gigamon/gigamon.md): Use Gigamon data with Cortex XSIAM. - [GitGuardian](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/cortex-xsiam-data-sources/vendor-specific-data-sources-and-connectors/gitguardian.md): Configure the GitGuardian connector for Cortex XSIAM. - [GitGuardian](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/cortex-xsiam-data-sources/vendor-specific-data-sources-and-connectors/gitguardian/gitguardian.md): Use GitGuardian data with Cortex XSIAM. - [GitHub](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/cortex-xsiam-data-sources/vendor-specific-data-sources-and-connectors/github.md): Configure the GitHub connector for Cortex XSIAM. - [GitHub](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/cortex-xsiam-data-sources/vendor-specific-data-sources-and-connectors/github/github.md): Use GitHub data with Cortex XSIAM. - [GitLab](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/cortex-xsiam-data-sources/vendor-specific-data-sources-and-connectors/gitlab.md): Configure the GitLab data source and connectors for Cortex XSIAM. - [Connect GitLab container registry](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/cortex-xsiam-data-sources/vendor-specific-data-sources-and-connectors/gitlab/connect-gitlab-container-registry.md): Connect a GitLab container registry to Cortex XSIAM for image scanning. - [Manage a GitLab Container Registry connector](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/cortex-xsiam-data-sources/vendor-specific-data-sources-and-connectors/gitlab/connect-gitlab-container-registry/manage-a-gitlab-container-registry-connector.md): Manage the GitLab Container Registry connector in Cortex XSIAM. - [GitLab Automation and Collection](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/cortex-xsiam-data-sources/vendor-specific-data-sources-and-connectors/gitlab/gitlab-automation-and-collection.md): Use GitLab Automation and Collection data with Cortex XSIAM. - [GitLab](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/cortex-xsiam-data-sources/vendor-specific-data-sources-and-connectors/gitlab/gitlab.md): Use GitLab data with Cortex XSIAM. - [Giphy](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/cortex-xsiam-data-sources/vendor-specific-data-sources-and-connectors/giphy.md): Configure the Giphy connector for Cortex XSIAM. - [Giphy](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/cortex-xsiam-data-sources/vendor-specific-data-sources-and-connectors/giphy/giphy.md): Use Giphy data with Cortex XSIAM. - [Google](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/cortex-xsiam-data-sources/vendor-specific-data-sources-and-connectors/google.md): Configure the Google data sources and connectors for Cortex XSIAM. - [Google AI](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/cortex-xsiam-data-sources/vendor-specific-data-sources-and-connectors/google/google-ai.md): Use Google AI data with Cortex XSIAM. - [Google Cloud](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/cortex-xsiam-data-sources/vendor-specific-data-sources-and-connectors/google/google-cloud.md): Use Google Cloud data with Cortex XSIAM. - [Google Cloud Platform](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/cortex-xsiam-data-sources/vendor-specific-data-sources-and-connectors/google/google-cloud-platform.md): Use Google Cloud Platform data with Cortex XSIAM. - [Ingest logs and data from a GCP Pub/Sub](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/cortex-xsiam-data-sources/vendor-specific-data-sources-and-connectors/google/google-cloud-platform/ingest-logs-and-data-from-a-gcp-pub-sub.md): Collect GCP Pub/Sub data with Cortex XSIAM. - [Google Kubernetes Engine](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/cortex-xsiam-data-sources/vendor-specific-data-sources-and-connectors/google/google-kubernetes-engine.md): Use Google Kubernetes Engine data with Cortex XSIAM. - [Ingest logs from Google Kubernetes Engine](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/cortex-xsiam-data-sources/vendor-specific-data-sources-and-connectors/google/google-kubernetes-engine/ingest-logs-from-google-kubernetes-engine.md): Collect Google Kubernetes Engine data with Cortex XSIAM. - [Google SecOps](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/cortex-xsiam-data-sources/vendor-specific-data-sources-and-connectors/google/google-secops.md): Use Google SecOps data with Cortex XSIAM. - [Google Services](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/cortex-xsiam-data-sources/vendor-specific-data-sources-and-connectors/google/google-services.md): Use Google Services data with Cortex XSIAM. - [Google Workspace](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/cortex-xsiam-data-sources/vendor-specific-data-sources-and-connectors/google/google-workspace.md): Use Google Workspace data with Cortex XSIAM. - [Ingest logs and data from Google Workspace](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/cortex-xsiam-data-sources/vendor-specific-data-sources-and-connectors/google/google-workspace/ingest-logs-and-data-from-google-workspace.md): Collect Google Workspace data with Cortex XSIAM. - [Google Workspace connector](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/cortex-xsiam-data-sources/vendor-specific-data-sources-and-connectors/google/google-workspace/google-workspace-connector.md): Use Google Workspace with Cortex XSIAM. - [Google Workspace Automation and Collection](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/cortex-xsiam-data-sources/vendor-specific-data-sources-and-connectors/google/google-workspace/google-workspace-automation-and-collection.md): Use Google Workspace Automation and Collection data with Cortex XSIAM. - [GraphQL](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/cortex-xsiam-data-sources/vendor-specific-data-sources-and-connectors/graphql.md): Configure the GraphQL connector for Cortex XSIAM. - [GraphQL](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/cortex-xsiam-data-sources/vendor-specific-data-sources-and-connectors/graphql/graphql.md): Use GraphQL data with Cortex XSIAM. - [Grouped Example Connector](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/cortex-xsiam-data-sources/vendor-specific-data-sources-and-connectors/grouped-example-connector.md): Configure the Grouped Example Connector connector for Cortex XSIAM. - [Grouped Example Connector](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/cortex-xsiam-data-sources/vendor-specific-data-sources-and-connectors/grouped-example-connector/grouped-example-connector.md): Use Grouped Example Connector data with Cortex XSIAM. - [GRR](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/cortex-xsiam-data-sources/vendor-specific-data-sources-and-connectors/grr.md): Configure the GRR connector for Cortex XSIAM. - [GRR](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/cortex-xsiam-data-sources/vendor-specific-data-sources-and-connectors/grr/grr.md): Use GRR data with Cortex XSIAM. - [Grafana](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/cortex-xsiam-data-sources/vendor-specific-data-sources-and-connectors/grafana.md): Configure the Grafana connector for Cortex XSIAM. - [Grafana](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/cortex-xsiam-data-sources/vendor-specific-data-sources-and-connectors/grafana/grafana.md): Use Grafana data with Cortex XSIAM. - [Halcyon](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/cortex-xsiam-data-sources/vendor-specific-data-sources-and-connectors/halcyon.md): Configure the Halcyon connector for Cortex XSIAM. - [Halcyon](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/cortex-xsiam-data-sources/vendor-specific-data-sources-and-connectors/halcyon/halcyon.md): Use Halcyon data with Cortex XSIAM. - [Harbor](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/cortex-xsiam-data-sources/vendor-specific-data-sources-and-connectors/harbor.md): Configure the Harbor data source for Cortex XSIAM. - [Connect Harbor registry](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/cortex-xsiam-data-sources/vendor-specific-data-sources-and-connectors/harbor/connect-harbor-registry.md): Connect a Harbor registry to Cortex XSIAM for container image scanning. - [Manage a Harbor connector](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/cortex-xsiam-data-sources/vendor-specific-data-sources-and-connectors/harbor/connect-harbor-registry/manage-a-harbor-connector.md): Manage the Harbor registry connector in Cortex XSIAM. - [Harness](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/cortex-xsiam-data-sources/vendor-specific-data-sources-and-connectors/harness.md): Configure the Harness connector for Cortex XSIAM. - [Harness](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/cortex-xsiam-data-sources/vendor-specific-data-sources-and-connectors/harness/harness.md): Use Harness data with Cortex XSIAM. - [HashiCorp](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/cortex-xsiam-data-sources/vendor-specific-data-sources-and-connectors/hashicorp.md): Configure the HashiCorp connector for Cortex XSIAM. - [HashiCorp](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/cortex-xsiam-data-sources/vendor-specific-data-sources-and-connectors/hashicorp/hashicorp.md): Use HashiCorp data with Cortex XSIAM. - [Have I Been Pwnd](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/cortex-xsiam-data-sources/vendor-specific-data-sources-and-connectors/have-i-been-pwnd.md): Configure the Have I Been Pwnd connector for Cortex XSIAM. - [Have I Been Pwnd](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/cortex-xsiam-data-sources/vendor-specific-data-sources-and-connectors/have-i-been-pwnd/have-i-been-pwnd.md): Use Have I Been Pwnd data with Cortex XSIAM. - [HCL BigFix](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/cortex-xsiam-data-sources/vendor-specific-data-sources-and-connectors/hcl-bigfix.md): Configure the HCL BigFix connector for Cortex XSIAM. - [HCL BigFix](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/cortex-xsiam-data-sources/vendor-specific-data-sources-and-connectors/hcl-bigfix/hcl-bigfix.md): Use HCL BigFix data with Cortex XSIAM. - [HPE Aruba](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/cortex-xsiam-data-sources/vendor-specific-data-sources-and-connectors/hpe-aruba.md): Configure the HPE Aruba connector for Cortex XSIAM. - [HPE Aruba](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/cortex-xsiam-data-sources/vendor-specific-data-sources-and-connectors/hpe-aruba/hpe-aruba.md): Use HPE Aruba data with Cortex XSIAM. - [Hostio Solutions](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/cortex-xsiam-data-sources/vendor-specific-data-sources-and-connectors/hostio-solutions.md): Configure the Hostio Solutions connector for Cortex XSIAM. - [Hostio Solutions](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/cortex-xsiam-data-sources/vendor-specific-data-sources-and-connectors/hostio-solutions/hostio-solutions.md): Use Hostio Solutions data with Cortex XSIAM. - [HTTP log collector](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/cortex-xsiam-data-sources/vendor-specific-data-sources-and-connectors/http-log-collector.md): Configure the HTTP log collector data source for Cortex XSIAM. - [Set up an HTTP log collector to receive logs](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/cortex-xsiam-data-sources/vendor-specific-data-sources-and-connectors/http-log-collector/set-up-an-http-log-collector-to-receive-logs.md): Collect HTTP log data in Cortex XSIAM. - [IBM](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/cortex-xsiam-data-sources/vendor-specific-data-sources-and-connectors/ibm.md): Configure the IBM connectors for Cortex XSIAM. - [IBM Storage Scale](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/cortex-xsiam-data-sources/vendor-specific-data-sources-and-connectors/ibm/ibm-storage-scale.md): Use IBM Storage Scale data with Cortex XSIAM. - [IBM QRadar](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/cortex-xsiam-data-sources/vendor-specific-data-sources-and-connectors/ibm/ibm-qradar.md): Use IBM QRadar data with Cortex XSIAM. - [IBM Security](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/cortex-xsiam-data-sources/vendor-specific-data-sources-and-connectors/ibm/ibm-security.md): Use IBM Security data with Cortex XSIAM. - [iManage](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/cortex-xsiam-data-sources/vendor-specific-data-sources-and-connectors/imanage.md): Configure the iManage connector for Cortex XSIAM. - [iManage](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/cortex-xsiam-data-sources/vendor-specific-data-sources-and-connectors/imanage/imanage.md): Use iManage data with Cortex XSIAM. - [Imperva](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/cortex-xsiam-data-sources/vendor-specific-data-sources-and-connectors/imperva.md): Configure the Imperva connector for Cortex XSIAM. - [Imperva](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/cortex-xsiam-data-sources/vendor-specific-data-sources-and-connectors/imperva/imperva.md): Use Imperva data with Cortex XSIAM. - [InfoArmor](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/cortex-xsiam-data-sources/vendor-specific-data-sources-and-connectors/infoarmor.md): Configure the InfoArmor connector for Cortex XSIAM. - [InfoArmor](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/cortex-xsiam-data-sources/vendor-specific-data-sources-and-connectors/infoarmor/infoarmor.md): Use InfoArmor data with Cortex XSIAM. - [Infoblox](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/cortex-xsiam-data-sources/vendor-specific-data-sources-and-connectors/infoblox.md): Configure the Infoblox connector for Cortex XSIAM. - [Infoblox](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/cortex-xsiam-data-sources/vendor-specific-data-sources-and-connectors/infoblox/infoblox.md): Use Infoblox data with Cortex XSIAM. - [Intellum](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/cortex-xsiam-data-sources/vendor-specific-data-sources-and-connectors/intellum.md): Configure the Intellum connector for Cortex XSIAM. - [Intellum](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/cortex-xsiam-data-sources/vendor-specific-data-sources-and-connectors/intellum/intellum.md): Use Intellum data with Cortex XSIAM. - [Intercom](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/cortex-xsiam-data-sources/vendor-specific-data-sources-and-connectors/intercom.md): Configure the Intercom connector for Cortex XSIAM. - [Intercom](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/cortex-xsiam-data-sources/vendor-specific-data-sources-and-connectors/intercom/intercom.md): Use Intercom data with Cortex XSIAM. - [IPInfo.io](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/cortex-xsiam-data-sources/vendor-specific-data-sources-and-connectors/ipinfo.io.md): Configure the IPInfo.io connector for Cortex XSIAM. - [IPInfo.io](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/cortex-xsiam-data-sources/vendor-specific-data-sources-and-connectors/ipinfo.io/ipinfo.io.md): Use IPInfo.io data with Cortex XSIAM. - [IPstack](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/cortex-xsiam-data-sources/vendor-specific-data-sources-and-connectors/ipstack.md): Configure the IPstack connector for Cortex XSIAM. - [IPstack](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/cortex-xsiam-data-sources/vendor-specific-data-sources-and-connectors/ipstack/ipstack.md): Use IPstack data with Cortex XSIAM. - [Ironscales](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/cortex-xsiam-data-sources/vendor-specific-data-sources-and-connectors/ironscales.md): Configure the Ironscales connector for Cortex XSIAM. - [Ironscales](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/cortex-xsiam-data-sources/vendor-specific-data-sources-and-connectors/ironscales/ironscales.md): Use Ironscales data with Cortex XSIAM. - [Ivanti](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/cortex-xsiam-data-sources/vendor-specific-data-sources-and-connectors/ivanti.md): Configure the Ivanti connector for Cortex XSIAM. - [Ivanti](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/cortex-xsiam-data-sources/vendor-specific-data-sources-and-connectors/ivanti/ivanti.md): Use Ivanti data with Cortex XSIAM. - [iZOOlogic](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/cortex-xsiam-data-sources/vendor-specific-data-sources-and-connectors/izoologic.md): Configure the iZOOlogic connector for Cortex XSIAM. - [iZOOlogic](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/cortex-xsiam-data-sources/vendor-specific-data-sources-and-connectors/izoologic/izoologic.md): Use iZOOlogic data with Cortex XSIAM. - [Jamf](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/cortex-xsiam-data-sources/vendor-specific-data-sources-and-connectors/jamf.md): Configure the Jamf connectors for Cortex XSIAM. - [Jamf](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/cortex-xsiam-data-sources/vendor-specific-data-sources-and-connectors/jamf/jamf.md): Use Jamf data with Cortex XSIAM. - [Jamf Pro](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/cortex-xsiam-data-sources/vendor-specific-data-sources-and-connectors/jamf/jamf-pro.md): Use Jamf Pro data with Cortex XSIAM. - [JFrog](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/cortex-xsiam-data-sources/vendor-specific-data-sources-and-connectors/jfrog.md): Configure the JFrog data source for Cortex XSIAM. - [Connect JFrog container registry](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/cortex-xsiam-data-sources/vendor-specific-data-sources-and-connectors/jfrog/connect-jfrog-container-registry.md): Connect a JFrog container registry to Cortex XSIAM for image scanning. - [Manage a JFrog connector](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/cortex-xsiam-data-sources/vendor-specific-data-sources-and-connectors/jfrog/connect-jfrog-container-registry/manage-a-jfrog-connector.md): Manage the JFrog container registry connector in Cortex XSIAM. - [Joe Security](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/cortex-xsiam-data-sources/vendor-specific-data-sources-and-connectors/joe-security.md): Configure the Joe Security connector for Cortex XSIAM. - [Joe Security](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/cortex-xsiam-data-sources/vendor-specific-data-sources-and-connectors/joe-security/joe-security.md): Use Joe Security data with Cortex XSIAM. - [JumpCloud](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/cortex-xsiam-data-sources/vendor-specific-data-sources-and-connectors/jumpcloud.md): Configure the JumpCloud connector for Cortex XSIAM. - [JumpCloud](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/cortex-xsiam-data-sources/vendor-specific-data-sources-and-connectors/jumpcloud/jumpcloud.md): Use JumpCloud data with Cortex XSIAM. - [JSONWhoIs.com](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/cortex-xsiam-data-sources/vendor-specific-data-sources-and-connectors/jsonwhois.com.md): Configure the JSONWhoIs.com connector for Cortex XSIAM. - [JSONWhoIs.com](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/cortex-xsiam-data-sources/vendor-specific-data-sources-and-connectors/jsonwhois.com/jsonwhois.com.md): Use JSONWhoIs.com data with Cortex XSIAM. - [Kafka](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/cortex-xsiam-data-sources/vendor-specific-data-sources-and-connectors/kafka.md): Configure the Kafka data source and connector for Cortex XSIAM. - [Kafka](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/cortex-xsiam-data-sources/vendor-specific-data-sources-and-connectors/kafka/kafka.md): Use Kafka data with Cortex XSIAM. - [Kaspersky](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/cortex-xsiam-data-sources/vendor-specific-data-sources-and-connectors/kaspersky.md): Configure the Kaspersky connector for Cortex XSIAM. - [Kaspersky](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/cortex-xsiam-data-sources/vendor-specific-data-sources-and-connectors/kaspersky/kaspersky.md): Use Kaspersky data with Cortex XSIAM. - [Keeper Security](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/cortex-xsiam-data-sources/vendor-specific-data-sources-and-connectors/keeper-security.md): Configure the Keeper Security connector for Cortex XSIAM. - [Keeper Security](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/cortex-xsiam-data-sources/vendor-specific-data-sources-and-connectors/keeper-security/keeper-security.md): Use Keeper Security data with Cortex XSIAM. - [KnowBe4](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/cortex-xsiam-data-sources/vendor-specific-data-sources-and-connectors/knowbe4.md): Configure the KnowBe4 connector for Cortex XSIAM. - [KnowB4](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/cortex-xsiam-data-sources/vendor-specific-data-sources-and-connectors/knowbe4/knowb4.md): Use KnowB4 data with Cortex XSIAM. - [Koi](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/cortex-xsiam-data-sources/vendor-specific-data-sources-and-connectors/koi.md): Configure the Koi connector for Cortex XSIAM. - [Koi](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/cortex-xsiam-data-sources/vendor-specific-data-sources-and-connectors/koi/koi.md): Use Koi data with Cortex XSIAM. - [Koodous](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/cortex-xsiam-data-sources/vendor-specific-data-sources-and-connectors/koodous.md): Configure the Koodous connector for Cortex XSIAM. - [Koodous](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/cortex-xsiam-data-sources/vendor-specific-data-sources-and-connectors/koodous/koodous.md): Use Koodous data with Cortex XSIAM. - [Kubernetes](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/cortex-xsiam-data-sources/vendor-specific-data-sources-and-connectors/kubernetes.md): Configure the Kubernetes data source for Cortex XSIAM. - [Onboard the Kubernetes connector](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/cortex-xsiam-data-sources/vendor-specific-data-sources-and-connectors/kubernetes/onboard-the-kubernetes-connector.md): Use Kubernetes data with Cortex XSIAM. - [What's new in Kubernetes connector](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/cortex-xsiam-data-sources/vendor-specific-data-sources-and-connectors/kubernetes/whats-new-in-kubernetes-connector.md): Learn more about the changes, additions, known issues, and fixes for each version of the Kubernetes connector. - [Supported Kubernetes distributions](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/cortex-xsiam-data-sources/vendor-specific-data-sources-and-connectors/kubernetes/supported-kubernetes-distributions.md): Learn more about the supported Kubernetes platform versions for the Kubernetes connector. - [Kustomer](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/cortex-xsiam-data-sources/vendor-specific-data-sources-and-connectors/kustomer.md): Configure the Kustomer connector for Cortex XSIAM. - [Kustomer](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/cortex-xsiam-data-sources/vendor-specific-data-sources-and-connectors/kustomer/kustomer.md): Use Kustomer data with Cortex XSIAM. - [LastPass](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/cortex-xsiam-data-sources/vendor-specific-data-sources-and-connectors/lastpass.md): Configure the LastPass connector for Cortex XSIAM. - [LastPass](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/cortex-xsiam-data-sources/vendor-specific-data-sources-and-connectors/lastpass/lastpass.md): Use LastPass data with Cortex XSIAM. - [Lastline](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/cortex-xsiam-data-sources/vendor-specific-data-sources-and-connectors/lastline.md): Configure the Lastline connector for Cortex XSIAM. - [Lastline](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/cortex-xsiam-data-sources/vendor-specific-data-sources-and-connectors/lastline/lastline.md): Use Lastline data with Cortex XSIAM. - [LevelBlue](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/cortex-xsiam-data-sources/vendor-specific-data-sources-and-connectors/levelblue.md): Configure the LevelBlue connector for Cortex XSIAM. - [LevelBlue](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/cortex-xsiam-data-sources/vendor-specific-data-sources-and-connectors/levelblue/levelblue.md): Use LevelBlue data with Cortex XSIAM. - [LogRhythm](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/cortex-xsiam-data-sources/vendor-specific-data-sources-and-connectors/logrhythm.md): Configure the LogRhythm connector for Cortex XSIAM. - [LogRhythm](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/cortex-xsiam-data-sources/vendor-specific-data-sources-and-connectors/logrhythm/logrhythm.md): Use LogRhythm data with Cortex XSIAM. - [LOLBAS](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/cortex-xsiam-data-sources/vendor-specific-data-sources-and-connectors/lolbas.md): Configure the LOLBAS connector for Cortex XSIAM. - [LOLBAS](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/cortex-xsiam-data-sources/vendor-specific-data-sources-and-connectors/lolbas/lolbas.md): Use LOLBAS data with Cortex XSIAM. - [Lookout](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/cortex-xsiam-data-sources/vendor-specific-data-sources-and-connectors/lookout.md): Configure the Lookout connector for Cortex XSIAM. - [Lookout](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/cortex-xsiam-data-sources/vendor-specific-data-sources-and-connectors/lookout/lookout.md): Use Lookout data with Cortex XSIAM. - [Lumu](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/cortex-xsiam-data-sources/vendor-specific-data-sources-and-connectors/lumu.md): Configure the Lumu connector for Cortex XSIAM. - [Lumu](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/cortex-xsiam-data-sources/vendor-specific-data-sources-and-connectors/lumu/lumu.md): Use Lumu data with Cortex XSIAM. - [Mail Utilities](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/cortex-xsiam-data-sources/vendor-specific-data-sources-and-connectors/mail-utilities.md): Configure the Mail Utilities connector for Cortex XSIAM. - [Mail Utilities](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/cortex-xsiam-data-sources/vendor-specific-data-sources-and-connectors/mail-utilities/mail-utilities.md): Use Mail Utilities data with Cortex XSIAM. - [Majestic](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/cortex-xsiam-data-sources/vendor-specific-data-sources-and-connectors/majestic.md): Configure the Majestic connector for Cortex XSIAM. - [Majestic](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/cortex-xsiam-data-sources/vendor-specific-data-sources-and-connectors/majestic/majestic.md): Use Majestic data with Cortex XSIAM. - [ManageEngine](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/cortex-xsiam-data-sources/vendor-specific-data-sources-and-connectors/manageengine.md): Configure the ManageEngine connector for Cortex XSIAM. - [ManageEngine](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/cortex-xsiam-data-sources/vendor-specific-data-sources-and-connectors/manageengine/manageengine.md): Use ManageEngine data with Cortex XSIAM. - [Mattermost](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/cortex-xsiam-data-sources/vendor-specific-data-sources-and-connectors/mattermost.md): Configure the Mattermost connector for Cortex XSIAM. - [Mattermost](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/cortex-xsiam-data-sources/vendor-specific-data-sources-and-connectors/mattermost/mattermost.md): Use Mattermost data with Cortex XSIAM. - [MaxMind](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/cortex-xsiam-data-sources/vendor-specific-data-sources-and-connectors/maxmind.md): Configure the Mattermost connector for Cortex XSIAM. - [MaxMind](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/cortex-xsiam-data-sources/vendor-specific-data-sources-and-connectors/maxmind/maxmind.md): Use MaxMind data with Cortex XSIAM. - [Menlo Security](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/cortex-xsiam-data-sources/vendor-specific-data-sources-and-connectors/menlo-security.md): Configure the Menlo Security connector for Cortex XSIAM. - [Menlo Security](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/cortex-xsiam-data-sources/vendor-specific-data-sources-and-connectors/menlo-security/menlo-security.md): Use Menlo Security data with Cortex XSIAM. - [Meta](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/cortex-xsiam-data-sources/vendor-specific-data-sources-and-connectors/meta.md): Configure the Meta connector for Cortex XSIAM. - [Meta](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/cortex-xsiam-data-sources/vendor-specific-data-sources-and-connectors/meta/meta.md): Use Meta data with Cortex XSIAM. - [Mimecast](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/cortex-xsiam-data-sources/vendor-specific-data-sources-and-connectors/mimecast.md): Configure the Mimecast connector for Cortex XSIAM. - [Mimecast](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/cortex-xsiam-data-sources/vendor-specific-data-sources-and-connectors/mimecast/mimecast.md): Use Mimecast data with Cortex XSIAM. - [Microsoft](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/cortex-xsiam-data-sources/vendor-specific-data-sources-and-connectors/microsoft.md): Configure the Microsoft data sources and connectors for Cortex XSIAM. - [Azure DevOps](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/cortex-xsiam-data-sources/vendor-specific-data-sources-and-connectors/microsoft/azure-devops.md): Use Azure DevOps data with Cortex XSIAM. - [Azure Event Hub](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/cortex-xsiam-data-sources/vendor-specific-data-sources-and-connectors/microsoft/azure-event-hub.md): Use Azure Event Hub data with Cortex XSIAM. - [Ingest logs from Microsoft Azure Event Hub](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/cortex-xsiam-data-sources/vendor-specific-data-sources-and-connectors/microsoft/azure-event-hub/ingest-logs-from-microsoft-azure-event-hub.md): Collect Microsoft Azure Event Hub data with Cortex XSIAM. - [Azure Firewall](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/cortex-xsiam-data-sources/vendor-specific-data-sources-and-connectors/microsoft/azure-firewall.md): Use Azure Firewall data with Cortex XSIAM. - [Azure Network Watcher](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/cortex-xsiam-data-sources/vendor-specific-data-sources-and-connectors/microsoft/azure-network-watcher.md): Use Azure Network Watcher data with Cortex XSIAM. - [Ingest network flow logs from Microsoft Azure Network Watcher](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/cortex-xsiam-data-sources/vendor-specific-data-sources-and-connectors/microsoft/azure-network-watcher/ingest-network-flow-logs-from-microsoft-azure-network-watcher.md): Collect Microsoft Azure Network Watcher data with Cortex XSIAM. - [Microsoft Azure](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/cortex-xsiam-data-sources/vendor-specific-data-sources-and-connectors/microsoft/microsoft-azure.md): Use Microsoft Azure data with Cortex XSIAM. - [Microsoft Copilot Studio](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/cortex-xsiam-data-sources/vendor-specific-data-sources-and-connectors/microsoft/microsoft-copilot-studio.md): Use Microsoft Copilot Studio data with Cortex XSIAM. - [Microsoft Defender for Endpoint Events](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/cortex-xsiam-data-sources/vendor-specific-data-sources-and-connectors/microsoft/microsoft-defender-for-endpoint-events.md): Use Microsoft Defender for Endpoint Events data with Cortex XSIAM. - [Ingest raw EDR events from Microsoft Defender for Endpoint](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/cortex-xsiam-data-sources/vendor-specific-data-sources-and-connectors/microsoft/microsoft-defender-for-endpoint-events/ingest-raw-edr-events-from-microsoft-defender-for-endpoint.md): Collect EDR events from Microsoft Defender for Endpoint data with Cortex XSIAM. - [Microsoft Entra ID](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/cortex-xsiam-data-sources/vendor-specific-data-sources-and-connectors/microsoft/microsoft-entra-id.md): Use Microsoft Entra ID data with Cortex XSIAM. - [Microsoft Office 365](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/cortex-xsiam-data-sources/vendor-specific-data-sources-and-connectors/microsoft/microsoft-office-365.md): Use Microsoft Office 365 data with Cortex XSIAM. - [Ingest logs from Microsoft Office 365](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/cortex-xsiam-data-sources/vendor-specific-data-sources-and-connectors/microsoft/microsoft-office-365/ingest-logs-from-microsoft-office-365.md): Collect Microsoft Office 365 data with Cortex XSIAM. - [Microsoft 365 (new)](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/cortex-xsiam-data-sources/vendor-specific-data-sources-and-connectors/microsoft/microsoft-office-365/microsoft-365.md): Use Microsoft 365 (new) data with Cortex XSIAM. - [Create a Microsoft Entra ID](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/cortex-xsiam-data-sources/vendor-specific-data-sources-and-connectors/microsoft/microsoft-office-365/microsoft-365/create-a-microsoft-entra-id.md): Learn more about creating a Microsoft Entra ID. - [Microsoft365 (legacy)](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/cortex-xsiam-data-sources/vendor-specific-data-sources-and-connectors/microsoft/microsoft-office-365/microsoft365.md): Use Microsoft365 (legacy) data with Cortex XSIAM. - [Migrate to new Microsoft 365 connector](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/cortex-xsiam-data-sources/vendor-specific-data-sources-and-connectors/microsoft/microsoft-office-365/microsoft365/migrate-to-new-microsoft-365-connector.md): Learn more about migrating to a new Microsoft 365 connector. - [Microsoft 365 Copilot](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/cortex-xsiam-data-sources/vendor-specific-data-sources-and-connectors/microsoft/microsoft-office-365/microsoft-365-copilot.md): Use Microsoft 365 Copilot data with Cortex XSIAM. - [Microsoft Graph](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/cortex-xsiam-data-sources/vendor-specific-data-sources-and-connectors/microsoft/microsoft-office-365/microsoft-graph.md): Use Microsoft Graph data with Cortex XSIAM. - [Microsoft Office 365 (email)](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/cortex-xsiam-data-sources/vendor-specific-data-sources-and-connectors/microsoft/microsoft-office-365-email.md): Use Microsoft Office 365 (email) data with Cortex XSIAM. - [Ingest logs and data from Microsoft 365](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/cortex-xsiam-data-sources/vendor-specific-data-sources-and-connectors/microsoft/microsoft-office-365-email/ingest-logs-and-data-from-microsoft-365.md): Collect Microsoft 365 data with Cortex XSIAM. - [Microsoft 365 (Posture)](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/cortex-xsiam-data-sources/vendor-specific-data-sources-and-connectors/microsoft/microsoft-365-posture.md): Use Microsoft 365 (Posture) data with Cortex XSIAM. - [How to onboard Microsoft 365](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/cortex-xsiam-data-sources/vendor-specific-data-sources-and-connectors/microsoft/microsoft-365-posture/how-to-onboard-microsoft-365.md): Learn more about adding Microsoft 365 as a third-party data source in Cortex XSIAM. - [Microsoft Teams](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/cortex-xsiam-data-sources/vendor-specific-data-sources-and-connectors/microsoft/microsoft-teams.md): Use Microsoft Teams data with Cortex XSIAM. - [Azure Log Analytics](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/cortex-xsiam-data-sources/vendor-specific-data-sources-and-connectors/microsoft/azure-log-analytics.md): Use Azure Log Analytics data with Cortex XSIAM. - [Azure Services](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/cortex-xsiam-data-sources/vendor-specific-data-sources-and-connectors/microsoft/azure-services.md): Use Azure Services data with Cortex XSIAM. - [Azure WAF](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/cortex-xsiam-data-sources/vendor-specific-data-sources-and-connectors/microsoft/azure-waf.md): Use Azure WAF data with Cortex XSIAM. - [Microsoft Active Directory](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/cortex-xsiam-data-sources/vendor-specific-data-sources-and-connectors/microsoft/microsoft-active-directory.md): Use Microsoft Active Directory data with Cortex XSIAM. - [Microsoft Identity](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/cortex-xsiam-data-sources/vendor-specific-data-sources-and-connectors/microsoft/microsoft-identity.md): Use Microsoft Identity data with Cortex XSIAM. - [Microsoft Intune](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/cortex-xsiam-data-sources/vendor-specific-data-sources-and-connectors/microsoft/microsoft-intune.md): Use Microsoft Intune data with Cortex XSIAM. - [Microsoft Security Automation and Collection](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/cortex-xsiam-data-sources/vendor-specific-data-sources-and-connectors/microsoft/microsoft-security-automation-and-collection.md): Use Microsoft Security Automation and Collection data with Cortex XSIAM. - [Microsoft Windows Tools](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/cortex-xsiam-data-sources/vendor-specific-data-sources-and-connectors/microsoft/microsoft-windows-tools.md): Use Microsoft Windows Tools data with Cortex XSIAM. - [M365 Automation and Collection](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/cortex-xsiam-data-sources/vendor-specific-data-sources-and-connectors/microsoft/m365-automation-and-collection.md): Use M365 Automation and Collection data with Cortex XSIAM. - [MISP](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/cortex-xsiam-data-sources/vendor-specific-data-sources-and-connectors/misp.md): Configure the MISP connector for Cortex XSIAM. - [MISP](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/cortex-xsiam-data-sources/vendor-specific-data-sources-and-connectors/misp/misp.md): Use MISP data with Cortex XSIAM. - [MITRE](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/cortex-xsiam-data-sources/vendor-specific-data-sources-and-connectors/mitre.md): Configure the MITRE connector for Cortex XSIAM. - [MITRE](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/cortex-xsiam-data-sources/vendor-specific-data-sources-and-connectors/mitre/mitre.md): Use MITRE data with Cortex XSIAM. - [Monday](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/cortex-xsiam-data-sources/vendor-specific-data-sources-and-connectors/monday.md): Configure the Monday connectors for Cortex XSIAM. - [Monday](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/cortex-xsiam-data-sources/vendor-specific-data-sources-and-connectors/monday/monday.md): Use Monday data with Cortex XSIAM. - [Monday.com](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/cortex-xsiam-data-sources/vendor-specific-data-sources-and-connectors/monday/monday.com.md): Use Monday.com data with Cortex XSIAM. - [MongoDB](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/cortex-xsiam-data-sources/vendor-specific-data-sources-and-connectors/mongodb.md): Configure the MongoDB data source and connectors for Cortex XSIAM. - [How to onboard MongoDB Atlas (Posture)](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/cortex-xsiam-data-sources/vendor-specific-data-sources-and-connectors/mongodb/how-to-onboard-mongodb-atlas.md): Use MongoDB Atlas (Posture) data with Cortex XSIAM. - [MongoDB](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/cortex-xsiam-data-sources/vendor-specific-data-sources-and-connectors/mongodb/mongodb.md): Use MongoDB data with Cortex XSIAM. - [MongoDB Atlas](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/cortex-xsiam-data-sources/vendor-specific-data-sources-and-connectors/mongodb/mongodb-atlas.md): Use MongoDB Atlas data with Cortex XSIAM. - [MuleSoft](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/cortex-xsiam-data-sources/vendor-specific-data-sources-and-connectors/mulesoft.md): Configure the MuleSoft connector for Cortex XSIAM. - [MuleSoft](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/cortex-xsiam-data-sources/vendor-specific-data-sources-and-connectors/mulesoft/mulesoft.md): Use MuleSoft data with Cortex XSIAM. - [Mural](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/cortex-xsiam-data-sources/vendor-specific-data-sources-and-connectors/mural.md): Configure the Mural connector for Cortex XSIAM. - [Mural](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/cortex-xsiam-data-sources/vendor-specific-data-sources-and-connectors/mural/mural.md): Use Mural data with Cortex XSIAM. - [MxToolBox](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/cortex-xsiam-data-sources/vendor-specific-data-sources-and-connectors/mxtoolbox.md): Configure the MxToolBox connector for Cortex XSIAM. - [MxToolBox](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/cortex-xsiam-data-sources/vendor-specific-data-sources-and-connectors/mxtoolbox/mxtoolbox.md): Use MxToolBox data with Cortex XSIAM. - [NetBox](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/cortex-xsiam-data-sources/vendor-specific-data-sources-and-connectors/netbox.md): Configure the NetBox connector for Cortex XSIAM. - [NetBox](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/cortex-xsiam-data-sources/vendor-specific-data-sources-and-connectors/netbox/netbox.md): Use NetBox data with Cortex XSIAM. - [Netcraft](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/cortex-xsiam-data-sources/vendor-specific-data-sources-and-connectors/netcraft.md): Configure the Netcraft connector for Cortex XSIAM. - [Netcraft](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/cortex-xsiam-data-sources/vendor-specific-data-sources-and-connectors/netcraft/netcraft.md): Use Netcraft data with Cortex XSIAM. - [Netmiko](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/cortex-xsiam-data-sources/vendor-specific-data-sources-and-connectors/netmiko.md): Configure the Netmiko connector for Cortex XSIAM. - [Netmiko](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/cortex-xsiam-data-sources/vendor-specific-data-sources-and-connectors/netmiko/netmiko.md): Use Netmiko data with Cortex XSIAM. - [NetQuest](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/cortex-xsiam-data-sources/vendor-specific-data-sources-and-connectors/netquest.md): Configure the NetQuest connector for Cortex XSIAM. - [NetQuest](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/cortex-xsiam-data-sources/vendor-specific-data-sources-and-connectors/netquest/netquest.md): Use NetQuest data with Cortex XSIAM. - [Netskope](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/cortex-xsiam-data-sources/vendor-specific-data-sources-and-connectors/netskope.md): Configure the Netskope connector for Cortex XSIAM. - [Netskope](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/cortex-xsiam-data-sources/vendor-specific-data-sources-and-connectors/netskope/netskope.md): Use Netskope data with Cortex XSIAM. - [Nintex Workflow Cloud](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/cortex-xsiam-data-sources/vendor-specific-data-sources-and-connectors/nintex-workflow-cloud.md): Configure the Nintex Workflow Cloud connector for Cortex XSIAM. - [Nintex Workflow Cloud](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/cortex-xsiam-data-sources/vendor-specific-data-sources-and-connectors/nintex-workflow-cloud/nintex-workflow-cloud.md): Use Nintex Workflow Cloud data with Cortex XSIAM. - [NIST](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/cortex-xsiam-data-sources/vendor-specific-data-sources-and-connectors/nist.md): Configure the NIST connector for Cortex XSIAM. - [NIST](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/cortex-xsiam-data-sources/vendor-specific-data-sources-and-connectors/nist/nist.md): Use NIST data with Cortex XSIAM. - [nmap](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/cortex-xsiam-data-sources/vendor-specific-data-sources-and-connectors/nmap.md): Configure the nmap connector for Cortex XSIAM. - [nmap](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/cortex-xsiam-data-sources/vendor-specific-data-sources-and-connectors/nmap/nmap.md): Use nmap data with Cortex XSIAM. - [NAVEX](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/cortex-xsiam-data-sources/vendor-specific-data-sources-and-connectors/navex.md): Configure the NAVEX connector for Cortex XSIAM. - [NAVEX](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/cortex-xsiam-data-sources/vendor-specific-data-sources-and-connectors/navex/navex.md): Use NAVEX data with Cortex XSIAM. - [Nutanix](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/cortex-xsiam-data-sources/vendor-specific-data-sources-and-connectors/nutanix.md): Configure the Nutanix connector for Cortex XSIAM. - [Nutanix](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/cortex-xsiam-data-sources/vendor-specific-data-sources-and-connectors/nutanix/nutanix.md): Use Nutanix data with Cortex XSIAM. - [Okta](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/cortex-xsiam-data-sources/vendor-specific-data-sources-and-connectors/okta.md): Configure the Okta data source and connectors for Cortex XSIAM. - [Ingest logs and data from Okta](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/cortex-xsiam-data-sources/vendor-specific-data-sources-and-connectors/okta/ingest-logs-and-data-from-okta.md): Configure Okta log and data collection for Cortex XSIAM. - [Okta Automation and Collection](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/cortex-xsiam-data-sources/vendor-specific-data-sources-and-connectors/okta/okta-automation-and-collection.md): Configure Okta automation and collection for Cortex XSIAM. - [Okta connector](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/cortex-xsiam-data-sources/vendor-specific-data-sources-and-connectors/okta/okta-connector.md): Use Okta data in Cortex XSIAM. - [OneLogin](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/cortex-xsiam-data-sources/vendor-specific-data-sources-and-connectors/onelogin.md): Configure the OneLogin data source and connector for Cortex XSIAM. - [Ingest logs and data from OneLogin](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/cortex-xsiam-data-sources/vendor-specific-data-sources-and-connectors/onelogin/ingest-logs-and-data-from-onelogin.md): Configure OneLogin log and directory data collection for Cortex XSIAM. - [OneLogin](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/cortex-xsiam-data-sources/vendor-specific-data-sources-and-connectors/onelogin/onelogin.md): Use OneLogin data in Cortex XSIAM. - [OpenAI](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/cortex-xsiam-data-sources/vendor-specific-data-sources-and-connectors/openai.md): Configure the OpenAI connector for Cortex XSIAM. - [OpenAI](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/cortex-xsiam-data-sources/vendor-specific-data-sources-and-connectors/openai/openai.md): Use OpenAI data and capabilities in Cortex XSIAM. - [OpenCVE](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/cortex-xsiam-data-sources/vendor-specific-data-sources-and-connectors/opencve.md): Configure the OpenCVE connector for Cortex XSIAM. - [OpenCVE](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/cortex-xsiam-data-sources/vendor-specific-data-sources-and-connectors/opencve/opencve.md): Use OpenCVE vulnerability intelligence data in Cortex XSIAM. - [OpenLDAP](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/cortex-xsiam-data-sources/vendor-specific-data-sources-and-connectors/openldap.md): Configure the OpenLDAP connector for Cortex XSIAM. - [OpenLDAP](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/cortex-xsiam-data-sources/vendor-specific-data-sources-and-connectors/openldap/openldap.md): Use OpenLDAP authentication for Cortex XSIAM. - [OpenPhish](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/cortex-xsiam-data-sources/vendor-specific-data-sources-and-connectors/openphish.md): Configure the OpenPhish connector for Cortex XSIAM. - [OpenPhish](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/cortex-xsiam-data-sources/vendor-specific-data-sources-and-connectors/openphish/openphish.md): Use OpenPhish threat intelligence data in Cortex XSIAM. - [OpenText](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/cortex-xsiam-data-sources/vendor-specific-data-sources-and-connectors/opentext.md): Configure the OpenText connectors for Cortex XSIAM. - [OpenText EnCase Endpoint Security](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/cortex-xsiam-data-sources/vendor-specific-data-sources-and-connectors/opentext/opentext-encase-endpoint-security.md): Use OpenText EnCase Endpoint Security data in Cortex XSIAM. - [OpenText Service Manager](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/cortex-xsiam-data-sources/vendor-specific-data-sources-and-connectors/opentext/opentext-service-manager.md): Use OpenText Service Manager data in Cortex XSIAM. - [OpenText Vertica](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/cortex-xsiam-data-sources/vendor-specific-data-sources-and-connectors/opentext/opentext-vertica.md): Use OpenText Vertica data in Cortex XSIAM. - [OPSWAT](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/cortex-xsiam-data-sources/vendor-specific-data-sources-and-connectors/opswat.md): Configure the OPSWAT connector for Cortex XSIAM. - [OPSWAT MetaDefender](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/cortex-xsiam-data-sources/vendor-specific-data-sources-and-connectors/opswat/opswat-metadefender.md): Use OPSWAT MetaDefender data in Cortex XSIAM. - [Oracle](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/cortex-xsiam-data-sources/vendor-specific-data-sources-and-connectors/oracle.md): Configure the Oracle data source and connector for Cortex XSIAM. - [Oracle Cloud Infrastructure](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/cortex-xsiam-data-sources/vendor-specific-data-sources-and-connectors/oracle/oracle-cloud-infrastructure.md): Configure Oracle Cloud Infrastructure data source for Cortex XSIAM. - [Oracle](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/cortex-xsiam-data-sources/vendor-specific-data-sources-and-connectors/oracle/oracle.md): Use Oracle data in Cortex XSIAM. - [Orca Security](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/cortex-xsiam-data-sources/vendor-specific-data-sources-and-connectors/orca-security.md): Configure the Orca Security connector for Cortex XSIAM. - [Orca Security](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/cortex-xsiam-data-sources/vendor-specific-data-sources-and-connectors/orca-security/orca-security.md): Use Orca Security to import cloud security alerts into Cortex XSIAM. - [PacketMail.net](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/cortex-xsiam-data-sources/vendor-specific-data-sources-and-connectors/packetmail.net.md): Configure the PacketMail.net connector for Cortex XSIAM. - [PacketMail.net](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/cortex-xsiam-data-sources/vendor-specific-data-sources-and-connectors/packetmail.net/packetmail.net.md): Use PacketMail.net data for IPS intelligence lookups in Cortex XSIAM. - [PacketSled](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/cortex-xsiam-data-sources/vendor-specific-data-sources-and-connectors/packetsled.md): Configure the PacketSled connector for Cortex XSIAM. - [PacketSled](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/cortex-xsiam-data-sources/vendor-specific-data-sources-and-connectors/packetsled/packetsled.md): Use PacketSled data to investigate network data in Cortex XSIAM. - [PagerDuty](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/cortex-xsiam-data-sources/vendor-specific-data-sources-and-connectors/pagerduty.md): Configure the PagerDuty connectors for Cortex XSIAM. - [PagerDuty Automation and Collection](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/cortex-xsiam-data-sources/vendor-specific-data-sources-and-connectors/pagerduty/pagerduty-automation-and-collection.md): Configure PagerDuty automation and collection for Cortex XSIAM. - [PagerDuty](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/cortex-xsiam-data-sources/vendor-specific-data-sources-and-connectors/pagerduty/pagerduty.md): Use PagerDuty data in Cortex XSIAM. - [PAT Helpdesk Advanced](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/cortex-xsiam-data-sources/vendor-specific-data-sources-and-connectors/pat-helpdesk-advanced.md): Configure the PAT Helpdesk Advanced connector for Cortex XSIAM. - [PAT Helpdesk Advanced](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/cortex-xsiam-data-sources/vendor-specific-data-sources-and-connectors/pat-helpdesk-advanced/pat-helpdesk-advanced.md): Use PAT Helpdesk Advanced data in Cortex XSIAM service management. - [PhishLabs](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/cortex-xsiam-data-sources/vendor-specific-data-sources-and-connectors/phishlabs.md): Configure the PhishLabs connector for Cortex XSIAM. - [PhishLabs](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/cortex-xsiam-data-sources/vendor-specific-data-sources-and-connectors/phishlabs/phishlabs.md): Use PhishLabs IOC, DRP, and EIR data in Cortex XSIAM. - [Ping Identity](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/cortex-xsiam-data-sources/vendor-specific-data-sources-and-connectors/ping-identity.md): Configure the Ping Identity data sources and connector for Cortex XSIAM. - [PingFederate](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/cortex-xsiam-data-sources/vendor-specific-data-sources-and-connectors/ping-identity/pingfederate.md): Configure PingFederate authentication log collection for Cortex XSIAM. - [PingOne](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/cortex-xsiam-data-sources/vendor-specific-data-sources-and-connectors/ping-identity/pingone.md): Configure PingOne data sources for Cortex XSIAM. - [Ingest authentication logs and data from PingOne](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/cortex-xsiam-data-sources/vendor-specific-data-sources-and-connectors/ping-identity/pingone/ingest-authentication-logs-and-data-from-pingone.md): Ingest PingOne authentication logs and data into Cortex XSIAM. - [Ping Identity](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/cortex-xsiam-data-sources/vendor-specific-data-sources-and-connectors/ping-identity/pingone/ping-identity.md): Use the Ping Identity data in Cortex XSIAM. - [Pipedrive](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/cortex-xsiam-data-sources/vendor-specific-data-sources-and-connectors/pipedrive.md): Configure the Pipedrive connector for Cortex XSIAM. - [Pipedrive](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/cortex-xsiam-data-sources/vendor-specific-data-sources-and-connectors/pipedrive/pipedrive.md): Use Pipedrive security posture monitoring in Cortex XSIAM. - [Pipl](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/cortex-xsiam-data-sources/vendor-specific-data-sources-and-connectors/pipl.md): Configure the Pipl connector for Cortex XSIAM. - [Pipl](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/cortex-xsiam-data-sources/vendor-specific-data-sources-and-connectors/pipl/pipl.md): Use Pipl identity intelligence data in Cortex XSIAM. - [Plainview](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/cortex-xsiam-data-sources/vendor-specific-data-sources-and-connectors/plainview.md): Configure the Plainview connector for Cortex XSIAM. - [Plainview](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/cortex-xsiam-data-sources/vendor-specific-data-sources-and-connectors/plainview/plainview.md): Use Plainview identity lifecycle management data in Cortex XSIAM. - [Proofpoint](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/cortex-xsiam-data-sources/vendor-specific-data-sources-and-connectors/proofpoint.md): Configure the Proofpoint data source and connector for Cortex XSIAM. - [Proofpoint Targeted Attack Protection](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/cortex-xsiam-data-sources/vendor-specific-data-sources-and-connectors/proofpoint/proofpoint-targeted-attack-protection.md): Configure the Proofpoint Targeted Attack Protection connector for Cortex XSIAM. - [Ingest logs from Proofpoint Targeted Attack Protection](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/cortex-xsiam-data-sources/vendor-specific-data-sources-and-connectors/proofpoint/proofpoint-targeted-attack-protection/ingest-logs-from-proofpoint-targeted-attack-protection.md): Ingest logs from Proofpoint Targeted Attack Protection in Cortex XSIAM. - [Proofpoint](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/cortex-xsiam-data-sources/vendor-specific-data-sources-and-connectors/proofpoint/proofpoint.md): Use Proofpoint data in Cortex XSIAM. - [ProtectWise](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/cortex-xsiam-data-sources/vendor-specific-data-sources-and-connectors/protectwise.md): Configure the ProtectWise connector for Cortex XSIAM. - [ProtectWise](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/cortex-xsiam-data-sources/vendor-specific-data-sources-and-connectors/protectwise/protectwise.md): Use ProtectWise event streaming in Cortex XSIAM. - [Qualtrics](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/cortex-xsiam-data-sources/vendor-specific-data-sources-and-connectors/qualtrics.md): Configure the Qualtrics connector for Cortex XSIAM. - [Qualtrics](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/cortex-xsiam-data-sources/vendor-specific-data-sources-and-connectors/qualtrics/qualtrics.md): Configure Qualtrics SaaS security posture monitoring for Cortex XSIAM. - [Qualys](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/cortex-xsiam-data-sources/vendor-specific-data-sources-and-connectors/qualys.md): Configure the Qualys connector for Cortex XSIAM. - [Qualys](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/cortex-xsiam-data-sources/vendor-specific-data-sources-and-connectors/qualys/qualys.md): Use Qualys vulnerability, compliance, and file integrity monitoring data in Cortex XSIAM. - [Quest KACE](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/cortex-xsiam-data-sources/vendor-specific-data-sources-and-connectors/quest-kace.md): Configure the Quest KACE connector for Cortex XSIAM. - [Quest KACE](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/cortex-xsiam-data-sources/vendor-specific-data-sources-and-connectors/quest-kace/quest-kace.md): Use Quest KACE Systems Management Appliance data in Cortex XSIAM. - [Radware](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/cortex-xsiam-data-sources/vendor-specific-data-sources-and-connectors/radware.md): Configure the Radware connector for Cortex XSIAM. - [Radware](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/cortex-xsiam-data-sources/vendor-specific-data-sources-and-connectors/radware/radware.md): Use Radware Cloud DDoS Protection Service data in Cortex XSIAM. - [Rapid7](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/cortex-xsiam-data-sources/vendor-specific-data-sources-and-connectors/rapid7.md): Configure the Rapid7 connector for Cortex XSIAM. - [Rapid7](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/cortex-xsiam-data-sources/vendor-specific-data-sources-and-connectors/rapid7/rapid7.md): Use Rapid7 InsightIDR, InsightVM, and AppSec data in Cortex XSIAM. - [Razor Group](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/cortex-xsiam-data-sources/vendor-specific-data-sources-and-connectors/razor-group.md): Configure the Razor Group connector for Cortex XSIAM. - [Razor Group](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/cortex-xsiam-data-sources/vendor-specific-data-sources-and-connectors/razor-group/razor-group.md): Use Razor Group and Perch threat intelligence data in Cortex XSIAM. - [Recorded Future](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/cortex-xsiam-data-sources/vendor-specific-data-sources-and-connectors/recorded-future.md): Configure the Recorded Future connector for Cortex XSIAM. - [Recorded Future](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/cortex-xsiam-data-sources/vendor-specific-data-sources-and-connectors/recorded-future/recorded-future.md): Use Recorded Future threat intelligence data in Cortex XSIAM. - [Red Hat](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/cortex-xsiam-data-sources/vendor-specific-data-sources-and-connectors/red-hat.md): Configure the Red Hat connector for Cortex XSIAM. - [Red Hat Ansible](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/cortex-xsiam-data-sources/vendor-specific-data-sources-and-connectors/red-hat/red-hat-ansible.md): Use Red Hat Ansible automation in Cortex XSIAM. - [Redis Labs](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/cortex-xsiam-data-sources/vendor-specific-data-sources-and-connectors/redis-labs.md): Configure the Redis Labs connector for Cortex XSIAM. - [Redis Labs](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/cortex-xsiam-data-sources/vendor-specific-data-sources-and-connectors/redis-labs/redis-labs.md): Use Redis Labs data in Cortex XSIAM. - [Redmine](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/cortex-xsiam-data-sources/vendor-specific-data-sources-and-connectors/redmine.md): Configure the Redmine connector for Cortex XSIAM. - [Redmine](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/cortex-xsiam-data-sources/vendor-specific-data-sources-and-connectors/redmine/redmine.md): Use Redmine data in Cortex XSIAM. - [ReliaQuest](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/cortex-xsiam-data-sources/vendor-specific-data-sources-and-connectors/reliaquest.md): Configure the ReliaQuest connector for Cortex XSIAM. - [ReliaQuest](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/cortex-xsiam-data-sources/vendor-specific-data-sources-and-connectors/reliaquest/reliaquest.md): Use ReliaQuest GreyMatter DRP data in Cortex XSIAM. - [RemoteAccess](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/cortex-xsiam-data-sources/vendor-specific-data-sources-and-connectors/remoteaccess.md): Configure the RemoteAccess connector for Cortex XSIAM. - [RemoteAccess](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/cortex-xsiam-data-sources/vendor-specific-data-sources-and-connectors/remoteaccess/remoteaccess.md): Use RemoteAccess commands and file transfers for Cortex XSIAM. - [Retarus](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/cortex-xsiam-data-sources/vendor-specific-data-sources-and-connectors/retarus.md): Configure the Retarus connector for Cortex XSIAM. - [Retarus](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/cortex-xsiam-data-sources/vendor-specific-data-sources-and-connectors/retarus/retarus.md): Use Retarus Secure Email Gateway data in Cortex XSIAM. - [RSA](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/cortex-xsiam-data-sources/vendor-specific-data-sources-and-connectors/rsa.md): Configure the RSA connector for Cortex XSIAM. - [RSA](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/cortex-xsiam-data-sources/vendor-specific-data-sources-and-connectors/rsa/rsa.md): Use RSA Archer and NetWitness data in Cortex XSIAM. - [RTIR](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/cortex-xsiam-data-sources/vendor-specific-data-sources-and-connectors/rtir.md): Configure the RTIR connector for Cortex XSIAM. - [RTIR](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/cortex-xsiam-data-sources/vendor-specific-data-sources-and-connectors/rtir/rtir.md): Manage RTIR incident-response tickets in Cortex XSIAM. - [runZero](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/cortex-xsiam-data-sources/vendor-specific-data-sources-and-connectors/runzero.md): Configure the runZero connector for Cortex XSIAM. - [runZero](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/cortex-xsiam-data-sources/vendor-specific-data-sources-and-connectors/runzero/runzero.md): Use runZero data in Cortex XSIAM. - [Salesforce](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/cortex-xsiam-data-sources/vendor-specific-data-sources-and-connectors/salesforce.md): Configure the Salesforce data source and connector for Cortex XSIAM. - [Ingest logs and data from Salesforce](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/cortex-xsiam-data-sources/vendor-specific-data-sources-and-connectors/salesforce/ingest-logs-and-data-from-salesforce.md): Ingest Salesforce logs and data into Cortex XSIAM. - [Salesforce connector](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/cortex-xsiam-data-sources/vendor-specific-data-sources-and-connectors/salesforce/ingest-and-run-salesforce-automation-and-remediation.md): Use Salesforce data in Cortex XSIAM. - [Automation and remediation commands](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/cortex-xsiam-data-sources/vendor-specific-data-sources-and-connectors/salesforce/ingest-and-run-salesforce-automation-and-remediation/automation-and-remediation-commands.md): Salesforce Automation and Remediation commands for playbooks and the War Room for Cortex XSIAM. - [SailPoint](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/cortex-xsiam-data-sources/vendor-specific-data-sources-and-connectors/sailpoint.md): Configure the SailPoint connector for Cortex XSIAM. - [SailPoint](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/cortex-xsiam-data-sources/vendor-specific-data-sources-and-connectors/sailpoint/sailpoint.md): Use SailPoint IdentityNow event collector data in Cortex XSIAM. - [Samhaus](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/cortex-xsiam-data-sources/vendor-specific-data-sources-and-connectors/samhaus.md): Configure the Samhaus connector for Cortex XSIAM. - [Samhaus](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/cortex-xsiam-data-sources/vendor-specific-data-sources-and-connectors/samhaus/samhaus.md): Use Samhaus data with Cortex XSIAM. - [SANS DShield](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/cortex-xsiam-data-sources/vendor-specific-data-sources-and-connectors/sans-dshield.md): Configure the SANS DShield connector for Cortex XSIAM. - [SANS DShield](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/cortex-xsiam-data-sources/vendor-specific-data-sources-and-connectors/sans-dshield/sans-dshield.md): Use SANS DShield data in Cortex XSIAM to fetch attack subnet feeds. - [SAP](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/cortex-xsiam-data-sources/vendor-specific-data-sources-and-connectors/sap.md): Configure the SAP connectors for Cortex XSIAM. - [SAP](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/cortex-xsiam-data-sources/vendor-specific-data-sources-and-connectors/sap/sap.md): Use SAP data in Cortex XSIAM, including BTP, C4C, and IAM. - [SAP Ariba](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/cortex-xsiam-data-sources/vendor-specific-data-sources-and-connectors/sap/sap-ariba.md): Configure the SAP Ariba connector for Cortex XSIAM security posture monitoring and remediation. - [Saviynt](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/cortex-xsiam-data-sources/vendor-specific-data-sources-and-connectors/saviynt.md): Configure the Saviynt connector for Cortex XSIAM. - [Saviynt](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/cortex-xsiam-data-sources/vendor-specific-data-sources-and-connectors/saviynt/saviynt.md): Use Saviynt Enterprise Identity Cloud audit log collector data for Cortex XSIAM. - [SecurityScorecard](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/cortex-xsiam-data-sources/vendor-specific-data-sources-and-connectors/securityscorecard.md): Configure the SecurityScorecard connector for Cortex XSIAM. - [SecurityScorecard](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/cortex-xsiam-data-sources/vendor-specific-data-sources-and-connectors/securityscorecard/securityscorecard.md): Use SecurityScorecard data in Cortex XSIAM. - [Securonix](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/cortex-xsiam-data-sources/vendor-specific-data-sources-and-connectors/securonix.md): Configure the Securonix connector for Cortex XSIAM. - [Securonix](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/cortex-xsiam-data-sources/vendor-specific-data-sources-and-connectors/securonix/securonix.md): Use Securonix data in Cortex XSIAM. - [Sentry](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/cortex-xsiam-data-sources/vendor-specific-data-sources-and-connectors/sentry.md): Configure the Sentry connector for Cortex XSIAM. - [Sentry](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/cortex-xsiam-data-sources/vendor-specific-data-sources-and-connectors/sentry/sentry.md): Use Sentry data in Cortex XSIAM. - [SentinelOne](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/cortex-xsiam-data-sources/vendor-specific-data-sources-and-connectors/sentinelone.md): Configure the SentinelOne data source and connector for Cortex XSIAM. - [SentinelOne DeepVisibility](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/cortex-xsiam-data-sources/vendor-specific-data-sources-and-connectors/sentinelone/sentinelone-deepvisibility.md): Configure SentinelOne DeepVisibility data ingestion for Cortex XSIAM. - [Ingest raw EDR events from SentinelOne DeepVisibility](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/cortex-xsiam-data-sources/vendor-specific-data-sources-and-connectors/sentinelone/sentinelone-deepvisibility/ingest-raw-edr-events-from-sentinelone-deepvisibility.md): Ingest SentinelOne DeepVisibility raw EDR events into Cortex XSIAM. - [SentinelOne](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/cortex-xsiam-data-sources/vendor-specific-data-sources-and-connectors/sentinelone/sentinelone.md): Use SentinelOne data in Cortex XSIAM. - [ServiceNow](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/cortex-xsiam-data-sources/vendor-specific-data-sources-and-connectors/servicenow.md): Configure the ServiceNow data source and connectors for Cortex XSIAM. - [ServiceNow CDMB](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/cortex-xsiam-data-sources/vendor-specific-data-sources-and-connectors/servicenow/servicenow-cdmb.md): Use ServiceNow CMDB data in Cortex XSIAM. - [Ingest data from ServiceNow CMDB](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/cortex-xsiam-data-sources/vendor-specific-data-sources-and-connectors/servicenow/servicenow-cdmb/ingest-data-from-servicenow-cmdb.md): Ingest ServiceNow CMDB data into Cortex XSIAM. - [ServiceNow Automation and Collection](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/cortex-xsiam-data-sources/vendor-specific-data-sources-and-connectors/servicenow/servicenow-automation-and-collection.md): Configure ServiceNow automation and collection for Cortex XSIAM. - [ServiceNow](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/cortex-xsiam-data-sources/vendor-specific-data-sources-and-connectors/servicenow/servicenow.md): Use ServiceNow data in Cortex XSIAM. - [Shopify](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/cortex-xsiam-data-sources/vendor-specific-data-sources-and-connectors/shopify.md): Configure the Shopify connector for Cortex XSIAM. - [Shopify](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/cortex-xsiam-data-sources/vendor-specific-data-sources-and-connectors/shopify/shopify.md): Use Shopify SaaS posture monitoring data for Cortex XSIAM. - [Shodan](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/cortex-xsiam-data-sources/vendor-specific-data-sources-and-connectors/shodan.md): Configure the Shodan connector for Cortex XSIAM. - [Shodan](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/cortex-xsiam-data-sources/vendor-specific-data-sources-and-connectors/shodan/shodan.md): Use Shodan data in Cortex XSIAM. - [Skyhigh Security](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/cortex-xsiam-data-sources/vendor-specific-data-sources-and-connectors/skyhigh-security.md): Configure the Skyhigh Security connector for Cortex XSIAM. - [Skyhigh Security](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/cortex-xsiam-data-sources/vendor-specific-data-sources-and-connectors/skyhigh-security/skyhigh-security.md): Use Skyhigh Security and Secure Web Gateway data in Cortex XSIAM. - [Slack](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/cortex-xsiam-data-sources/vendor-specific-data-sources-and-connectors/slack.md): Configure the Slack connectors for Cortex XSIAM. - [Slack Automation and Collection](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/cortex-xsiam-data-sources/vendor-specific-data-sources-and-connectors/slack/slack-automation-and-collection.md): Configure Slack automation, notifications, and audit log collection for Cortex XSIAM. - [Slack Enterprise](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/cortex-xsiam-data-sources/vendor-specific-data-sources-and-connectors/slack/slack-enterprise.md): Configure Slack Enterprise identity and SaaS posture monitoring for Cortex XSIAM. - [SMB](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/cortex-xsiam-data-sources/vendor-specific-data-sources-and-connectors/smb.md): Configure the SMB connector for Cortex XSIAM. - [SMB](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/cortex-xsiam-data-sources/vendor-specific-data-sources-and-connectors/smb/smb.md): Use SMB data for Cortex XSIAM file and directory management. - [SMIME Messaging](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/cortex-xsiam-data-sources/vendor-specific-data-sources-and-connectors/smime-messaging.md): Configure the SMIME Messaging connector for Cortex XSIAM. - [SMIME Messaging](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/cortex-xsiam-data-sources/vendor-specific-data-sources-and-connectors/smime-messaging/smime-messaging.md): Use SMIME Messaging data in Cortex XSIAM. - [Snowflake](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/cortex-xsiam-data-sources/vendor-specific-data-sources-and-connectors/snowflake.md): Configure the Snowflake data source and connector for Cortex XSIAM. - [How to onboard Snowflake](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/cortex-xsiam-data-sources/vendor-specific-data-sources-and-connectors/snowflake/how-to-onboard-snowflake.md): Onboard Snowflake as a data source in Cortex XSIAM. - [Snowflake Automation and Collection](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/cortex-xsiam-data-sources/vendor-specific-data-sources-and-connectors/snowflake/snowflake-automation-and-collection.md): Configure Snowflake automation and collection in Cortex XSIAM. - [SolarWinds](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/cortex-xsiam-data-sources/vendor-specific-data-sources-and-connectors/solarwinds.md): Configure the SolarWinds connector for Cortex XSIAM. - [SolarWinds](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/cortex-xsiam-data-sources/vendor-specific-data-sources-and-connectors/solarwinds/solarwinds.md): Use SolarWinds data in Cortex XSIAM. - [Sonatype Nexus](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/cortex-xsiam-data-sources/vendor-specific-data-sources-and-connectors/sonatype-nexus.md): Configure the Sonatype Nexus connector for Cortex XSIAM. - [Connect Sonatype Nexus registry](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/cortex-xsiam-data-sources/vendor-specific-data-sources-and-connectors/sonatype-nexus/connect-sonatype-nexus-registry.md): Use Sonatype Nexus registry data in Cortex XSIAM for container image scanning. - [Manage a Sonatype connector](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/cortex-xsiam-data-sources/vendor-specific-data-sources-and-connectors/sonatype-nexus/connect-sonatype-nexus-registry/manage-a-sonatype-connector.md): Manage the Sonatype registry connector in Cortex XSIAM. - [Sophos](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/cortex-xsiam-data-sources/vendor-specific-data-sources-and-connectors/sophos.md): Configure the Sophos connector for Cortex XSIAM. - [Sophos](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/cortex-xsiam-data-sources/vendor-specific-data-sources-and-connectors/sophos/sophos.md): Use Sophos data in Cortex XSIAM. - [Splunk](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/cortex-xsiam-data-sources/vendor-specific-data-sources-and-connectors/splunk.md): Configure the Splunk connectors for Cortex XSIAM. - [Splunk Automation and Collection](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/cortex-xsiam-data-sources/vendor-specific-data-sources-and-connectors/splunk/splunk-automation-and-collection.md): Configure Splunk automation and collection for Cortex XSIAM. - [Splunk](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/cortex-xsiam-data-sources/vendor-specific-data-sources-and-connectors/splunk/splunk.md): Use Splunk data in Cortex XSIAM. - [Sublime Security](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/cortex-xsiam-data-sources/vendor-specific-data-sources-and-connectors/sublime-security.md): Configure the Sublime Security connector for Cortex XSIAM. - [Sublime Security](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/cortex-xsiam-data-sources/vendor-specific-data-sources-and-connectors/sublime-security/sublime-security.md): Use Sublime Security data in Cortex XSIAM. - [Sumo Logic](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/cortex-xsiam-data-sources/vendor-specific-data-sources-and-connectors/sumo-logic.md): Configure the Sumo Logic data sources for Cortex XSIAM. - [Sumo Logic Automation and Collection](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/cortex-xsiam-data-sources/vendor-specific-data-sources-and-connectors/sumo-logic/sumo-logic-automation-and-collection.md): Configure Sumo Logic automation and collection for Cortex XSIAM. - [Sumo Logic](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/cortex-xsiam-data-sources/vendor-specific-data-sources-and-connectors/sumo-logic/sumo-logic.md): Use Sumo Logic data in Cortex XSIAM. - [SysAid](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/cortex-xsiam-data-sources/vendor-specific-data-sources-and-connectors/sysaid.md): Configure the SysAid connector for Cortex XSIAM. - [SysAid](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/cortex-xsiam-data-sources/vendor-specific-data-sources-and-connectors/sysaid/sysaid.md): Use SysAid data in Cortex XSIAM. - [Syslog Sender](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/cortex-xsiam-data-sources/vendor-specific-data-sources-and-connectors/syslog-sender.md): Configure the Syslog Sender connector for Cortex XSIAM. - [Syslog Sender](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/cortex-xsiam-data-sources/vendor-specific-data-sources-and-connectors/syslog-sender/syslog-sender.md): Use Syslog Sender data in Cortex XSIAM. - [Tanium](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/cortex-xsiam-data-sources/vendor-specific-data-sources-and-connectors/tanium.md): Configure the Tanium connector for Cortex XSIAM. - [Tanium](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/cortex-xsiam-data-sources/vendor-specific-data-sources-and-connectors/tanium/tanium.md): Use Tanium data in Cortex XSIAM. - [TAXII](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/cortex-xsiam-data-sources/vendor-specific-data-sources-and-connectors/taxii.md): Configure the TAXII connector for Cortex XSIAM. - [TAXII](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/cortex-xsiam-data-sources/vendor-specific-data-sources-and-connectors/taxii/taxii.md): Use TAXII data in Cortex XSIAM. - [TeamViewer](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/cortex-xsiam-data-sources/vendor-specific-data-sources-and-connectors/teamviewer.md): Configure the TeamViewer connector for Cortex XSIAM. - [TeamViewer](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/cortex-xsiam-data-sources/vendor-specific-data-sources-and-connectors/teamviewer/teamviewer.md): Use TeamViewer data in Cortex XSIAM. - [Telegram](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/cortex-xsiam-data-sources/vendor-specific-data-sources-and-connectors/telegram.md): Configure the Telegram connector for Cortex XSIAM. - [Telegram](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/cortex-xsiam-data-sources/vendor-specific-data-sources-and-connectors/telegram/telegram.md): Use Telegram data in Cortex XSIAM. - [Tenable](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/cortex-xsiam-data-sources/vendor-specific-data-sources-and-connectors/tenable.md): Configure the Tenable connector for Cortex XSIAM. - [Tenable](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/cortex-xsiam-data-sources/vendor-specific-data-sources-and-connectors/tenable/tenable.md): Use Tenable data in Cortex XSIAM. - [Terraform](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/cortex-xsiam-data-sources/vendor-specific-data-sources-and-connectors/terraform.md): Configure the Terraform connector for Cortex XSIAM. - [Terraform](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/cortex-xsiam-data-sources/vendor-specific-data-sources-and-connectors/terraform/terraform.md): Use Terraform data in Cortex XSIAM. - [Thales](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/cortex-xsiam-data-sources/vendor-specific-data-sources-and-connectors/thales.md): Configure the Thales connector for Cortex XSIAM. - [Thales](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/cortex-xsiam-data-sources/vendor-specific-data-sources-and-connectors/thales/thales.md): Use Thales data in Cortex XSIAM. - [TheHive](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/cortex-xsiam-data-sources/vendor-specific-data-sources-and-connectors/thehive.md): Configure the TheHive connector for Cortex XSIAM. - [TheHive](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/cortex-xsiam-data-sources/vendor-specific-data-sources-and-connectors/thehive/thehive.md): Use TheHive data in Cortex XSIAM. - [Thinkst Canary](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/cortex-xsiam-data-sources/vendor-specific-data-sources-and-connectors/thinkst-canary.md): Configure the Thinkst Canary connector for Cortex XSIAM. - [Thinkst Canary](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/cortex-xsiam-data-sources/vendor-specific-data-sources-and-connectors/thinkst-canary/thinkst-canary.md): Use Thinkst Canary data in Cortex XSIAM. - [ThreatConnect](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/cortex-xsiam-data-sources/vendor-specific-data-sources-and-connectors/threatconnect.md): Configure the ThreatConnect connector for Cortex XSIAM. - [ThreatConnect](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/cortex-xsiam-data-sources/vendor-specific-data-sources-and-connectors/threatconnect/threatconnect.md): Use ThreatConnect data in Cortex XSIAM. - [ThreatMiner.org](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/cortex-xsiam-data-sources/vendor-specific-data-sources-and-connectors/threatminer.org.md): Configure the ThreatMiner.org connector for Cortex XSIAM. - [ThreatMiner.org](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/cortex-xsiam-data-sources/vendor-specific-data-sources-and-connectors/threatminer.org/threatminer.org.md): Use ThreatMiner.org data in Cortex XSIAM. - [ThreatX](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/cortex-xsiam-data-sources/vendor-specific-data-sources-and-connectors/threatx.md): Configure the ThreatX connector for Cortex XSIAM. - [ThreatX](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/cortex-xsiam-data-sources/vendor-specific-data-sources-and-connectors/threatx/threatx.md): Use ThreatX data in Cortex XSIAM. - [Tidy](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/cortex-xsiam-data-sources/vendor-specific-data-sources-and-connectors/tidy.md): Configure the Tidy connector for Cortex XSIAM. - [Tidy](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/cortex-xsiam-data-sources/vendor-specific-data-sources-and-connectors/tidy/tidy.md): Use Tidy data in Cortex XSIAM. - [TOPdesk](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/cortex-xsiam-data-sources/vendor-specific-data-sources-and-connectors/topdesk.md): Configure the TOPdesk connector for Cortex XSIAM. - [TOPdesk](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/cortex-xsiam-data-sources/vendor-specific-data-sources-and-connectors/topdesk/topdesk.md): Use TOPdesk data in Cortex XSIAM. - [Tor Exit Adress](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/cortex-xsiam-data-sources/vendor-specific-data-sources-and-connectors/tor-exit-adress.md): Configure the Tor Exit Adress connector for Cortex XSIAM. - [Tor Exit Adress](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/cortex-xsiam-data-sources/vendor-specific-data-sources-and-connectors/tor-exit-adress/tor-exit-adress.md): Use Tor Exit Adress data in Cortex XSIAM. - [Trellix](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/cortex-xsiam-data-sources/vendor-specific-data-sources-and-connectors/trellix.md): Configure the Trellix connectors for Cortex XSIAM. - [Trellix Database Security](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/cortex-xsiam-data-sources/vendor-specific-data-sources-and-connectors/trellix/trellix-database-security.md): Use Trellix Database Security data in Cortex XSIAM. - [Trellix Email Security (ETP)](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/cortex-xsiam-data-sources/vendor-specific-data-sources-and-connectors/trellix/trellix-email-security-etp.md): Use Trellix Email Security (ETP) data in Cortex XSIAM. - [Trellix Email Security](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/cortex-xsiam-data-sources/vendor-specific-data-sources-and-connectors/trellix/trellix-email-security.md): use Trellix Email Security data in Cortex XSIAM. - [Trellix Endpoint (HX)](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/cortex-xsiam-data-sources/vendor-specific-data-sources-and-connectors/trellix/trellix-endpoint-hx.md): Use Trellix Endpoint (HX) data in Cortex XSIAM. - [Trellix ePO](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/cortex-xsiam-data-sources/vendor-specific-data-sources-and-connectors/trellix/trellix-epo.md): Use Trellix ePO data in Cortex XSIAM. - [Trellix Network](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/cortex-xsiam-data-sources/vendor-specific-data-sources-and-connectors/trellix/trellix-network.md): Use Trellix Network data in Cortex XSIAM. - [Trellix Sandbox](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/cortex-xsiam-data-sources/vendor-specific-data-sources-and-connectors/trellix/trellix-sandbox.md): Use Trellix Sandbox data in Cortex XSIAM. - [Trellix SIEM](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/cortex-xsiam-data-sources/vendor-specific-data-sources-and-connectors/trellix/trellix-siem.md): Use Trellix SIEM data in Cortex XSIAM. - [Trellix Threat Intel](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/cortex-xsiam-data-sources/vendor-specific-data-sources-and-connectors/trellix/trellix-threat-intel.md): Use Threat Intel data in Cortex XSIAM. - [TrendAI](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/cortex-xsiam-data-sources/vendor-specific-data-sources-and-connectors/trendai.md): Configure the TrendAI connector for Cortex XSIAM. - [TrendAI](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/cortex-xsiam-data-sources/vendor-specific-data-sources-and-connectors/trendai/trendai.md): Use TrendAI data in Cortex XSIAM, including Trend Micro endpoint, cloud, email, and XDR integrations. - [Twilio](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/cortex-xsiam-data-sources/vendor-specific-data-sources-and-connectors/twilio.md): Configure the Twilio connector for Cortex XSIAM. - [Twilio](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/cortex-xsiam-data-sources/vendor-specific-data-sources-and-connectors/twilio/twilio.md): Use Twilio data in Cortex XSIAM to send SMS notifications and collect SendGrid email activity. - [Uptycs](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/cortex-xsiam-data-sources/vendor-specific-data-sources-and-connectors/uptycs.md): Configure the Uptycs connector for Cortex XSIAM. - [Uptycs](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/cortex-xsiam-data-sources/vendor-specific-data-sources-and-connectors/uptycs/uptycs.md): Use Uptycs event and security alert data in Cortex XSIAM. - [Vectra](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/cortex-xsiam-data-sources/vendor-specific-data-sources-and-connectors/vectra.md): Configure the Vectra connector for Cortex XSIAM. - [Vectra](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/cortex-xsiam-data-sources/vendor-specific-data-sources-and-connectors/vectra/vectra.md): Use Vectra data in Cortex XSIAM to collect detections and audits. - [Versa Networks](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/cortex-xsiam-data-sources/vendor-specific-data-sources-and-connectors/versa-networks.md): Configure the Versa Networks connector for Cortex XSIAM. - [Versa Networks](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/cortex-xsiam-data-sources/vendor-specific-data-sources-and-connectors/versa-networks/versa-networks.md): Use Versa Networks data in Cortex XSIAM, including Versa Director. - [VMware](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/cortex-xsiam-data-sources/vendor-specific-data-sources-and-connectors/vmware.md): Configure the VMware connectors for Cortex XSIAM. - [VMware Automation and Collection](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/cortex-xsiam-data-sources/vendor-specific-data-sources-and-connectors/vmware/vmware-automation-and-colection.md): Configure VMware automation and collection capabilities for Cortex XSIAM. - [VMWare](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/cortex-xsiam-data-sources/vendor-specific-data-sources-and-connectors/vmware/vmware.md): Configure VMware security posture capabilities for Cortex XSIAM. - [VulnDB](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/cortex-xsiam-data-sources/vendor-specific-data-sources-and-connectors/vulndb.md): Configure the VulnDB connector for Cortex XSIAM. - [VulnDB](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/cortex-xsiam-data-sources/vendor-specific-data-sources-and-connectors/vulndb/vulndb.md): Use VulnDB vulnerability intelligence data in Cortex XSIAM. - [WhatsMyBrowser.org](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/cortex-xsiam-data-sources/vendor-specific-data-sources-and-connectors/whatsmybrowser.org.md): Configure the WhatsMyBrowser.org connector for Cortex XSIAM. - [WhatsMyBrowser.org](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/cortex-xsiam-data-sources/vendor-specific-data-sources-and-connectors/whatsmybrowser.org/whatsmybrowser.org.md): Use WhatsMyBrowser.org data in Cortex XSIAM user-agent parsing. - [Whois](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/cortex-xsiam-data-sources/vendor-specific-data-sources-and-connectors/whois.md): Configure the Whois connector for Cortex XSIAM. - [Whois](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/cortex-xsiam-data-sources/vendor-specific-data-sources-and-connectors/whois/whois.md): Use Whois domain enrichment data in Cortex XSIAM. - [WithSecure](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/cortex-xsiam-data-sources/vendor-specific-data-sources-and-connectors/withsecure.md): Configure the WithSecure connector for Cortex XSIAM. - [WithSecure](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/cortex-xsiam-data-sources/vendor-specific-data-sources-and-connectors/withsecure/withsecure.md): Use WithSecure Endpoint Protection data in Cortex XSIAM. - [Workday](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/cortex-xsiam-data-sources/vendor-specific-data-sources-and-connectors/workday.md): Configure the Workday data source and connectors in Cortex XSIAM. - [Ingest report data from Workday](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/cortex-xsiam-data-sources/vendor-specific-data-sources-and-connectors/workday/ingest-report-data-from-workday.md): Ingest Workday report data into Cortex XSIAM. - [Workday Automation and Collection](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/cortex-xsiam-data-sources/vendor-specific-data-sources-and-connectors/workday/workday-automation-and-collection.md): Configure Workday automation and collection data for Cortex XSIAM. - [Workday](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/cortex-xsiam-data-sources/vendor-specific-data-sources-and-connectors/workday/workday.md): Use Workday data in Cortex XSIAM. - [X](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/cortex-xsiam-data-sources/vendor-specific-data-sources-and-connectors/x.md): Configure the X connector for Cortex XSIAM. - [X Automation and Remediation](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/cortex-xsiam-data-sources/vendor-specific-data-sources-and-connectors/x/x-automation-and-remediation.md): Use X automation and remediation in Cortex XSIAM. - [YouTrack](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/cortex-xsiam-data-sources/vendor-specific-data-sources-and-connectors/youtrack.md): Configure the YouTrack connector for Cortex XSIAM. - [YouTrack](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/cortex-xsiam-data-sources/vendor-specific-data-sources-and-connectors/youtrack/youtrack.md): Use YouTrack data for Cortex XSIAM. - [Zendesk](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/cortex-xsiam-data-sources/vendor-specific-data-sources-and-connectors/zendesk.md): Configure the Zendesk connector for Cortex XSIAM. - [Zendesk](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/cortex-xsiam-data-sources/vendor-specific-data-sources-and-connectors/zendesk/zendesk.md): Use Zendesk data in Cortex XSIAM. - [Zero Networks](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/cortex-xsiam-data-sources/vendor-specific-data-sources-and-connectors/zero-networks.md): Configure the Zero Networks connector for Cortex XSIAM. - [Zero Networks](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/cortex-xsiam-data-sources/vendor-specific-data-sources-and-connectors/zero-networks/zero-networks.md): Use Zero Networks data in Cortex XSIAM. - [Zimperium](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/cortex-xsiam-data-sources/vendor-specific-data-sources-and-connectors/zimperium.md): Configure the Zimperium connector for Cortex XSIAM. - [Zimperium](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/cortex-xsiam-data-sources/vendor-specific-data-sources-and-connectors/zimperium/zimperium.md): Use Zimperium data in Cortex XSIAM. - [Zoom](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/cortex-xsiam-data-sources/vendor-specific-data-sources-and-connectors/zoom.md): Configure the Zoom connector for Cortex XSIAM. - [Zoom](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/cortex-xsiam-data-sources/vendor-specific-data-sources-and-connectors/zoom/zoom.md): Use Zoom data in Cortex XSIAM, including users, meetings, logs, and feeds. - [Zscaler](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/cortex-xsiam-data-sources/vendor-specific-data-sources-and-connectors/zscaler.md): Configure the Zscaler data sources and connector for Cortex XSIAM. - [Zscaler Internet Access](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/cortex-xsiam-data-sources/vendor-specific-data-sources-and-connectors/zscaler/zscaler-internet-access.md): Configure Zscaler Internet Access (ZIA) log collection in Cortex XSIAM. - [Zscaler Private Access](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/cortex-xsiam-data-sources/vendor-specific-data-sources-and-connectors/zscaler/zscaler-private-access.md): Configure Zscaler Private Access (ZPA) log collection in Cortex XSIAM. - [Zscaler](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/cortex-xsiam-data-sources/vendor-specific-data-sources-and-connectors/zscaler/zscaler.md): Use Zscaler data in Cortex XSIAM for ZIA log collection and security management. - [Connectors](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/cortex-xsiam-data-sources/connectors.md): Configure connectors that collect and enrich data in Cortex XSIAM. - [Standard data sources](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/cortex-xsiam-data-sources/standard-data-sources.md): Configure standard data sources to ingest telemetry into Cortex XSIAM. - [Cloud service provider (CSP) onboarding](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/cortex-xsiam-data-sources/cloud-service-provider-csp-onboarding.md): Learn about onboarding your cloud service provider to Cortex XSIAM. - [Understand CSP onboarding tiers and licensing](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/cortex-xsiam-data-sources/cloud-service-provider-csp-onboarding/understand-csp-onboarding-tiers-and-licensing.md): Understand the license tiers and capabilities available for CSP onboarding in Cortex XSIAM. - [Amazon Web Services cloud onboarding](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/cortex-xsiam-data-sources/cloud-service-provider-csp-onboarding/amazon-web-services-cloud-onboarding.md): Follow the AWS onboarding wizard, and Cortex XSIAM creates a custom authentication template to be deployed in AWS. - [AWS security capabilities and deployment planning](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/cortex-xsiam-data-sources/cloud-service-provider-csp-onboarding/amazon-web-services-cloud-onboarding/aws-security-capabilities-and-deployment-planning.md): Plan AWS security capabilities for Cortex XSIAM cloud onboarding. - [AWS resource inventory](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/cortex-xsiam-data-sources/cloud-service-provider-csp-onboarding/amazon-web-services-cloud-onboarding/aws-resource-inventory.md): Inventory AWS resources for Cortex XSIAM cloud onboarding. - [AWS security model and authentication](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/cortex-xsiam-data-sources/cloud-service-provider-csp-onboarding/amazon-web-services-cloud-onboarding/aws-security-model-and-authentication.md): Understand AWS authentication for Cortex XSIAM cloud onboarding. - [Cortex XSIAM and AWS audit log collection architecture](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/cortex-xsiam-data-sources/cloud-service-provider-csp-onboarding/amazon-web-services-cloud-onboarding/cortex-cloud-and-aws-audit-log-collection-architecture.md): Understand AWS audit log collection architecture for Cortex XSIAM. - [Onboard Amazon Web Services](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/cortex-xsiam-data-sources/cloud-service-provider-csp-onboarding/amazon-web-services-cloud-onboarding/onboard-amazon-web-services.md): Follow the AWS onboarding wizard, and Cortex XSIAM creates a custom authentication template to be executed in AWS. - [Prerequisites for onboarding AWS](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/cortex-xsiam-data-sources/cloud-service-provider-csp-onboarding/amazon-web-services-cloud-onboarding/prerequisites-for-onboarding-aws.md): Before you begin onboarding AWS, you must review the following prerequisites. - [How to onboard Amazon Web Services](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/cortex-xsiam-data-sources/cloud-service-provider-csp-onboarding/amazon-web-services-cloud-onboarding/how-to-onboard-amazon-web-services.md): Follow the AWS onboarding wizard and Cortex XSIAM creates a custom authentication template to be deployed in AWS CloudFormation. - [How to onboard Amazon Web Services with foundational configuration](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/cortex-xsiam-data-sources/cloud-service-provider-csp-onboarding/amazon-web-services-cloud-onboarding/how-to-onboard-amazon-web-services-with-foundational-configuration.md) - [Deploy the authentication template in AWS](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/cortex-xsiam-data-sources/cloud-service-provider-csp-onboarding/amazon-web-services-cloud-onboarding/deploy-the-authentication-template-in-aws.md): Learn how to deploy the Terraform or CloudFormation authentication template in Amazon Web Services. - [Post-deployment: Custom (BYOB) and Control Tower audit log collection](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/cortex-xsiam-data-sources/cloud-service-provider-csp-onboarding/amazon-web-services-cloud-onboarding/post-deployment-custom-byob-audit-log-collection.md): Configure AWS audit log collection after Cortex XSIAM deployment. - [Grant cross-account KMS key access for Control Tower BYOB log collection](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/cortex-xsiam-data-sources/cloud-service-provider-csp-onboarding/amazon-web-services-cloud-onboarding/grant-cross-account-kms-key-access-for-control-tower-byob-log-collection.md): Learn how to configure cross-account AWS KMS key permissions for Cortex Control Tower BYOB log collection. Step-by-step guide to updating KMS key policies. - [AWS post-deployment verification](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/cortex-xsiam-data-sources/cloud-service-provider-csp-onboarding/amazon-web-services-cloud-onboarding/aws-post-deployment-verification.md): After you have completed the AWS onboarding wizard and you have deployed the authentication template in AWS (using CloudFormation or Terraform), verify that the deployment succeeded. - [Amazon Web Services (AWS) provider permissions](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/cortex-xsiam-data-sources/cloud-service-provider-csp-onboarding/amazon-web-services-cloud-onboarding/amazon-web-services-aws-provider-permissions.md): List of Amazon Web Services (AWS) permissions for use during Cortex XSIAM onboarding to enable continuous monitoring in your cloud environment. - [Microsoft Azure cloud onboarding](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/cortex-xsiam-data-sources/cloud-service-provider-csp-onboarding/microsoft-azure-cloud-onboarding.md): Onboard Microsoft Azure cloud resources to Cortex XSIAM. - [Onboard Microsoft Azure](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/cortex-xsiam-data-sources/cloud-service-provider-csp-onboarding/microsoft-azure-cloud-onboarding/onboard-microsoft-azure.md): Follow the Azure onboarding wizard, and Cortex creates a custom authentication template to be executed in Azure. - [Prerequisites for onboarding Azure](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/cortex-xsiam-data-sources/cloud-service-provider-csp-onboarding/microsoft-azure-cloud-onboarding/prerequisites-for-onboarding-azure.md): Before you begin onboarding Microsoft Azure, you must review the following prerequisites. - [How to onboard Microsoft Azure](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/cortex-xsiam-data-sources/cloud-service-provider-csp-onboarding/microsoft-azure-cloud-onboarding/how-to-onboard-microsoft-azure.md): Follow the Azure onboarding wizard, and Cortex creates a custom authentication template to be executed in Azure. - [How to onboard Microsoft Azure with foundational configuration](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/cortex-xsiam-data-sources/cloud-service-provider-csp-onboarding/microsoft-azure-cloud-onboarding/how-to-onboard-microsoft-azure-with-foundational-configuration.md) - [Finalize Microsoft Azure onboarding by executing the authentication template](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/cortex-xsiam-data-sources/cloud-service-provider-csp-onboarding/microsoft-azure-cloud-onboarding/finalize-microsoft-azure-onboarding-by-executing-the-authentication-template.md): Learn how to execute the authentication template file in Microsoft Azure for subscriptions, tenants, and management groups. We provide instructions both for applying the Terraform template's configura - [Microsoft Azure offboarding overview](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/cortex-xsiam-data-sources/cloud-service-provider-csp-onboarding/microsoft-azure-cloud-onboarding/microsoft-azure-offboarding-overview.md): This section contains the technical procedures required to safely decommission and offboard your Cortex XSIAM resources in Microsoft Azure. - [Offboard Terraform-based Azure deployments (all scopes)](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/cortex-xsiam-data-sources/cloud-service-provider-csp-onboarding/microsoft-azure-cloud-onboarding/microsoft-azure-offboarding-overview/offboard-terraform-based-azure-deployments-all-scopes.md): How to offboard all Terraform-based Microsoft Azure scopes from Cortex XSIAM: A step-by-step technical guide to safely running Terraform destroy and cleaning up policy-deployed resources. - [Offboard Azure subscription (ARM)](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/cortex-xsiam-data-sources/cloud-service-provider-csp-onboarding/microsoft-azure-cloud-onboarding/microsoft-azure-offboarding-overview/offboard-azure-subscription-arm.md): How to offboard a Microsoft Azure subscription scope that was onboarded using ARM: A step-by-step technical guide to safely running the interactive offboarding script and cleaning up all resources. - [Offboard Azure management group or tenant scope (ARM)](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/cortex-xsiam-data-sources/cloud-service-provider-csp-onboarding/microsoft-azure-cloud-onboarding/microsoft-azure-offboarding-overview/offboard-azure-management-group-or-tenant-scope-arm.md): How to offboard Microsoft Azure management group or tenant scopes from Cortex XSIAM: A step-by-step technical guide to safely removing all Azure resources deployed by Cortex onboarding templates. - [Offboard Azure tenant with Entra ID only](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/cortex-xsiam-data-sources/cloud-service-provider-csp-onboarding/microsoft-azure-cloud-onboarding/microsoft-azure-offboarding-overview/offboard-azure-tenant-with-entra-id-only.md): How to offboard a Microsoft Azure tenant onboarded with the Entra ID only option from Cortex XSIAM: A step-by-step technical guide to safely removing deployed resources. - [Microsoft Azure provider permissions](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/cortex-xsiam-data-sources/cloud-service-provider-csp-onboarding/microsoft-azure-cloud-onboarding/microsoft-azure-provider-permissions.md): List of Microsoft Azure provider permissions for Cortex XSIAM. - [Google Cloud Platform onboarding](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/cortex-xsiam-data-sources/cloud-service-provider-csp-onboarding/google-cloud-platform-cloud-onboarding.md): Onboard Google Cloud Platform resources to Cortex XSIAM. - [Onboard Google Cloud Platform](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/cortex-xsiam-data-sources/cloud-service-provider-csp-onboarding/google-cloud-platform-cloud-onboarding/onboard-google-cloud-platform.md): Follow the GCP onboarding wizard, and Cortex creates a custom authentication template to be executed in GCP. - [Prerequisites for onboarding GCP](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/cortex-xsiam-data-sources/cloud-service-provider-csp-onboarding/google-cloud-platform-cloud-onboarding/prerequisites-for-onboarding-gcp.md): Before you begin onboarding GCP, you must review the following prerequisites. - [Required APIs](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/cortex-xsiam-data-sources/cloud-service-provider-csp-onboarding/google-cloud-platform-cloud-onboarding/prerequisites-for-onboarding-gcp/required-apis.md) - [How to onboard Google Cloud Platform](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/cortex-xsiam-data-sources/cloud-service-provider-csp-onboarding/google-cloud-platform-cloud-onboarding/how-to-onboard-google-cloud-platform.md): Follow the GCP onboarding wizard, and Cortex XSIAM creates a custom authentication template to be applied in GCP. - [How to onboard GCP with foundational configuration](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/cortex-xsiam-data-sources/cloud-service-provider-csp-onboarding/google-cloud-platform-cloud-onboarding/how-to-onboard-microsoft-azure-with-foundational-configuration.md): Onboard GCP with foundational configuration for Cortex XSIAM. - [Deploy the Terraform authentication template in GCP](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/cortex-xsiam-data-sources/cloud-service-provider-csp-onboarding/google-cloud-platform-cloud-onboarding/deploy-the-terraform-authentication-template-in-gcp.md): Learn how to deploy the Terraform authentication template in Google Cloud Console. - [Connect Google Workspace with your GCP cloud instance](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/cortex-xsiam-data-sources/cloud-service-provider-csp-onboarding/google-cloud-platform-cloud-onboarding/connect-google-workspace-with-your-gcp-cloud-instance.md): Connect Google Workspace to Cortex XSIAM through your GCP instance. - [Monitor GCP resources inside service perimeters](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/cortex-xsiam-data-sources/cloud-service-provider-csp-onboarding/google-cloud-platform-cloud-onboarding/monitor-gcp-resources-inside-service-perimeters.md): Learn how to grant authorization to Cortex XSIAM to scan within your GCP service perimeter. - [Google Cloud Platform (GCP) provider permissions](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/cortex-xsiam-data-sources/cloud-service-provider-csp-onboarding/google-cloud-platform-cloud-onboarding/google-cloud-platform-gcp-provider-permissions.md): List of Google Cloud Platform (GCP) permissions for use during Cortex XSIAM onboarding to enable continuous monitoring in your cloud environment. - [Oracle Cloud Infrastructure cloud onboarding](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/cortex-xsiam-data-sources/cloud-service-provider-csp-onboarding/oracle-cloud-infrastructure-cloud-onboarding.md): Follow the Oracle Cloud Infrastructure onboarding wizard and Cortex XSIAM creates a custom Terraform authentication template to be deployed in Oracle Cloud Infrastructure. - [Onboard Oracle Cloud Infrastructure](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/cortex-xsiam-data-sources/cloud-service-provider-csp-onboarding/oracle-cloud-infrastructure-cloud-onboarding/onboard-oracle-cloud-infrastructure.md): Follow the OCI onboarding wizard, and Cortex creates a custom authentication template to be executed in OCI. - [Prerequisites for onboarding OCI](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/cortex-xsiam-data-sources/cloud-service-provider-csp-onboarding/oracle-cloud-infrastructure-cloud-onboarding/prerequisites-for-onboarding-oci.md): Before you begin onboarding Oracle Cloud Infrastructure, you must review the following prerequisites. - [How to onboard Oracle Cloud Infrastructure](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/cortex-xsiam-data-sources/cloud-service-provider-csp-onboarding/oracle-cloud-infrastructure-cloud-onboarding/how-to-onboard-oracle-cloud-infrastructure.md): Follow the OCI onboarding wizard and Cortex XSIAM creates a custom authentication template to be applied in OCI. - [How to onboard Oracle Cloud Infrastructure with foundational configuration](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/cortex-xsiam-data-sources/cloud-service-provider-csp-onboarding/oracle-cloud-infrastructure-cloud-onboarding/how-to-onboard-oracle-cloud-infrastructure-with-foundational-configuration.md): Onboard Oracle Cloud Infrastructure to Cortex XSIAM. - [Deploy the Terraform authentication template in OCI](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/cortex-xsiam-data-sources/cloud-service-provider-csp-onboarding/oracle-cloud-infrastructure-cloud-onboarding/deploy-the-terraform-authentication-template-in-oci.md): Learn how to deploy the Terraform authentication template in Oracle Cloud Infrastructure. - [Oracle Cloud Infrastructure (OCI) provider permissions](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/cortex-xsiam-data-sources/cloud-service-provider-csp-onboarding/oracle-cloud-infrastructure-cloud-onboarding/oracle-cloud-infrastructure-oci-provider-permissions.md): List of Oracle Cloud Infrastructure provider permissions for Cortex XSIAM. - [Alibaba Cloud cloud onboarding](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/cortex-xsiam-data-sources/cloud-service-provider-csp-onboarding/alibaba-cloud-cloud-onboarding.md): Follow the Alibaba Cloud onboarding wizard and Cortex XSIAM creates a custom Terraform authentication template to be deployed in Alibaba Cloud. - [Alibaba security capabilities and deployment planning](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/cortex-xsiam-data-sources/cloud-service-provider-csp-onboarding/alibaba-cloud-cloud-onboarding/alibaba-security-capabilities-and-deployment-planning.md): Plan Alibaba Cloud security capabilities for Cortex XSIAM onboarding. - [Alibaba Cloud resource inventory](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/cortex-xsiam-data-sources/cloud-service-provider-csp-onboarding/alibaba-cloud-cloud-onboarding/alibaba-cloud-resource-inventory.md): Inventory Alibaba Cloud resources for Cortex XSIAM onboarding. - [Alibaba Cloud security model and authentication](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/cortex-xsiam-data-sources/cloud-service-provider-csp-onboarding/alibaba-cloud-cloud-onboarding/alibaba-cloud-security-model-and-authentication.md): Understand Alibaba Cloud authentication for Cortex XSIAM onboarding. - [Onboard Alibaba Cloud](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/cortex-xsiam-data-sources/cloud-service-provider-csp-onboarding/alibaba-cloud-cloud-onboarding/onboard-alibaba-cloud.md): Follow the Alibaba Cloud onboarding wizard and Cortex XSIAM creates a custom CloudFormation authentication template to be deployed in Alibaba Cloud. - [Prerequisites for onboarding Alibaba Cloud](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/cortex-xsiam-data-sources/cloud-service-provider-csp-onboarding/alibaba-cloud-cloud-onboarding/prerequisites-for-onboarding-alibaba-cloud.md): Before you begin onboarding Alibaba Cloud, you must review the following prerequisites. - [How to onboard Alibaba Cloud](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/cortex-xsiam-data-sources/cloud-service-provider-csp-onboarding/alibaba-cloud-cloud-onboarding/how-to-onboard-alibaba-cloud.md): Onboard Alibaba Cloud resources to Cortex XSIAM. - [Alibaba Cloud post-deployment verification](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/cortex-xsiam-data-sources/cloud-service-provider-csp-onboarding/alibaba-cloud-cloud-onboarding/alibaba-cloud-post-deployment-verification.md): After you have completed the Alibaba Cloud onboarding wizard and you have deployed the authentication template in Alibaba Cloud, verify that the deployment succeeded. - [Alibaba Cloud provider permissions](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/cortex-xsiam-data-sources/cloud-service-provider-csp-onboarding/alibaba-cloud-cloud-onboarding/alibaba-cloud-provider-permissions.md): List of Alibaba Cloud permissions for use during Cortex XSIAM onboarding to enable continuous monitoring in your cloud environment. - [Outpost onboarding](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/cortex-xsiam-data-sources/cloud-service-provider-csp-onboarding/outpost-onboarding.md): Learn about outposts, which are a dedicated set of infrastructure resources that extends the reach of Cortex XSIAM into your environment. - [Outpost fundamentals and planning](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/cortex-xsiam-data-sources/cloud-service-provider-csp-onboarding/outpost-onboarding/outpost-fundamentals-and-planning.md): An outpost enables you to have security scans performed on infrastructure in a cloud account owned by you. Learn about outpost fundamentals and what to consider when planning your outpost. - [Outpost creation workflow](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/cortex-xsiam-data-sources/cloud-service-provider-csp-onboarding/outpost-onboarding/outpost-creation-workflow.md): Learn about the creation process for an outposts, which facilitate security scanning performed on infrastructure in a cloud account owned by you. - [Working with standard outposts](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/cortex-xsiam-data-sources/cloud-service-provider-csp-onboarding/outpost-onboarding/working-with-standard-outposts.md): Standard outposts are the recommended way to create dedicated set of infrastructure resources that extends the reach of Cortex XSIAM into your environment. - [Create a standard outpost](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/cortex-xsiam-data-sources/cloud-service-provider-csp-onboarding/outpost-onboarding/working-with-standard-outposts/create-a-standard-outpost.md): Instructions for creating a standard outpost while onboarding your CSP. - [Working with Bringing your own Azure app (BYOA) outposts](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/cortex-xsiam-data-sources/cloud-service-provider-csp-onboarding/outpost-onboarding/working-with-bringing-your-own-azure-app-byoa-outposts.md): Using advanced settings while creating your outpost, you can deploy a Cortex Cloud Azure outpost using your own pre-created Entra ID app registration. - [Task 1: Meet the prerequisites for Azure BYOA outposts](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/cortex-xsiam-data-sources/cloud-service-provider-csp-onboarding/outpost-onboarding/working-with-bringing-your-own-azure-app-byoa-outposts/task-1-meet-the-prerequisites-for-azure-byoa-outposts.md): You can customize your own Azure outpost by bringing your own app (BYOA). This page lists the prerequisites that must be met before customizing your outpost in this way. - [Task 2: Create the app registration for the Azure BYOA outpost](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/cortex-xsiam-data-sources/cloud-service-provider-csp-onboarding/outpost-onboarding/working-with-bringing-your-own-azure-app-byoa-outposts/task-2-create-the-app-registration-for-the-azure-byoa-outpost.md): You can customize your own outpost for Azure by bringing your own app (BYOA). This page describes the steps for creating the app registration. - [Task 3: Deploy the Azure BYOA outpost](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/cortex-xsiam-data-sources/cloud-service-provider-csp-onboarding/outpost-onboarding/working-with-bringing-your-own-azure-app-byoa-outposts/task-3-deploy-the-azure-byoa-outpost.md): You can customize your own outpost by bringing your own app (BYOA). This page describes the steps for deploying the Azure BYOA outpost. - [Task 4: Verify the BYOA outpost deployment](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/cortex-xsiam-data-sources/cloud-service-provider-csp-onboarding/outpost-onboarding/working-with-bringing-your-own-azure-app-byoa-outposts/task-4-verify-the-byoa-outpost-deployment.md): You can customize your own Azure outpost by bringing your own app (BYOA). This page describes the steps for verifying your BYOA outpost deployment. - [The shell script for Azure app registration](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/cortex-xsiam-data-sources/cloud-service-provider-csp-onboarding/outpost-onboarding/working-with-bringing-your-own-azure-app-byoa-outposts/the-shell-script-for-azure-app-registration.md): You can run this helper shell script to set up your resources and retrieve their IDs for use while creating your Azure BYOA outpost. This page provides technical, "read-me style" details about the scr - [Outpost troubleshooting](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/cortex-xsiam-data-sources/cloud-service-provider-csp-onboarding/outpost-onboarding/outpost-troubleshooting.md): Check here for solutions to issues that might occur while configuring, deploying, and operating outposts. - [Outpost Cloud Service Provider (CSP) permissions](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/cortex-xsiam-data-sources/cloud-service-provider-csp-onboarding/outpost-onboarding/outpost-cloud-service-provider-csp-permissions.md): This page lists and explains the various roles and permissions needed for working with resources for outposts by CSP. - [Amazon Web Services (AWS) outpost permissions](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/cortex-xsiam-data-sources/cloud-service-provider-csp-onboarding/outpost-onboarding/outpost-cloud-service-provider-csp-permissions/amazon-web-services-aws-outpost-permissions.md): List of Amazon Web Services (AWS) permissions for use during Cortex XSIAM outpost onboarding to enable continuous monitoring in your cloud environment. - [Microsoft Azure outpost permissions](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/cortex-xsiam-data-sources/cloud-service-provider-csp-onboarding/outpost-onboarding/outpost-cloud-service-provider-csp-permissions/microsoft-azure-outpost-permissions.md): List of Microsoft Azure provider outpost permissions for Cortex XSIAM. - [Google Cloud Platform (GCP) outpost permissions](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/cortex-xsiam-data-sources/cloud-service-provider-csp-onboarding/outpost-onboarding/outpost-cloud-service-provider-csp-permissions/google-cloud-platform-gcp-outpost-permissions.md): List of Google Cloud Platform (GCP) permissions for use during Cortex XSIAM onboarding outposts to enable continuous monitoring in your cloud environment. - [Introduction to Terraform for Cloud service provider (CSP) onboarding](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/cortex-xsiam-data-sources/cloud-service-provider-csp-onboarding/introduction-to-terraform-for-cloud-service-provider-csp-onboarding.md): Learn how to onboard Cloud Service Providers (CSPs) using Terraform. Discover step-by-step workflows for initial provisioning, updates, and Cloud Shell deployment. - [Manually connect a cloud instance](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/cortex-xsiam-data-sources/cloud-service-provider-csp-onboarding/manually-connect-a-cloud-instance.md): Manually connect a cloud instance to Cortex XSIAM. - [Manage cloud instances](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/cortex-xsiam-data-sources/cloud-service-provider-csp-onboarding/manage-cloud-instances.md): Manage cloud instances connected to Cortex XSIAM. - [Pending cloud instances](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/cortex-xsiam-data-sources/cloud-service-provider-csp-onboarding/pending-cloud-instances.md): Review pending cloud instances in Cortex XSIAM. - [Edit your onboarded CSP configuration](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/cortex-xsiam-data-sources/cloud-service-provider-csp-onboarding/edit-your-onboarded-csp-configuration.md): Update onboarded cloud configurations in Cortex XSIAM. - [Update cloud permissions after Cortex XSIAM release updates](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/cortex-xsiam-data-sources/cloud-service-provider-csp-onboarding/update-cloud-permissions-after-cortex-release-updates.md): Manage permission updates for your cloud instances following new feature releases or bug fixes in Cortex XSIAM. - [Troubleshoot errors on cloud instances](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/cortex-xsiam-data-sources/cloud-service-provider-csp-onboarding/troubleshoot-errors-on-cloud-instances.md): You can troubleshoot errors on cloud instances by drilling down on an instance from the Data Sources & Integrations page in Cortex XSIAM. - [Cloud service provider permissions](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/cortex-xsiam-data-sources/cloud-service-provider-csp-onboarding/cloud-service-provider-permissions.md): Grant the correct cloud service provider permissions for Cortex XSIAM. - [Generic on-premise data collectors](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/cortex-xsiam-data-sources/generic-on-premise-data-collectors.md): Configure generic on-premise data collectors for Cortex XSIAM. - [Broker VM data collector applets](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/cortex-xsiam-data-sources/generic-on-premise-data-collectors/broker-vm-data-collector-applets.md): Configure Broker VM data collector applets for Cortex XSIAM. - [Activate Apache Kafka Collector](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/cortex-xsiam-data-sources/generic-on-premise-data-collectors/broker-vm-data-collector-applets/activate-apache-kafka-collector.md): Configure the Apache Kafka Collector applet for Cortex XSIAM. - [Activate Cortex Network Scanner](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/cortex-xsiam-data-sources/generic-on-premise-data-collectors/broker-vm-data-collector-applets/activate-cortex-network-scanner.md): Configure the Cortex Network Scanner applet for Cortex XSIAM. - [Activate CSV Collector](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/cortex-xsiam-data-sources/generic-on-premise-data-collectors/broker-vm-data-collector-applets/activate-csv-collector.md): Configure the CSV Collector applet for Cortex XSIAM. - [Activate Database Collector](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/cortex-xsiam-data-sources/generic-on-premise-data-collectors/broker-vm-data-collector-applets/activate-database-collector.md): Configure the Database Collector applet for Cortex XSIAM. - [Activate DSPM Database](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/cortex-xsiam-data-sources/generic-on-premise-data-collectors/broker-vm-data-collector-applets/activate-dspm-database.md): Configure the DSPM Database applet for Cortex XSIAM. - [Activate DSPM Fileshare](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/cortex-xsiam-data-sources/generic-on-premise-data-collectors/broker-vm-data-collector-applets/activate-dspm-fileshare.md): Configure the DSPM Fileshare applet for Cortex XSIAM. - [Activate Files and Folders Collector](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/cortex-xsiam-data-sources/generic-on-premise-data-collectors/broker-vm-data-collector-applets/activate-files-and-folders-collector.md): Configure the Files and Folders Collector applet for Cortex XSIAM. - [Activate FTP Collector](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/cortex-xsiam-data-sources/generic-on-premise-data-collectors/broker-vm-data-collector-applets/activate-ftp-collector.md): Configure the FTP Collector applet for Cortex XSIAM. - [Activate Local Agent Settings](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/cortex-xsiam-data-sources/generic-on-premise-data-collectors/broker-vm-data-collector-applets/activate-local-agent-settings.md): Configure the Local Agent Settings applet for Cortex XSIAM. - [Activate NetFlow Collector](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/cortex-xsiam-data-sources/generic-on-premise-data-collectors/broker-vm-data-collector-applets/activate-netflow-collector.md): Configure the NetFlow Collector applet for Cortex XSIAM. - [Activate Network Mapper](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/cortex-xsiam-data-sources/generic-on-premise-data-collectors/broker-vm-data-collector-applets/activate-network-mapper.md): Configure the Network Mapper applet for Cortex XSIAM. - [Activate Registry Scanner](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/cortex-xsiam-data-sources/generic-on-premise-data-collectors/broker-vm-data-collector-applets/activate-registry-scanner.md): Configure Registry Scanner applet for Cortex XSIAM. - [Syslog Collector applet](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/cortex-xsiam-data-sources/generic-on-premise-data-collectors/broker-vm-data-collector-applets/syslog-collector-applet.md): Configure the Syslog Collector applet for Cortex XSIAM. - [Activate Syslog Collector](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/cortex-xsiam-data-sources/generic-on-premise-data-collectors/broker-vm-data-collector-applets/syslog-collector-applet/activate-syslog-collector.md): Configure the Syslog Collector for Cortex XSIAM. - [Ingest logs from a Syslog receiver](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/cortex-xsiam-data-sources/generic-on-premise-data-collectors/broker-vm-data-collector-applets/syslog-collector-applet/ingest-logs-from-a-syslog-receiver.md): To extend visibility, Cortex XSIAM can receive Syslog from additional vendors that use CEF or LEEF formatted over Syslog (TLS not supported). - [Check Point FW1 VPN1](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/cortex-xsiam-data-sources/generic-on-premise-data-collectors/broker-vm-data-collector-applets/syslog-collector-applet/check-point-fw1-vpn1.md): Ingest Check Point firewall data into Cortex XSIAM. - [Ingest logs from Check Point firewalls](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/cortex-xsiam-data-sources/generic-on-premise-data-collectors/broker-vm-data-collector-applets/syslog-collector-applet/check-point-fw1-vpn1/ingest-logs-from-check-point-firewalls.md): Ingest Check Point firewall logs into Cortex XSIAM. - [Cisco ASA firewalls and AnyConnect](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/cortex-xsiam-data-sources/generic-on-premise-data-collectors/broker-vm-data-collector-applets/syslog-collector-applet/cisco-asa-firewalls-and-anyconnect.md): Ingest Cisco ASA and AnyConnect data into Cortex XSIAM. - [Ingest logs from Cisco ASA firewalls and AnyConnect](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/cortex-xsiam-data-sources/generic-on-premise-data-collectors/broker-vm-data-collector-applets/syslog-collector-applet/cisco-asa-firewalls-and-anyconnect/ingest-logs-from-cisco-asa-firewalls-and-anyconnect.md): Ingest Cisco ASA and AnyConnect logs into Cortex XSIAM. - [Corelight Zeek](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/cortex-xsiam-data-sources/generic-on-premise-data-collectors/broker-vm-data-collector-applets/syslog-collector-applet/corelight-zeek.md): Ingest Corelight Zeek data into Cortex XSIAM. - [Ingest logs from Corelight Zeek](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/cortex-xsiam-data-sources/generic-on-premise-data-collectors/broker-vm-data-collector-applets/syslog-collector-applet/corelight-zeek/ingest-logs-from-corelight-zeek.md): Ingest Corelight Zeek logs into Cortex XSIAM. - [Forcepoint DLP](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/cortex-xsiam-data-sources/generic-on-premise-data-collectors/broker-vm-data-collector-applets/syslog-collector-applet/forcepoint-dlp.md): Ingest Forcepoint DLP data into Cortex XSIAM. - [Ingest logs from Forcepoint DLP](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/cortex-xsiam-data-sources/generic-on-premise-data-collectors/broker-vm-data-collector-applets/syslog-collector-applet/forcepoint-dlp/ingest-logs-from-forcepoint-dlp.md): Ingest Forcepoint DLP logs into Cortex XSIAM. - [Fortinet Fortigate](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/cortex-xsiam-data-sources/generic-on-premise-data-collectors/broker-vm-data-collector-applets/syslog-collector-applet/fortinet-fortigate.md): Ingest Fortinet FortiGate data into Cortex XSIAM. - [Ingest logs from Fortinet Fortigate firewalls](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/cortex-xsiam-data-sources/generic-on-premise-data-collectors/broker-vm-data-collector-applets/syslog-collector-applet/fortinet-fortigate/ingest-logs-from-fortinet-fortigate-firewalls.md): Ingest Fortinet FortiGate logs into Cortex XSIAM. - [Next Generation Firewall](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/cortex-xsiam-data-sources/generic-on-premise-data-collectors/broker-vm-data-collector-applets/syslog-collector-applet/next-generation-firewall.md): Ingest next-generation firewall data into Cortex XSIAM. - [Ingest Next-Generation Firewall logs using the Syslog Collector](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/cortex-xsiam-data-sources/generic-on-premise-data-collectors/broker-vm-data-collector-applets/syslog-collector-applet/next-generation-firewall/ingest-next-generation-firewall-logs-using-the-syslog-collector.md): Ingest firewall logs through Syslog Collector into Cortex XSIAM. - [PingFederate](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/cortex-xsiam-data-sources/generic-on-premise-data-collectors/broker-vm-data-collector-applets/syslog-collector-applet/pingfederate.md): Ingest PingFederate data into Cortex XSIAM. - [Ingest authentication logs from PingFederate](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/cortex-xsiam-data-sources/generic-on-premise-data-collectors/broker-vm-data-collector-applets/syslog-collector-applet/pingfederate/ingest-authentication-logs-from-pingfederate.md): Ingest PingFederate authentication logs into Cortex XSIAM. - [Zscaler Internet Access](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/cortex-xsiam-data-sources/generic-on-premise-data-collectors/broker-vm-data-collector-applets/syslog-collector-applet/zscaler-internet-access.md): Ingest Zscaler Internet Access data into Cortex XSIAM. - [Ingest logs from Zscaler Internet Access](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/cortex-xsiam-data-sources/generic-on-premise-data-collectors/broker-vm-data-collector-applets/syslog-collector-applet/zscaler-internet-access/ingest-logs-from-zscaler-internet-access.md): Ingest Zscaler Internet Access logs into Cortex XSIAM. - [Zscaler Private Access](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/cortex-xsiam-data-sources/generic-on-premise-data-collectors/broker-vm-data-collector-applets/syslog-collector-applet/zscaler-private-access.md): Ingest Zscaler Private Access data into Cortex XSIAM. - [Ingest logs from Zscaler Private Access](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/cortex-xsiam-data-sources/generic-on-premise-data-collectors/broker-vm-data-collector-applets/syslog-collector-applet/zscaler-private-access/ingest-logs-from-zscaler-private-access.md): Ingest Zscaler Private Access logs into Cortex XSIAM. - [Activate Transporter](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/cortex-xsiam-data-sources/generic-on-premise-data-collectors/broker-vm-data-collector-applets/activate-transporter.md): Configure Transporter applet for Cortex XSIAM. - [Activate Windows Event Collector](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/cortex-xsiam-data-sources/generic-on-premise-data-collectors/broker-vm-data-collector-applets/activate-windows-event-collector.md): Configure Windows Event Collector for Cortex XSIAM. - [Activate Windows Event Collector on Windows Core](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/cortex-xsiam-data-sources/generic-on-premise-data-collectors/broker-vm-data-collector-applets/activate-windows-event-collector/activate-windows-event-collector-on-windows-core.md): Configure Windows Core event collection for Cortex XSIAM. - [Renew WEC certificates](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/cortex-xsiam-data-sources/generic-on-premise-data-collectors/broker-vm-data-collector-applets/activate-windows-event-collector/renew-wec-certificates.md): Renew Windows Event Collector certificates for Cortex XSIAM. - [XDR Collectors](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/cortex-xsiam-data-sources/generic-on-premise-data-collectors/xdr-collectors.md): Use XDR Collectors to collect data for Cortex XSIAM. - [XDR Collector audit logs](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/cortex-xsiam-data-sources/generic-on-premise-data-collectors/xdr-collectors/xdr-collector-audit-logs.md): Review XDR Collector audit logs in Cortex XSIAM. - [XDR Collector machine requirements and supported operating systems](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/cortex-xsiam-data-sources/generic-on-premise-data-collectors/xdr-collectors/xdr-collector-machine-requirements-and-supported-operating-systems.md): Review XDR Collector requirements for Cortex XSIAM. - [Resources required to enable access to XDR collectors](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/cortex-xsiam-data-sources/generic-on-premise-data-collectors/xdr-collectors/resources-required-to-enable-access-to-xdr-collectors.md): Review required collector access resources for Cortex XSIAM. - [Manage XDR Collectors](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/cortex-xsiam-data-sources/generic-on-premise-data-collectors/xdr-collectors/manage-xdr-collectors.md): Manage XDR Collectors in Cortex XSIAM. - [XDR Collectors installation resource for Windows and Linux](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/cortex-xsiam-data-sources/generic-on-premise-data-collectors/xdr-collectors/manage-xdr-collectors/xdr-collectors-installation-resource-for-windows-and-linux.md): Install XDR Collectors for Cortex XSIAM. - [Create an XDR Collector installation package](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/cortex-xsiam-data-sources/generic-on-premise-data-collectors/xdr-collectors/manage-xdr-collectors/create-an-xdr-collector-installation-package.md): Create an XDR Collector package for Cortex XSIAM. - [Install the XDR Collector installation package for Windows](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/cortex-xsiam-data-sources/generic-on-premise-data-collectors/xdr-collectors/manage-xdr-collectors/install-the-xdr-collector-installation-package-for-windows.md): Install an XDR Collector on Windows for Cortex XSIAM. - [Install the XDR collector on Windows using the MSI](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/cortex-xsiam-data-sources/generic-on-premise-data-collectors/xdr-collectors/manage-xdr-collectors/install-the-xdr-collector-installation-package-for-windows/install-the-xdr-collector-on-windows-using-the-msi.md): Install an XDR Collector MSI for Cortex XSIAM. - [Install the XDR Collector on Windows using Msiexec](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/cortex-xsiam-data-sources/generic-on-premise-data-collectors/xdr-collectors/manage-xdr-collectors/install-the-xdr-collector-installation-package-for-windows/install-the-xdr-collector-on-windows-using-msiexec.md): Install an XDR Collector with Msiexec for Cortex XSIAM. - [Install the XDR Collector installation package for Linux](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/cortex-xsiam-data-sources/generic-on-premise-data-collectors/xdr-collectors/manage-xdr-collectors/install-the-xdr-collector-installation-package-for-linux.md): Install an XDR Collector on Linux for Cortex XSIAM. - [Configure XDR Collector upgrade scheduler](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/cortex-xsiam-data-sources/generic-on-premise-data-collectors/xdr-collectors/manage-xdr-collectors/configure-xdr-collector-upgrade-scheduler.md): Schedule XDR Collector upgrades for Cortex XSIAM. - [Set an application proxy for XDR Collectors](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/cortex-xsiam-data-sources/generic-on-premise-data-collectors/xdr-collectors/manage-xdr-collectors/set-an-application-proxy-for-xdr-collectors.md): Configure an XDR Collector proxy for Cortex XSIAM. - [Set an alias for an XDR Collector machine](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/cortex-xsiam-data-sources/generic-on-premise-data-collectors/xdr-collectors/manage-xdr-collectors/set-an-alias-for-an-xdr-collector-machine.md): Set an XDR Collector machine alias in Cortex XSIAM. - [Upgrade XDR Collectors](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/cortex-xsiam-data-sources/generic-on-premise-data-collectors/xdr-collectors/manage-xdr-collectors/upgrade-xdr-collectors.md): Upgrade XDR Collectors for Cortex XSIAM. - [Uninstall the XDR Collector](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/cortex-xsiam-data-sources/generic-on-premise-data-collectors/xdr-collectors/manage-xdr-collectors/uninstall-the-xdr-collector.md): Uninstall an XDR Collector from Cortex XSIAM. - [Define XDR Collector machine groups](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/cortex-xsiam-data-sources/generic-on-premise-data-collectors/xdr-collectors/manage-xdr-collectors/define-xdr-collector-machine-groups.md): Define XDR Collector machine groups in Cortex XSIAM. - [About Cortex XDR Collector content updates](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/cortex-xsiam-data-sources/generic-on-premise-data-collectors/xdr-collectors/manage-xdr-collectors/about-cortex-xdr-collector-content-updates.md): Understand XDR Collector content updates for Cortex XSIAM. - [XDR Collector profiles](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/cortex-xsiam-data-sources/generic-on-premise-data-collectors/xdr-collectors/xdr-collector-profiles.md): Configure XDR Collector profiles for Cortex XSIAM. - [Add an XDR Collector profile for Windows](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/cortex-xsiam-data-sources/generic-on-premise-data-collectors/xdr-collectors/xdr-collector-profiles/add-an-xdr-collector-profile-for-windows.md): Add a Windows XDR Collector profile for Cortex XSIAM. - [How to configure XDR Collector profiles](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/cortex-xsiam-data-sources/generic-on-premise-data-collectors/xdr-collectors/xdr-collector-profiles/add-an-xdr-collector-profile-for-windows/how-to-configure-xdr-collector-profiles.md): Configure XDR Collector profiles for Cortex XSIAM. - [Additional XDR Collector profile management options](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/cortex-xsiam-data-sources/generic-on-premise-data-collectors/xdr-collectors/xdr-collector-profiles/add-an-xdr-collector-profile-for-windows/additional-xdr-collector-profile-management-options.md): Manage XDR Collector profiles in Cortex XSIAM. - [Query Windows Event Log records](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/cortex-xsiam-data-sources/generic-on-premise-data-collectors/xdr-collectors/xdr-collector-profiles/add-an-xdr-collector-profile-for-windows/query-windows-event-log-records.md): Query Windows Event Log records for Cortex XSIAM. - [Ingest logs from Windows DHCP using Elasticsearch Filebeat](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/cortex-xsiam-data-sources/generic-on-premise-data-collectors/xdr-collectors/xdr-collector-profiles/ingest-logs-from-windows-dhcp-using-elasticsearch-filebeat.md): Ingest Windows DHCP logs into Cortex XSIAM. - [Ingest Windows DNS debug logs using Elasticsearch Filebeat](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/cortex-xsiam-data-sources/generic-on-premise-data-collectors/xdr-collectors/xdr-collector-profiles/ingest-windows-dns-debug-logs-using-elasticsearch-filebeat.md): Ingest Windows DNS logs into Cortex XSIAM. - [Add an XDR Collector profile for Linux](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/cortex-xsiam-data-sources/generic-on-premise-data-collectors/xdr-collectors/xdr-collector-profiles/add-an-xdr-collector-profile-for-linux.md): Add a Linux XDR Collector profile for Cortex XSIAM. - [Apply profiles to collection machine policies](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/cortex-xsiam-data-sources/generic-on-premise-data-collectors/xdr-collectors/apply-profiles-to-collection-machine-policies.md): Apply collection profiles to Cortex XSIAM policies. - [XDR Collector datasets](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/cortex-xsiam-data-sources/generic-on-premise-data-collectors/xdr-collectors/xdr-collector-datasets.md): Review XDR Collector datasets in Cortex XSIAM. - [Palo Alto Networks integrations](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/cortex-xsiam-data-sources/palo-alto-networks-integrations.md): Configure Palo Alto Networks integrations for Cortex XSIAM. - [Cloud Next-Generation Firewall](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/cortex-xsiam-data-sources/palo-alto-networks-integrations/cloud-next-generation-firewall.md): Configure Cloud NGFW data ingestion for Cortex XSIAM. - [Ingest data from Cloud Next-Generation Firewall](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/cortex-xsiam-data-sources/palo-alto-networks-integrations/cloud-next-generation-firewall/ingest-data-from-cloud-next-generation-firewall.md) - [Next-Generation Firewall](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/cortex-xsiam-data-sources/palo-alto-networks-integrations/next-generation-firewall.md): Configure Next-Generation Firewall ingestion for Cortex XSIAM. - [Ingest data from Next-Generation Firewall](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/cortex-xsiam-data-sources/palo-alto-networks-integrations/next-generation-firewall/ingest-data-from-next-generation-firewall.md) - [Ingest Next-Generation Firewall logs using the Syslog collector](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/cortex-xsiam-data-sources/palo-alto-networks-integrations/next-generation-firewall/ingest-next-generation-firewall-logs-using-the-syslog-collector.md): Ingest firewall Syslog data into Cortex XSIAM. - [Panorama](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/cortex-xsiam-data-sources/palo-alto-networks-integrations/next-generation-firewall/panorama.md): Configure Panorama data ingestion for Cortex XSIAM. - [Prisma Access](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/cortex-xsiam-data-sources/palo-alto-networks-integrations/prisma-access.md): Configure Prisma Access data ingestion for Cortex XSIAM. - [Ingest data from Prisma Access](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/cortex-xsiam-data-sources/palo-alto-networks-integrations/prisma-access/ingest-data-from-prisma-access.md): Ingest Prisma Access data into Cortex XSIAM. - [Palo Alto Networks Prisma](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/cortex-xsiam-data-sources/palo-alto-networks-integrations/prisma-access/palo-alto-networks-prisma.md): Configure Palo Alto Networks Prisma for Cortex XSIAM. - [Prisma Access Browser](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/cortex-xsiam-data-sources/palo-alto-networks-integrations/prisma-access-browser.md): Configure Prisma Access Browser for Cortex XSIAM. - [Ingest logs from Prisma Access Browser](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/cortex-xsiam-data-sources/palo-alto-networks-integrations/prisma-access-browser/ingest-logs-from-prisma-access-browser.md): Ingest Prisma Access Browser logs into Cortex XSIAM. - [Ingest detection data from Strata Logging Service](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/cortex-xsiam-data-sources/palo-alto-networks-integrations/ingest-detection-data-from-strata-logging-service.md): Ingest Palo Alto Networks detection data from Strata Logging Service into Cortex XSIAM, migrate legacy collectors to Cortex Native Data Lake, and query logs with XQL. - [IoT Security](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/cortex-xsiam-data-sources/palo-alto-networks-integrations/iot-security.md): Configure IoT Security data ingestion for Cortex XSIAM. - [Ingest alerts and assets from IoT Security (Deprecated)](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/cortex-xsiam-data-sources/palo-alto-networks-integrations/iot-security/ingest-alerts-and-assets-from-iot-security.md): Ingest legacy IoT Security data into Cortex XSIAM. - [Ingest alerts and assets from Device Security](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/cortex-xsiam-data-sources/palo-alto-networks-integrations/iot-security/ingest-alerts-and-assets-from-device-security.md): Ingest Device Security alerts and assets into Cortex XSIAM. - [IoT Security](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/cortex-xsiam-data-sources/palo-alto-networks-integrations/iot-security/iot-security.md): Use IoT Security data with Cortex XSIAM. - [Cortex Attack Surface Management](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/cortex-xsiam-data-sources/palo-alto-networks-integrations/cortex-attack-surface-management.md): Configure Attack Surface Management data for Cortex XSIAM. - [Cortex Automation Developer Tools](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/cortex-xsiam-data-sources/palo-alto-networks-integrations/cortex-automation-developer-tools.md): Use Cortex Automation Developer Tools with Cortex XSIAM. - [Cortex Data Lake](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/cortex-xsiam-data-sources/palo-alto-networks-integrations/cortex-data-lake.md): Configure Cortex Data Lake data for Cortex XSIAM. - [Cortex Internals](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/cortex-xsiam-data-sources/palo-alto-networks-integrations/cortex-internals.md): Use Cortex Internals data with Cortex XSIAM. - [Cortex XDR](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/cortex-xsiam-data-sources/palo-alto-networks-integrations/cortex-xdr.md): Use Cortex XDR data with Cortex XSIAM. - [Enterprise DLP](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/cortex-xsiam-data-sources/palo-alto-networks-integrations/enterprise-dlp.md): Configure Enterprise DLP data for Cortex XSIAM. - [Palo Alto Networks Cortex](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/cortex-xsiam-data-sources/palo-alto-networks-integrations/palo-alto-networks-cortex.md): Configure Palo Alto Networks Cortex data for Cortex XSIAM. - [PAN PSIRT Advisories](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/cortex-xsiam-data-sources/palo-alto-networks-integrations/pan-psirt-advisories.md): Ingest PAN PSIRT advisories into Cortex XSIAM. - [Prisma Cloud Compute](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/cortex-xsiam-data-sources/palo-alto-networks-integrations/prisma-cloud-compute.md): Configure Prisma Cloud Compute data for Cortex XSIAM. - [Prisma Cloud CSPM](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/cortex-xsiam-data-sources/palo-alto-networks-integrations/prisma-cloud-cspm.md): Configure Prisma Cloud CSPM data for Cortex XSIAM. - [SaaS Security (Aperture)](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/cortex-xsiam-data-sources/palo-alto-networks-integrations/saas-security-aperture.md): Configure SaaS Security data for Cortex XSIAM. - [Threat Vault](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/cortex-xsiam-data-sources/palo-alto-networks-integrations/threat-vault.md): Use Threat Vault data with Cortex XSIAM. - [WildFire Cloud](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/cortex-xsiam-data-sources/palo-alto-networks-integrations/wildfire-cloud.md): Configure WildFire Cloud data for Cortex XSIAM. - [Log type filtering](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/cortex-xsiam-data-sources/palo-alto-networks-integrations/log-type-filtering.md) - [Collecting URL and File log types](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/cortex-xsiam-data-sources/palo-alto-networks-integrations/collecting-url-and-file-log-types.md): Configure URL and File log collection for Palo Alto Networks integrations in pre-3.x Cortex XSIAM to balance analytics visibility, correlation rules, and ingestion costs. - [Detectors connected to URL and File log types](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/cortex-xsiam-data-sources/palo-alto-networks-integrations/collecting-url-and-file-log-types/detectors-connected-to-url-and-file-log-types.md): Review Cortex XSIAM detectors affected when URL or File log collection is disabled, including impacts on cyberattack detection, investigation context, and correlation rules. - [Cloud Posture and Runtime Security data sources](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/cortex-xsiam-data-sources/cloud-posture-and-runtime-security-data-sources.md): Learn more about the Cloud Posture and Runtime Security data sources in Cortex XSIAM. - [External alerts using External Issue Mapping](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/cortex-xsiam-data-sources/external-alerts-using-external-issue-mapping.md): Learn more about collecting alerts from any external source using External Issue Mapping in Cortex XSIAM. - [Ingest external alerts](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/cortex-xsiam-data-sources/external-alerts-using-external-issue-mapping/ingest-external-alerts.md): Send external alerts to Cortex XSIAM and map source fields using External Issue Mapping. - [Administration and troubleshooting](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/cortex-xsiam-data-sources/administration-and-troubleshooting.md): Learn more about the administration and troubleshooting of the different data collector integrations in Cortex XSIAM. - [Manage instances](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/cortex-xsiam-data-sources/administration-and-troubleshooting/manage-instances.md): Manage data source and connector instances in Cortex XSIAM. - [Add a new data source or instance](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/cortex-xsiam-data-sources/administration-and-troubleshooting/manage-instances/add-a-new-data-source-or-instance.md): Add a data source or connector instance in Cortex XSIAM. - [How to configure the scanning settings for supported services](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/cortex-xsiam-data-sources/administration-and-troubleshooting/manage-instances/how-to-configure-the-scanning-settings-for-supported-services.md): Configure scanning settings for supported services in Cortex XSIAM. - [Manage cloud instances](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/cortex-xsiam-data-sources/administration-and-troubleshooting/manage-instances/manage-cloud-instances.md): Manage cloud instances connected to Cortex XSIAM. - [Update cloud permissions after Cortex release updates](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/cortex-xsiam-data-sources/administration-and-troubleshooting/manage-instances/update-cloud-permissions-after-cortex-release-updates.md): Update cloud permissions after Cortex XSIAM releases. - [Pending cloud instances](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/cortex-xsiam-data-sources/administration-and-troubleshooting/manage-instances/pending-cloud-instances.md): Review pending cloud instances in Cortex XSIAM. - [Troubleshoot errors on cloud instances](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/cortex-xsiam-data-sources/administration-and-troubleshooting/manage-instances/troubleshoot-errors-on-cloud-instances.md): Troubleshoot errors on cloud instances in Cortex XSIAM. - [Manage Kubernetes Connector instances](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/cortex-xsiam-data-sources/administration-and-troubleshooting/manage-instances/manage-kubernetes-connector-instances.md): Manage Kubernetes Connector instances in Cortex XSIAM. - [Integrations](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/cortex-xsiam-data-sources/administration-and-troubleshooting/integrations.md): Manage and configure integrations in Cortex XSIAM. - [Integration use cases](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/cortex-xsiam-data-sources/administration-and-troubleshooting/integrations/integration-use-cases.md): Explore common integration use cases in Cortex XSIAM. - [Add an integration instance](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/cortex-xsiam-data-sources/administration-and-troubleshooting/integrations/add-an-integration-instance.md): Add and configure an integration instance in Cortex XSIAM. - [Configure integration permissions](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/cortex-xsiam-data-sources/administration-and-troubleshooting/integrations/configure-integration-permissions.md): Configure permissions for integrations in Cortex XSIAM. - [Fetch issues from an integration instance](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/cortex-xsiam-data-sources/administration-and-troubleshooting/integrations/fetch-issues-from-an-integration-instance.md): Fetch issues from an integration instance in Cortex XSIAM. - [Map fields to issue types](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/cortex-xsiam-data-sources/administration-and-troubleshooting/integrations/fetch-issues-from-an-integration-instance/map-fields-to-issue-types.md): Map integration fields to issue types in Cortex XSIAM. - [Classify events using a classifier for issue types](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/cortex-xsiam-data-sources/administration-and-troubleshooting/integrations/fetch-issues-from-an-integration-instance/classify-events-using-a-classifier-for-issue-types.md): Classify integration events for issue types in Cortex XSIAM. - [Manage credentials](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/cortex-xsiam-data-sources/administration-and-troubleshooting/integrations/manage-credentials.md): Manage integration credentials securely in Cortex XSIAM. - [Troubleshoot Integrations](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/cortex-xsiam-data-sources/administration-and-troubleshooting/integrations/troubleshoot-integrations.md): Troubleshoot integration issues in Cortex XSIAM. - [Forward Requests to Long-Running Integrations](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/cortex-xsiam-data-sources/administration-and-troubleshooting/integrations/forward-requests-to-long-running-integrations.md): Forward requests to long-running integrations in Cortex XSIAM. - [Verify collector connectivity](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/cortex-xsiam-data-sources/administration-and-troubleshooting/verify-collector-connectivity.md): Check collector connection status, investigate errors, and track connectivity changes in Cortex XSIAM. - [Overview of data ingestion metrics](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/cortex-xsiam-data-sources/administration-and-troubleshooting/overview-of-data-ingestion-metrics.md): Learn how Cortex XSIAM calculates and uses metrics to monitor data ingestion health. - [Creating correlation rules to monitor data ingestion health](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/cortex-xsiam-data-sources/administration-and-troubleshooting/overview-of-data-ingestion-metrics/creating-correlation-rules-to-monitor-data-ingestion-health.md): Create correlation rules in Cortex XSIAM that detect data ingestion disruptions and trigger health issues. - [Measuring data freshness](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/cortex-xsiam-data-sources/administration-and-troubleshooting/overview-of-data-ingestion-metrics/measuring-data-freshness.md): Understand how Cortex XSIAM measures and reports delays between log creation and ingestion. - [Health issues in Cortex XSIAM](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/cortex-xsiam-data-sources/administration-and-troubleshooting/about-health-issues.md): Understand Cortex XSIAM health issues, their types, and how to view and investigate them. - [Investigate and resolve health issues](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/cortex-xsiam-data-sources/administration-and-troubleshooting/about-health-issues/investigate-and-resolve-health-issues.md): Investigate and resolve ingestion, collection, correlation, and automation health issues in Cortex XSIAM. - [Monitor data ingestion health (BETA)](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/cortex-xsiam-data-sources/administration-and-troubleshooting/about-health-issues/monitor-data-ingestion-health.md): Monitor data ingestion health using metrics, custom rules, and built-in issue detection in Cortex XSIAM - [Monitor Correlation rules](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/cortex-xsiam-data-sources/administration-and-troubleshooting/about-health-issues/monitor-correlation-rules.md): Monitor correlation rule executions, audit status, errors, and related health issues in Cortex XSIAM - [Marketplace](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/marketplace.md): Explore Cortex XSIAM Marketplace to discover, install, and manage content packs. - [Cortex Marketplace](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/marketplace/cortex-marketplace.md): Search Cortex XSIAM Marketplace content by use case, integration, and category. - [Content packs](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/marketplace/content-packs.md): Discover Cortex XSIAM Marketplace content packs for your security workflows. - [Content Pack Support Types](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/marketplace/content-pack-support-types.md): Understand Cortex XSIAM Marketplace content pack support types and ownership. - [Manage content packs](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/marketplace/manage-content-packs.md): Install, update, revert, and delete Cortex XSIAM Marketplace content packs. - [Marketplace FAQs](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/marketplace/marketplace-faqs.md): Find answers to common Cortex XSIAM Marketplace questions. - [Content changes when upgrading Cortex XSIAM versions](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/marketplace/content-changes-when-upgrading-cortex-xsiam-versions.md): Understand Cortex XSIAM Marketplace content changes during Cortex XSIAM upgrades. - [Content pack contributions](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/marketplace/content-pack-contributions.md): Create and submit content packs for Cortex XSIAM Marketplace. - [Configure the Cortex Agentic Assistant](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/configure-the-cortex-agentic-assistant-1.md): Configure the Cortex XSIAM Agentic Assistant for AI-powered SOC investigations, response, agents, actions, knowledge sources, and access. - [Agentic Assistant components and concepts](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/configure-the-cortex-agentic-assistant-1/agentic-assistant-components-and-concepts.md): Understand Cortex XSIAM Agentic Assistant components, including agents, actions, and their relationships. - [Agentic Assistant Hub](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/configure-the-cortex-agentic-assistant-1/agents-hub.md): Manage personal and system agents in the Cortex XSIAM Agentic Assistant Hub. - [Manage actions](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/configure-the-cortex-agentic-assistant-1/agents-hub/manage-actions.md): Manage actions that extend Cortex XSIAM Agentic Assistant capabilities. - [Register actions](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/configure-the-cortex-agentic-assistant-1/agents-hub/register-actions.md): Register actions for use with Cortex XSIAM Agentic Assistant agents. - [Manage agents](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/configure-the-cortex-agentic-assistant-1/agents-hub/manage-agents.md): Manage personal and system agents in Cortex XSIAM Agentic Assistant. - [Build agents](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/configure-the-cortex-agentic-assistant-1/agents-hub/build-agents.md): Build agents that automate tasks in Cortex XSIAM Agentic Assistant. - [Manage knowledge sources (preview)](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/configure-the-cortex-agentic-assistant-1/agents-hub/manage-knowledge-sources-preview.md): Use knowledge sources to give Cortex XSIAM Agentic Assistant agents trusted business context. - [Expand agent capabilities with MCP integrations](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/configure-the-cortex-agentic-assistant-1/agents-hub/expand-agent-capabilities-with-mcp-integrations.md): Connect MCP integrations to extend Cortex XSIAM Agentic Assistant agent capabilities. - [Agentic Assistant role-based access control](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/configure-the-cortex-agentic-assistant-1/agentic-assistant-role-based-access-control.md): Configure Cortex XSIAM role-based access for Agentic Assistant features. - [Cortex MCP server](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/cortex-mcp-server.md): The Cortex MCP server enables you to leverage Cortex XSIAM's powerful capabilities directly through natural language. - [Install the Cortex MCP server](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/cortex-mcp-server/install-the-cortex-mcp-server.md): Install and configure the Cortex MCP Server with Docker or Poetry to investigate and manage Cortex XSIAM cases from an MCP client. - [Configure the MCP client](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/cortex-mcp-server/configure-the-mcp-client.md): Configure a local MCP client to connect to the Cortex XSIAM MCP Server using Docker or a Poetry virtual environment. - [Use the Cortex MCP server](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/cortex-mcp-server/use-the-cortex-mcp-server.md): Use Cortex XSIAM MCP Server tools to investigate assets, cases, issues, and endpoints, and create custom tools for security workflows. - [Create custom Cortex MCP server tools](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/cortex-mcp-server/create-custom-cortex-mcp-server-tools.md): Create custom Cortex MCP Server tools with OpenAPI or Python to extend Cortex XSIAM investigations, case management, and issue workflows. - [Automations](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/automations.md): Automate Cortex XSIAM investigation, response, and operational workflows with rules, playbooks, scripts, and jobs. - [Automation in Cortex XSIAM](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/automations/automation-in-cortex-xsiam.md): Automate Cortex XSIAM issue response with playbooks and Quick Actions, triggered by rules or manually. - [Quick Actions](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/automations/quick-actions.md): Run Cortex XSIAM response actions quickly from issues, cases, and investigations. - [Automation Exclusion Center](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/automations/automation-exclusion-center.md): Protect critical Cortex XSIAM assets from automated remediation using exclusion policies. - [Manage automation exclusion policies](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/automations/automation-exclusion-center/manage-automation-exclusion-policies.md): Create and manage Cortex XSIAM policies that exclude critical assets from automated remediation. - [Playbooks](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/automations/playbooks.md): Build and manage Cortex XSIAM playbooks for automated investigation and response workflows. - [Playbooks overview](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/automations/playbooks/playbooks-overview.md): Learn how Cortex XSIAM playbooks automate investigation, response, and operational workflows. - [Access to playbooks](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/automations/playbooks/access-to-playbooks.md): Control access to Cortex XSIAM playbooks using roles and permissions. - [Playbook development checklist](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/automations/playbooks/playbook-development-checklist.md): Use this checklist to plan, build, test, and deploy Cortex XSIAM playbooks. - [Plan your playbook](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/automations/playbooks/plan-your-playbook.md): Plan Cortex XSIAM playbooks that automate your investigation and response workflows. - [Manage playbooks](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/automations/playbooks/manage-playbooks.md): Create, organize, enable, and maintain Cortex XSIAM playbooks. - [Build your playbook](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/automations/playbooks/build-your-playbook.md): Build Cortex XSIAM playbooks by configuring tasks, logic, and automation settings. - [Choose from existing playbooks or create your own](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/automations/playbooks/build-your-playbook/choose-from-existing-playbooks-or-create-your-own.md): Reuse existing Cortex XSIAM playbooks or create playbooks for new workflows. - [Configure playbook settings](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/automations/playbooks/build-your-playbook/configure-playbook-settings.md): Configure Cortex XSIAM playbook names, permissions, inputs, and output settings. - [Add objects from the Task Library](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/automations/playbooks/build-your-playbook/add-objects-from-the-task-library.md): Add tasks and automation objects from the playbook Task Library in Cortex XSIAM. - [Add commands and scripts](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/automations/playbooks/build-your-playbook/add-objects-from-the-task-library/add-commands-and-scripts.md): Add commands and scripts as playbooks tasks in Cortex XSIAM. - [Add sub-playbooks](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/automations/playbooks/build-your-playbook/add-objects-from-the-task-library/add-sub-playbooks.md): Add sub-playbooks to reuse workflow logic and tasks in Cortex XSIAM. - [Add AI Prompt tasks](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/automations/playbooks/build-your-playbook/add-objects-from-the-task-library/add-ai-prompt-tasks.md): Add AI Prompt tasks to Cortex XSIAM playbooks for AI-assisted automation. - [Add manual tasks and blank tasks](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/automations/playbooks/build-your-playbook/add-objects-from-the-task-library/add-manual-tasks-and-blank-tasks.md): Add manual and blank tasks to Cortex XSIAM playbooks. - [Create a standard task](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/automations/playbooks/build-your-playbook/add-objects-from-the-task-library/add-manual-tasks-and-blank-tasks/create-a-standard-task.md): Create standard tasks in Cortex XSIAM playbooks to run automation steps. - [Create a conditional task](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/automations/playbooks/build-your-playbook/add-objects-from-the-task-library/add-manual-tasks-and-blank-tasks/create-a-conditional-task.md): Create conditional tasks in Cortex XSIAM playbooks to branch workflows. - [Create a communication task](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/automations/playbooks/build-your-playbook/add-objects-from-the-task-library/add-manual-tasks-and-blank-tasks/create-a-communication-task.md): Create communication tasks in Cortex XSIAM playbooks for notifications and collaboration. - [Create a section header](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/automations/playbooks/build-your-playbook/add-objects-from-the-task-library/create-a-section-header.md): Add section headers to organize tasks in Cortex XSIAM playbooks. - [Configure script error handling in a playbook](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/automations/playbooks/build-your-playbook/add-objects-from-the-task-library/configure-script-error-handling-in-a-playbook.md): Configure script error handling in Cortex XSIAM playbooks to manage task failures. - [Customize your playbook](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/automations/playbooks/build-your-playbook/customize-your-playbook.md): Customize Cortex XSIAM playbooks with data handling, loops, filters, and transformers. - [Configure a sub-playbook loop](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/automations/playbooks/build-your-playbook/customize-your-playbook/configure-a-sub-playbook-loop.md): Configure Cortex XSIAM sub-playbook loops to repeat workflow tasks. - [Filter and transform Cortex XSIAM playbook data](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/automations/playbooks/build-your-playbook/customize-your-playbook/filter-and-transform-data.md): Filter and transform Cortex XSIAM playbook data, JSON context, and task mappings for downstream automation tasks. - [Create custom filters and transformers](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/automations/playbooks/build-your-playbook/customize-your-playbook/create-custom-filter-and-transformers.md): Create custom Cortex XSIAM filters and transformers for playbook data. - [Filter considerations, categories, and built-in filters](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/automations/playbooks/build-your-playbook/customize-your-playbook/filter-considerations-categories-and-built-in-filters.md): Understand Cortex XSIAM playbook filter options, categories, and built-in filters. - [Transformer considerations, categories, and built-in transformers](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/automations/playbooks/build-your-playbook/customize-your-playbook/transformer-considerations-categories-and-built-in-transformers.md): Understand Cortex XSIAM playbook transformer options, categories, and built-in transformers. - [Extend context in playbooks](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/automations/playbooks/build-your-playbook/customize-your-playbook/extend-context.md): Extend Cortex XSIAM playbook context with integration command responses, task data, and custom context keys. - [Extract indicators in playbooks](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/automations/playbooks/build-your-playbook/customize-your-playbook/extract-indicators.md): Extract and enrich threat indicators from Cortex XSIAM issue fields and playbook task outputs. - [Update issue fields with playbook tasks](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/automations/playbooks/build-your-playbook/customize-your-playbook/update-issue-fields-with-playbook-tasks.md): Update Cortex XSIAM issue fields with playbook task results. - [Test your playbook](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/automations/playbooks/build-your-playbook/test-your-playbook.md): Test Cortex XSIAM playbooks using breakpoints, skips, and input or output overrides. - [Troubleshoot playbook performance](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/automations/playbooks/build-your-playbook/test-your-playbook/troubleshoot-playbook-performance.md): Troubleshoot Cortex XSIAM playbook performance, identify slow workflow tasks, and analyze execution data with XQL. - [Manage playbook content](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/automations/playbooks/build-your-playbook/manage-playbook-content.md): Manage Cortex XSIAM playbook content, including versions, tasks, and dependencies. - [Accelerate playbook development using the Agentic Playbook Builder (preview)](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/automations/playbooks/accelerate-playbook-development-using-the-agentic-playbook-builder-private-preview.md): Use the Agentic Playbook Builder (preview) in Cortex XSIAM to create, optimize, and troubleshoot playbooks using natural language and security best practices. - [Agentic Playbook Builder prompt examples](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/automations/playbooks/accelerate-playbook-development-using-the-agentic-playbook-builder-private-preview/agentic-playbook-builder-prompt-examples.md): Use Agentic Playbook Builder prompt examples to generate Cortex XSIAM security response playbooks for triage, enrichment, and remediation. - [Best practices for playbooks](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/automations/playbooks/best-practices-for-playbooks.md): Follow Cortex XSIAM playbook best practices for reliable, maintainable automation. - [Autonomous playbooks](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/automations/autonomous-playbooks.md): Use Cortex XSIAM autonomous playbooks for managed security automation and response. - [Enable autonomous playbooks](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/automations/autonomous-playbooks/enable-autonomous-playbooks.md): Enable Cortex XSIAM autonomous playbooks to automate supported response workflows. - [Manage autonomous playbooks](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/automations/autonomous-playbooks/manage-autonomous-playbooks.md): Manage Cortex XSIAM autonomous playbooks and their automation settings. - [Manage autonomous automation rules](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/automations/autonomous-playbooks/manage-autonomous-automation-rules.md): Manage Cortex XSIAM automation rules that trigger autonomous playbooks. - [Work Plan for autonomous playbooks](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/automations/autonomous-playbooks/work-plan-for-autonomous-playbooks.md): Review Cortex XSIAM Work Plans for autonomous playbook execution and progress. - [AI Prompts](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/automations/ai-prompts.md): Create and manage Cortex XSIAM AI prompts for agents and playbook tasks. - [AI prompts role-based access control](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/automations/ai-prompts/ai-prompts-role-based-access-control.md): Manage Cortex XSIAM AI prompt permissions using role-based access control. - [Use existing prompts](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/automations/ai-prompts/use-existing-prompts.md): Find, duplicate, and edit existing Cortex XSIAM AI prompts. - [Create a prompt](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/automations/ai-prompts/create-a-prompt.md): Create AI prompts for agents, playbooks, and automation workflows in Cortex XSIAM. - [Write effective prompts](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/automations/ai-prompts/write-effective-prompts.md): Learn how to write effective AI prompts for reliable Cortex XSIAM playbook automation. - [Agentic Response (Preview)](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/automations/agentic-response-preview.md): Use Agentic Response in Cortex XSIAM to trigger AI agents from automation rules. - [Create an automation rule](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/automations/create-an-automation-rule.md): Create automation rules in Cortex XSIAM that trigger actions when issue conditions are met. - [Scripts](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/automations/scripts.md): Create and manage Cortex XSIAM scripts for automation and response workflows. - [Access to scripts](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/automations/scripts/access-to-scripts.md): Control access to Cortex XSIAM scripts using roles and permissions. - [Use existing scripts](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/automations/scripts/use-existing-scripts.md): Find, review, and reuse existing Cortex XSIAM automation scripts. - [Create a script](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/automations/scripts/create-a-script.md): Create Cortex XSIAM scripts for custom automation and response tasks. - [Accelerate script development using the Automation Engineer agent](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/automations/scripts/accelerate-script-development-using-the-automation-engineer-agent.md): Use the Cortex XSIAM Automation Engineer agent to accelerate script development. - [Change the Docker image in an integration or script](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/automations/scripts/change-the-docker-image-in-an-integration-or-script.md): Change Docker images used by Cortex XSIAM integrations and scripts. - [Context data](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/automations/context-data.md): Use Cortex XSIAM context data to support investigation and remediation workflows. - [Issue context data](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/automations/context-data/issue-context-data.md): View and use Cortex XSIAM context data stored for an issue. - [Case context data](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/automations/context-data/case-context-data.md): View and use Cortex XSIAM context data stored for a case. - [Search context data](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/automations/context-data/search-context-data.md): Search Cortex XSIAM context data and expand stored values. - [Add context data to an issue](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/automations/context-data/add-context-data-to-an-issue.md): Add keys and values to Cortex XSIAM issue context data. - [Add context data to a case](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/automations/context-data/add-context-data-to-a-case.md): Add keys and values to Cortex XSIAM case context data. - [Delete context data from a case](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/automations/context-data/delete-context-data-from-a-case.md): Delete all or selected Cortex XSIAM context data from a case. - [Use context data in a playbook](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/automations/context-data/use-context-data-in-a-playbook.md): Use Cortex XSIAM context data in playbooks for dynamic workflow execution. - [Lists](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/automations/lists.md): Use Cortex XSIAM lists to store data for playbooks and scripts. - [Create a list](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/automations/lists/create-a-list.md): Create Cortex XSIAM lists to store reusable automation data. - [List commands](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/automations/lists/list-commands.md): Use Cortex XSIAM list commands in playbooks and scripts. - [Use cases: JSON lists](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/automations/lists/use-cases-json-lists.md): Use Cortex XSIAM JSON lists to extract, filter, and transform data. - [Extract data from a JSON object](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/automations/lists/use-cases-json-lists/extract-data-from-a-json-object.md): Extract data from a JSON object stored in a Cortex XSIAM list. - [Extract a subset of the data](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/automations/lists/use-cases-json-lists/extract-a-subset-of-the-data.md): Extract a subset of data from a Cortex XSIAM JSON list. - [Filter extracted data](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/automations/lists/use-cases-json-lists/filter-extracted-data.md): Filter data extracted from a Cortex XSIAM JSON list. - [Transform a list into an array](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/automations/lists/transform-a-list-into-an-array-1.md): Transform a Cortex XSIAM list into an array for automation workflows. - [Jobs](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/automations/jobs.md): Create Cortex XSIAM jobs to run playbooks on schedules or events. - [Access to Jobs](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/automations/jobs/access-to-jobs.md): Control access to Cortex XSIAM jobs using roles and permissions. - [Manage jobs](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/automations/jobs/manage-jobs.md): Create, manage, and schedule Cortex XSIAM playbook jobs. - [Create a time-triggered job](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/automations/jobs/create-a-time-triggered-job.md): Schedule a Cortex XSIAM playbook job to run at a specific time. - [Create a job triggered by a delta in a feed](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/automations/jobs/create-a-job-triggered-by-a-delta-in-a-feed.md): Trigger a playbook job when a feed changes in Cortex XSIAM. - [Engines](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/engines.md): Install, configure, manage, and troubleshoot Cortex XSIAM engines for secure integration and automation workloads. - [What is an engine?](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/engines/what-is-an-engine.md): Learn what a Cortex XSIAM engine is and how it securely runs integrations and automation. - [Engine requirements](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/engines/engine-requirements.md): Review Cortex XSIAM engine hardware, operating system, network, and required URLs. - [Install an engine](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/engines/install-an-engine.md): Install and configure a Cortex XSIAM engine for integration and automation workloads. - [Docker](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/engines/install-an-engine/docker.md): Install, configure, secure, and troubleshoot Docker for Cortex XSIAM engines. - [Install Docker](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/engines/install-an-engine/docker/install-docker.md): Install Docker and verify required user permissions for Cortex XSIAM engines. - [Install Docker distribution for Red Hat](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/engines/install-an-engine/docker/install-docker-distribution-for-red-hat.md): Install Docker and configure SELinux on Red Hat servers for Cortex XSIAM engines. - [Docker image security](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/engines/install-an-engine/docker/docker-image-security.md): Secure and harden Docker images and containers used by Cortex XSIAM engines. - [Docker FAQs](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/engines/install-an-engine/docker/docker-faqs.md): Find answers to common Docker installation, configuration, and operation questions for Cortex XSIAM engines. - [Troubleshoot Docker Issues](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/engines/install-an-engine/docker/troubleshoot-docker-issues.md): Troubleshoot Docker installation, container, and runtime issues on Cortex XSIAM engines. - [Configure Docker pull rate limit](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/engines/install-an-engine/docker/configure-docker-pull-rate-limit.md): Configure Docker image pull rate limits for reliable Cortex XSIAM engine deployments. - [Change the Docker Installation folder](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/engines/install-an-engine/docker/change-the-docker-installation-folder.md): Change the Docker installation folder on hosts running Cortex XSIAM engines. - [Docker hardening guide](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/engines/install-an-engine/docker/docker-hardening-guide.md): Harden Docker hosts and containers to secure Cortex XSIAM engine deployments. - [Docker network hardening](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/engines/install-an-engine/docker/docker-hardening-guide/docker-network-hardening.md): Configure Docker network hardening for secure Cortex XSIAM engine communication. - [Configure Docker images](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/engines/install-an-engine/docker/docker-hardening-guide/configure-docker-images.md): Configure Docker images securely for Cortex XSIAM engine deployments. - [Run Docker with non-root internal users](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/engines/install-an-engine/docker/docker-hardening-guide/run-docker-with-non-root-internal-users.md): Run Docker with non-root internal users to strengthen Cortex XSIAM engine security. - [Configure the memory limit support without swap capabilities](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/engines/install-an-engine/docker/docker-hardening-guide/configure-the-memory-limit-support-without-swap-capabilities.md): Configure Docker memory limits without swap support for Cortex XSIAM engines. - [Configure the memory limitation](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/engines/install-an-engine/docker/docker-hardening-guide/configure-the-memory-limitation.md): Configure Docker memory limits to manage resources for Cortex XSIAM engines. - [Configure the CPU, PIDs, and open the file descriptors limit](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/engines/install-an-engine/docker/docker-hardening-guide/configure-the-cpu-pids-and-open-the-file-descriptors-limit.md): Configure Docker CPU, PID, and file descriptor limits for Cortex XSIAM engines. - [Check Docker hardening configurations](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/engines/install-an-engine/docker/docker-hardening-guide/check-docker-hardening-configurations.md): Verify Docker hardening settings for secure Cortex XSIAM engine deployments. - [Podman](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/engines/install-an-engine/podman.md): Install, configure, and troubleshoot Podman for Cortex XSIAM engines. - [Change the Container storage](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/engines/install-an-engine/podman/change-the-container-storage.md): Configure Podman container storage for Cortex XSIAM engines. - [Install Podman](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/engines/install-an-engine/podman/install-podman.md): Install and configure Podman for Cortex XSIAM engines. - [Migrate from Docker to Podman](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/engines/install-an-engine/podman/migrate-from-docker-to-podman.md): Migrate a Cortex XSIAM engine from Docker to Podman. - [Troubleshoot Podman](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/engines/install-an-engine/podman/troubleshoot-podman.md): Troubleshoot common Podman installation and runtime issues on Cortex XSIAM engines. - [Manage engines](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/engines/manage-engines.md): Manage Cortex XSIAM engines and load-balancing groups for integrations and automation. - [Upgrade an engine](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/engines/upgrade-an-engine.md): Upgrade a Cortex XSIAM engine from the console or its remote host. - [Remove an engine](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/engines/remove-an-engine.md): Remove a Cortex XSIAM engine safely from its host and tenant configuration. - [Configure engines](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/engines/configure-engines.md): Configure Cortex XSIAM engines using the UI or the d1.conf configuration file. - [Configure the engine to use a web proxy](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/engines/configure-engines/configure-the-engine-to-use-a-web-proxy.md): Configure a Cortex XSIAM engine to connect through a web proxy. - [Configure the engine to call the server without using a proxy](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/engines/configure-engines/configure-the-engine-to-call-the-server-without-using-a-proxy.md): Configure a Cortex XSIAM engine to connect directly without a proxy. - [Use NGINX as a reverse proxy](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/engines/configure-engines/use-nginx-as-a-reverse-proxy.md): Use NGINX as a reverse proxy for secure Cortex XSIAM engine communication. - [Configure an engine to use custom certificates](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/engines/configure-engines/configure-an-engine-to-use-custom-certificates.md): Configure custom certificates for secure Cortex XSIAM engine communication. - [Use an engine in an integration](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/engines/use-an-engine-in-an-integration.md): Use Cortex XSIAM engines and load-balancing groups to run integration commands and fetch issues. - [Run a script using an engine](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/engines/run-a-script-using-an-engine.md): Run Cortex XSIAM automation scripts on an engine or load-balancing group. - [Troubleshoot engines](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/engines/troubleshoot-engines.md): Troubleshoot Cortex XSIAM engine issues by reviewing logs, errors, and connectivity. - [Troubleshoot integrations running on engines](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/engines/troubleshoot-integrations-running-on-engines.md): Troubleshoot integrations that run on Cortex XSIAM engines. - [Remote repository management](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/remote-repository-management.md): In Cortex XSIAM, develop and test content in a remote repository before publishing it to production. - [Cortex XSIAM development tenant](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/remote-repository-management/cortex-xsiam-development-tenant.md): Learn how to use a Cortex XSIAM development tenant and remote repository to test, manage, and deploy content across environments. - [Set up a remote repository](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/remote-repository-management/set-up-a-remote-repository.md): Set up a Cortex XSIAM remote repository for Git-based content management, version control, and synchronization across development and production tenants. - [Set up a built-in remote repository](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/remote-repository-management/set-up-a-remote-repository/set-up-a-built-in-remote-repository.md): Set up the Cortex XSIAM built-in remote repository to synchronize content between production and development tenants. - [Set up a Private Remote Repository](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/remote-repository-management/set-up-a-remote-repository/set-up-a-private-remote-repository.md): Set up a private Git remote repository in Cortex XSIAM to synchronize content between development and production tenants. - [Push and pull content](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/remote-repository-management/push-and-pull-content.md): Push and pull Cortex XSIAM content through a remote repository to synchronize playbooks, scripts, and integrations between development and production tenants. - [Remote repository troubleshooting](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/remote-repository-management/remote-repository-troubleshooting.md): Troubleshoot Cortex XSIAM remote repository issues, including non-empty branches and switching between built-in and private repositories. - [Customize cases and issues](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/customize-cases-and-issues.md): Customize Cortex XSIAM cases and issues with configuration options for scoring, integrations, layouts, and investigation workflows. - [External integrations](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/customize-cases-and-issues/external-integrations.md): Integrate external threat intelligence and case management services with Cortex XSIAM. - [Set up case scoring](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/customize-cases-and-issues/set-up-case-scoring.md): Configure Cortex XSIAM case scoring with SmartScore and user-defined scoring rules for cases and issues. - [Create a starring configuration](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/customize-cases-and-issues/create-a-starring-configuration.md): Create Cortex XSIAM starring rules to automatically prioritize matching issues and their linked cases. - [Create custom case statuses and resolution reasons](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/customize-cases-and-issues/create-custom-case-statuses-and-resolution-reasons.md): Learn how to create custom case and issue statuses and resolution reasons in Cortex XSIAM. - [Create a sync profile](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/customize-cases-and-issues/create-a-sync-profile.md): Create Cortex XSIAM sync profiles to map issue fields and synchronize data with Jira, ServiceNow, and other external applications. - [Create a case domain](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/customize-cases-and-issues/create-a-case-domain.md): Create custom Cortex XSIAM case domains to organize case workflows, statuses, resolution reasons, and access control. - [Customize case fields and layouts](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/customize-cases-and-issues/customize-case-fields-and-layouts.md): Create custom Cortex XSIAM case fields and layouts, then use layout rules to apply them to cases. - [Case fields](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/customize-cases-and-issues/customize-case-fields-and-layouts/case-fields.md): Manage system, content pack, and custom case fields in Cortex XSIAM. View, import, export, and maintain case field configurations. - [Case field types](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/customize-cases-and-issues/customize-case-fields-and-layouts/case-fields/case-field-types.md): Explore Cortex XSIAM case field types and select the right format for case data, investigation workflows, and reporting. - [Create custom case fields](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/customize-cases-and-issues/customize-case-fields-and-layouts/case-fields/create-custom-case-fields.md): Create custom case fields in Cortex XSIAM to capture investigation details, standardize case data, and support SOC workflows. - [Create a grid field for a case](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/customize-cases-and-issues/customize-case-fields-and-layouts/case-fields/create-a-grid-field-for-a-case.md): Create a grid case field in Cortex XSIAM to capture and organize structured, tabular investigation data. - [Update case fields](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/customize-cases-and-issues/customize-case-fields-and-layouts/case-fields/update-case-fields.md): Update Cortex XSIAM case fields with CLI commands, scripts, and playbooks to automate case data and investigation workflows. - [Case layouts](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/customize-cases-and-issues/customize-case-fields-and-layouts/case-layouts.md): Learn how Cortex XSIAM default and custom case layouts control tabs and case information display. - [Create custom layouts](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/customize-cases-and-issues/customize-case-fields-and-layouts/case-layouts/create-custom-layouts.md): Create custom Cortex XSIAM case layouts with case fields, tabs, sections, and action buttons for different case types. - [Create rules for case layouts](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/customize-cases-and-issues/customize-case-fields-and-layouts/case-layouts/create-rules-for-case-layouts.md): Create Cortex XSIAM case layout rules to apply custom layouts based on case severity, source, and other criteria. - [Customize issue fields and layouts](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/customize-cases-and-issues/customize-issue-fields-and-layouts.md): Create custom Cortex XSIAM issue fields and layouts, then use layout rules to display them for matching issues. - [Manage Cortex XSIAM issue fields](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/customize-cases-and-issues/customize-issue-fields-and-layouts/issue-fields.md): Manage Cortex XSIAM system and custom issue fields for mapping, correlation rules, issue layouts, and investigations. - [Issue field types](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/customize-cases-and-issues/customize-issue-fields-and-layouts/issue-fields/issue-field-types.md): Explore Cortex XSIAM custom issue field types, including text, selection, date, grid, HTML, Markdown, timer, and URL fields. - [Create custom issue fields](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/customize-cases-and-issues/customize-issue-fields-and-layouts/issue-fields/create-custom-issue-fields.md): Create and manage custom Cortex XSIAM issue fields for JSON mapping, XQL correlation rules, issue layouts, and automation. - [Create a grid field for an issue](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/customize-cases-and-issues/customize-issue-fields-and-layouts/issue-fields/create-a-grid-field-for-an-issue.md): Create interactive Cortex XSIAM grid fields for custom issue layouts with configurable tables, columns, and editable rows. - [Configure issue timer fields](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/customize-cases-and-issues/customize-issue-fields-and-layouts/issue-fields/issue-timer-fields.md): Configure Cortex XSIAM issue timer fields to track response times, SLAs, risk thresholds, and timeout automation. - [Issue field-triggered scripts](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/customize-cases-and-issues/customize-issue-fields-and-layouts/issue-fields/issue-field-triggered-scripts.md): Configure Cortex XSIAM field-change-triggered scripts to automate issue updates, validations, notifications, and workflows. - [Configure issue timer fields](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/customize-cases-and-issues/customize-issue-fields-and-layouts/issue-fields/configure-issue-timer-fields.md): Configure Cortex XSIAM issue timer fields to track targets, risk thresholds, and timeout actions with scripts. - [Configure a playbook to run timers](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/customize-cases-and-issues/customize-issue-fields-and-layouts/issue-fields/configure-a-playbook-to-run-timers.md): Configure Cortex XSIAM playbooks to start, pause, and stop issue timers for response-time tracking and automated workflows. - [Automate changes to issue fields using timer scripts](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/customize-cases-and-issues/customize-issue-fields-and-layouts/issue-fields/automate-changes-to-issue-fields-using-timer-scripts.md): Use Cortex XSIAM timer scripts with SLA tags to automate issue field updates, notifications, and actions after timer timeouts. - [Use issue timer field commands in the CLI](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/customize-cases-and-issues/customize-issue-fields-and-layouts/issue-fields/user-issue-timer-field-commands-manually-in-the-cli.md): Use Cortex XSIAM CLI commands to set, start, pause, stop, and reset issue timer fields and SLA targets. - [Issue layouts](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/customize-cases-and-issues/customize-issue-fields-and-layouts/issue-layouts.md): Manage Cortex XSIAM system and custom issue layouts to control Investigate panel fields and issue information display. - [Create custom issue layouts](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/customize-cases-and-issues/customize-issue-fields-and-layouts/issue-layouts/create-custom-issue-layouts.md): Create custom Cortex XSIAM issue layouts with fields, tabs, sections, and action buttons to support analyst investigations. - [Add a custom widget to an issue layout](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/customize-cases-and-issues/customize-issue-fields-and-layouts/issue-layouts/add-a-custom-widget-to-an-issue-layout.md): Add custom or system widgets to Cortex XSIAM issue layouts with dynamic-section scripts and layout rules. - [Create issue layout rules](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/customize-cases-and-issues/customize-issue-fields-and-layouts/issue-layouts/create-rules-for-issue-layouts.md): Create Cortex XSIAM issue layout rules to apply custom layouts based on issue source, correlation rules, and other criteria. - [Create SLAs for case and issue resolution](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/customize-cases-and-issues/create-slas-for-issue-resolution.md): Create Cortex XSIAM resolution SLA rules to set, track, and report case and issue resolution time goals and timers. - [Create additional case timers and SLAs](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/customize-cases-and-issues/create-slas-for-issue-resolution/create-case-timers-and-slas.md): Create Cortex XSIAM case timers and custom SLAs to track KPIs, response-time goals, case milestones, and SLA compliance. - [Update case timer and SLA fields](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/customize-cases-and-issues/create-slas-for-issue-resolution/create-case-timers-and-slas/update-case-timer-and-sla-fields.md): Refresh Cortex XSIAM case timer and SLA fields with a War Room CLI command. - [Create issue exceptions](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/customize-cases-and-issues/create-issue-exceptions.md): Create Cortex XSIAM issue exception rules to defer remediation, pause SLA timers, and manage risk acceptance approvals. - [Configure the issue exception approval workflow](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/customize-cases-and-issues/create-issue-exceptions/configure-the-issue-exception-approval-workflow.md): Configure Cortex XSIAM issue exception approvals by managing approvers and enabling or disabling approval requirements. - [Create issue exception rules](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/customize-cases-and-issues/create-issue-exceptions/create-issue-exception-rules.md): Create Cortex XSIAM issue exception rules with approvers, expiration dates, SLA timer pauses, and issue filter criteria. - [Create an exception rule from an issue](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/customize-cases-and-issues/create-issue-exceptions/create-an-exception-rule-from-an-issue.md): Create a Cortex XSIAM issue exception rule from a specific issue to pause its SLA timer and request approver review. - [View issue exception rules](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/customize-cases-and-issues/create-issue-exceptions/view-issue-exception-rules.md): View Cortex XSIAM issue exception rules, approval status, affected issues, expiration dates, and workflow details. - [Disable issue exception rules](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/customize-cases-and-issues/create-issue-exceptions/disable-issue-exception-rules.md): Disable Cortex XSIAM issue exception rules to stop creating exceptions for matching issues. Disabled rules cannot be re-enabled. - [View excepted issues](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/customize-cases-and-issues/create-issue-exceptions/view-excepted-issues.md): View Cortex XSIAM excepted issues by filtering the Issues page and tracking each exception's remaining period. - [Optimize case grouping in correlations](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/customize-cases-and-issues/optimize-case-grouping-in-correlations.md): Map correlation rule fields in Cortex XSIAM to improve case grouping, reduce issue fragmentation, and support investigation prioritization. - [Run indicator extraction in the CLI](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/customize-cases-and-issues/run-indicator-extraction-in-the-cli.md): Use Cortex XSIAM War Room CLI commands to extract, enrich, and run reputation checks on indicators. - [XQL query management](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/xql-query-management.md): Configure Cortex XSIAM XQL query limits, timeouts, and visibility controls to protect tenant performance and query privacy. - [Multi-Tenant](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/multi-tenant.md): Manage Cortex XSIAM multi-tenant deployments, including child tenants, licensing, data isolation, and centralized security operations. - [What is Cortex XSIAM multi-tenant?](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/multi-tenant/what-is-cortex-xsiam-multi-tenant.md): Learn how Cortex XSIAM multi-tenant deployments isolate child tenant data while centralizing licensing, administration, and alert visibility. - [MSSP multi-tenant](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/multi-tenant/what-is-cortex-xsiam-multi-tenant/mssp-multi-tenant.md): Manage Cortex XSIAM MSSP multi-tenant environments with centralized or customer-owned licensing for client security operations. - [Enterprise multi-tenant](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/multi-tenant/what-is-cortex-xsiam-multi-tenant/enterprise-multi-tenant.md): Use Cortex XSIAM enterprise multi-tenancy to isolate subdivision data while centralizing threat visibility, licensing, and resource allocation. - [Multi-tenant central licensing management](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/multi-tenant/multi-tenant-central-licensing-management.md) - [Onboard Cortex multi-tenant](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/multi-tenant/onboard-cortex-multi-tenant.md): Onboard Cortex XSIAM multi-tenant deployments by activating parent and child tenants and managing child tenant access. - [Onboarding checklist for multi-tenant central licensing deployments](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/multi-tenant/onboard-cortex-multi-tenant/onboarding-checklist-for-multi-tenant-central-licensing-deployments.md): Follow this checklist to activate parent tenants, create child tenants, and configure user access for centrally licensed Cortex XSIAM deployments. - [Step 1. Activate Cortex XSIAM (main account)](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/multi-tenant/onboard-cortex-multi-tenant/onboarding-checklist-for-multi-tenant-central-licensing-deployments/step-1.-activate-cortex-xsiam-main-account.md): Activate the Cortex XSIAM main account in Cortex Gateway and configure its tenant name, region, subdomain, and encryption method. - [Create a child tenant](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/multi-tenant/onboard-cortex-multi-tenant/onboarding-checklist-for-multi-tenant-central-licensing-deployments/step-2.-create-a-child-tenant.md): Create Cortex XSIAM child tenants in Cortex Gateway and allocate licensed employee, storage, and add-on resources. - [Onboarding checklist for multi-tenant customer-owned license deployments](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/multi-tenant/onboard-cortex-multi-tenant/onboarding-checklist-for-multi-tenant-customer-owned-license-deployments.md): Follow this checklist to activate, configure access for, and pair Cortex XSIAM tenants using customer-owned licenses. - [Step 1. Active Cortex XSIAM (parent and child tenants)](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/multi-tenant/onboard-cortex-multi-tenant/onboarding-checklist-for-multi-tenant-customer-owned-license-deployments/step-1.-active-cortex-xsiam-parent-and-child-tenants.md): Activate Cortex XSIAM parent and child tenants in Cortex Gateway for multi-tenant deployments. - [Step 2. Define access configuations and role permissions](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/multi-tenant/onboard-cortex-multi-tenant/onboarding-checklist-for-multi-tenant-customer-owned-license-deployments/step-2.-define-access-configuations-and-role-permissions.md): Configure Customer Support Portal access and Cortex Gateway roles for manual parent-child tenant pairing in Cortex XSIAM. - [Step 3. Pair a parent tenant with a child tenant](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/multi-tenant/onboard-cortex-multi-tenant/onboarding-checklist-for-multi-tenant-customer-owned-license-deployments/step-3.-pair-a-parent-tenant-with-a-child-tenant.md): Pair Cortex XSIAM parent and child tenants in Tenant Management to centrally manage child tenant security configurations. - [Dynamic license allocation](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/multi-tenant/dynamic-license-allocation.md): Dynamically allocate Cortex XSIAM licenses, endpoints, employees, and storage across child tenants in centrally managed multi-tenant deployments. - [Child tenant management](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/multi-tenant/child-tenant-management.md): Manage Cortex XSIAM child tenants from a parent tenant by investigating their data and applying centralized security configurations. - [Track your tenant management](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/multi-tenant/child-tenant-management/track-your-tenant-management.md): Track Cortex XSIAM child tenant connection status, pairing, synchronization, and centrally managed security configurations. - [Investigate child tenant data](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/multi-tenant/child-tenant-management/investigate-child-tenant-data.md): Investigate Cortex XSIAM child tenant data, including cases and issues, from a multi-tenant parent environment. - [Create and allocate configurations](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/multi-tenant/child-tenant-management/create-and-allocate-configurations.md): Create and assign Cortex XSIAM security action configurations to centrally manage issues, profiles, and allowlists for child tenants. - [Create a security managed action](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/multi-tenant/child-tenant-management/create-a-security-managed-action.md): Create Cortex XSIAM managed security actions for child tenants, including issues exclusions, starred isses, and endpoint profiles. - [About managed threat hunting](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/multi-tenant/about-managed-threat-hunting.md): Learn about Cortex XSIAM Managed Threat Hunting, a 24/7 security service from Palo Alto Networks threat researchers and Unit 42 experts. - [Set up Managed Threat Hunting](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/multi-tenant/about-managed-threat-hunting/set-up-managed-threat-hunting.md): Set up Cortex XSIAM Managed Threat Hunting by approving tenant pairing and configuring notification emails for threat reports and inquiries. - [Investigate Managed Threat Hunting reports](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/multi-tenant/about-managed-threat-hunting/investigate-managed-threat-hunting-reports.md): Investigate Cortex XSIAM Managed Threat Hunting threat and impact reports, then collaborate directly with the hunting team. - [Managed Services configuration in Cortex](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/managed-services-configuration-in-cortex.md): Configure Cortex XSIAM Managed Services settings for Unit 42 threat response, report delivery, action permissions, and escalation contacts. - [Managed Services configuration](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/managed-services-configuration-in-cortex/managed-services-configuration.md): Configure how Unit 42 Managed Services hunts, investigates, and responds to threats in your Cortex XSIAM environment. - [Configure report forwarding](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/managed-services-configuration-in-cortex/configure-report-forwarding.md): Configure an email address or distribution list to receive Cortex XSIAM reports from Unit 42 Managed Services. - [Configure actions permissions](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/managed-services-configuration-in-cortex/configure-actions-permissions.md): Configure Unit 42 Managed Services response permissions in Cortex XSIAM for server and workstation endpoint actions. - [Manage escalation contacts](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/managed-services-configuration-in-cortex/manage-escalation-contacts.md): Manage Unit 42 Managed Services escalation contacts for Cortex XSIAM cases and response actions requiring approval. - [Endpoint security](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/protect-your-endpoints/endpoint-security.md): Learn how Cortex XSIAM and the Cortex XDR agent protect your endpoints. - [Endpoint protection](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/protect-your-endpoints/endpoint-security/endpoint-protection.md): Learn how Cortex XSIAM endpoint protection uses the Cortex XDR agent to prevent malware, exploits, and zero-day threats. - [Malware protection](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/protect-your-endpoints/endpoint-security/endpoint-protection/malware-protection.md): Learn how Cortex XSIAM prevents known and unknown malware across supported endpoint platforms. - [Exploit protection](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/protect-your-endpoints/endpoint-security/endpoint-protection/exploit-protection.md): Learn how Cortex XSIAM prevents software exploits across the endpoint attack chain. - [File analysis and protection flow](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/protect-your-endpoints/endpoint-security/endpoint-protection/file-analysis-and-protection-flow.md): Understand Cortex XSIAM file analysis and the Cortex XDR agent exploit and malware protection flow. - [Endpoint protection capabilities](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/protect-your-endpoints/endpoint-security/endpoint-protection/endpoint-protection-capabilities.md): Explore Cortex XSIAM endpoint protection capabilities and their supported platforms. - [Processes protected by exploit security policy](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/protect-your-endpoints/endpoint-security/endpoint-protection/processes-protected-by-exploit-security-policy.md): Review processes protected by Cortex XSIAM exploit security policies on each operating system. - [WildFire analysis concepts](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/protect-your-endpoints/endpoint-security/endpoint-protection/wildfire-analysis-concepts.md): Learn how Cortex XSIAM and WildFire analyze unknown files, assign malware verdicts, and protect endpoints. - [File Integrity Monitoring (FIM)](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/protect-your-endpoints/endpoint-security/endpoint-protection/file-integrity-monitoring-fim.md): Use Cortex XSIAM File Integrity Monitoring to detect changes to endpoint files and folders. - [CaaS Workloads](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/protect-your-endpoints/endpoint-security/endpoint-protection/caas-workloads.md): Deploy the Cortex XSIAM container-embedded agent to protect CaaS workloads. - [About content updates](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/protect-your-endpoints/endpoint-security/endpoint-protection/about-content-updates.md): Learn how content updates deliver current endpoint protections and detection logic in Cortex XSIAM. - [Guidelines for keeping Cortex XDR agents and content updated](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/protect-your-endpoints/endpoint-security/endpoint-protection/guidelines-for-keeping-cortex-xdr-agents-and-content-updated.md): Plan phased Cortex XDR agent and content updates to maintain endpoint protection in Cortex XSIAM. - [Endpoint data collection](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/protect-your-endpoints/endpoint-security/endpoint-protection/endpoint-data-collection.md): Understand endpoint data that Cortex XSIAM collects through the Cortex XDR agent. - [Install and manage endpoints](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/protect-your-endpoints/endpoint-security/install-and-manage-endpoints.md): Learn how Cortex XSIAM installs, configures, hardens, and manages Cortex XDR agents and endpoint protection. - [Set up endpoint protection](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/protect-your-endpoints/endpoint-security/install-and-manage-endpoints/set-up-endpoint-protection.md): Set up Cortex XSIAM endpoint protection with profiles, policies, and exception rules. - [Set up endpoint profiles and exception rules](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/protect-your-endpoints/endpoint-security/install-and-manage-endpoints/set-up-endpoint-protection/set-up-endpoint-profiles-and-exception-rules.md): Configure Cortex XSIAM endpoint profiles and exception rules for consistent protection. - [Set up malware prevention profiles](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/protect-your-endpoints/endpoint-security/install-and-manage-endpoints/set-up-endpoint-protection/set-up-endpoint-profiles-and-exception-rules/set-up-malware-prevention-profiles.md): Configure Cortex XSIAM malware prevention profiles to detect and block malicious files. - [Set up exploit prevention profiles](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/protect-your-endpoints/endpoint-security/install-and-manage-endpoints/set-up-endpoint-protection/set-up-endpoint-profiles-and-exception-rules/set-up-exploit-prevention-profiles.md): Configure Cortex XSIAM exploit prevention profiles to protect endpoints from software exploits. - [Set up agent settings profiles](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/protect-your-endpoints/endpoint-security/install-and-manage-endpoints/set-up-endpoint-protection/set-up-endpoint-profiles-and-exception-rules/set-up-agent-settings-profiles.md): Configure Cortex XDR agent settings profiles for endpoint communication, upgrades, and protection behavior in Cortex XSIAM. - [Set up restrictions prevention profiles](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/protect-your-endpoints/endpoint-security/install-and-manage-endpoints/set-up-endpoint-protection/set-up-endpoint-profiles-and-exception-rules/set-up-restrictions-prevention-profiles.md): Configure restrictions prevention profiles to control executable activity on endpoints in Cortex XSIAM. - [Set up exception profiles and rules](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/protect-your-endpoints/endpoint-security/install-and-manage-endpoints/set-up-endpoint-protection/set-up-endpoint-profiles-and-exception-rules/set-up-exception-profiles-and-rules.md): Configure exception profiles and rules for trusted or unsupported activity in Cortex XSIAM. - [Exception configuration](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/protect-your-endpoints/endpoint-security/install-and-manage-endpoints/set-up-endpoint-protection/set-up-endpoint-profiles-and-exception-rules/set-up-exception-profiles-and-rules/exception-configuration.md): Configure endpoint exception settings and policy behavior in Cortex XSIAM. - [Issue exclusions](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/protect-your-endpoints/endpoint-security/install-and-manage-endpoints/set-up-endpoint-protection/set-up-endpoint-profiles-and-exception-rules/set-up-exception-profiles-and-rules/issue-exclusions.md): Manage issue exclusions to suppress selected endpoint security issues in Cortex XSIAM. - [Add an issue exclusion rule](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/protect-your-endpoints/endpoint-security/install-and-manage-endpoints/set-up-endpoint-protection/set-up-endpoint-profiles-and-exception-rules/set-up-exception-profiles-and-rules/issue-exclusions/add-an-issue-exclusion-rule.md): Create issue exclusion rules for matching endpoint security issues in Cortex XSIAM. - [Add an IOC or BIOC rule exception](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/protect-your-endpoints/endpoint-security/install-and-manage-endpoints/set-up-endpoint-protection/set-up-endpoint-profiles-and-exception-rules/set-up-exception-profiles-and-rules/add-an-ioc-or-bioc-rule-exception.md): Add Cortex XSIAM IOC or BIOC rule exceptions for approved endpoint activity. - [Add a disable prevention rule for endpoints](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/protect-your-endpoints/endpoint-security/install-and-manage-endpoints/set-up-endpoint-protection/set-up-endpoint-profiles-and-exception-rules/set-up-exception-profiles-and-rules/add-a-disable-prevention-rule-for-endpoints.md): Add Cortex XSIAM rules that disable prevention on selected endpoints. - [Add a disable injection and prevention rule](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/protect-your-endpoints/endpoint-security/install-and-manage-endpoints/set-up-endpoint-protection/set-up-endpoint-profiles-and-exception-rules/set-up-exception-profiles-and-rules/add-a-disable-injection-and-prevention-rule.md): Add Cortex XSIAM rules that disable injection and prevention for selected processes. - [Add a support exception rule for endpoints](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/protect-your-endpoints/endpoint-security/install-and-manage-endpoints/set-up-endpoint-protection/set-up-endpoint-profiles-and-exception-rules/set-up-exception-profiles-and-rules/add-a-support-exception-rule-for-endpoints.md): Add Cortex XSIAM support exception rules for endpoint troubleshooting and compatibility. - [Add a legacy exception rule for endpoints](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/protect-your-endpoints/endpoint-security/install-and-manage-endpoints/set-up-endpoint-protection/set-up-endpoint-profiles-and-exception-rules/set-up-exception-profiles-and-rules/add-a-legacy-exception-rule-for-endpoints.md): Add Cortex XSIAM legacy exception rules for endpoint compatibility requirements. - [Add a new exceptions security profile](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/protect-your-endpoints/endpoint-security/install-and-manage-endpoints/set-up-endpoint-protection/set-up-endpoint-profiles-and-exception-rules/set-up-exception-profiles-and-rules/add-a-legacy-exception-rule-for-endpoints/add-a-new-exceptions-security-profile.md): Create Cortex XSIAM exceptions security profiles for legacy endpoint policies. - [Add a global endpoint policy exception](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/protect-your-endpoints/endpoint-security/install-and-manage-endpoints/set-up-endpoint-protection/set-up-endpoint-profiles-and-exception-rules/set-up-exception-profiles-and-rules/add-a-legacy-exception-rule-for-endpoints/add-a-global-endpoint-policy-exception.md): Add global Cortex XSIAM endpoint policy exceptions for selected endpoints. - [Set up Identity profiles](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/protect-your-endpoints/endpoint-security/install-and-manage-endpoints/set-up-endpoint-protection/set-up-endpoint-profiles-and-exception-rules/set-up-identity-profiles.md): Configure identity profiles for endpoint-related identity protection settings in Cortex XSIAM. - [Define endpoint groups](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/protect-your-endpoints/endpoint-security/install-and-manage-endpoints/define-endpoint-groups.md): Define endpoint groups to organize endpoints and target policies in Cortex XSIAM. - [Configure global agent settings](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/protect-your-endpoints/endpoint-security/install-and-manage-endpoints/configure-global-agent-settings.md): Configure global Cortex XDR agent settings for endpoints across your Cortex XSIAM environment. - [Apply profiles to endpoints](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/protect-your-endpoints/endpoint-security/install-and-manage-endpoints/apply-profiles-to-endpoints.md): Apply Cortex XSIAM profiles to endpoints using targeted policy rules. - [Create an agent installation package](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/protect-your-endpoints/endpoint-security/install-and-manage-endpoints/create-an-agent-installation-package.md): Create Cortex XDR agent installation packages for endpoint deployment in Cortex XSIAM. - [Manage an agent installation package](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/protect-your-endpoints/endpoint-security/install-and-manage-endpoints/create-an-agent-installation-package/manage-an-agent-installation-package.md): Manage Cortex XDR agent installation packages and their deployment settings in Cortex XSIAM. - [Harden endpoint security](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/protect-your-endpoints/endpoint-security/install-and-manage-endpoints/harden-endpoint-security.md): Harden endpoint security with Cortex XSIAM controls for devices, firewalls, encryption, and vulnerabilities. - [Device control](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/protect-your-endpoints/endpoint-security/install-and-manage-endpoints/harden-endpoint-security/device-control.md): Configure Cortex XSIAM device control policies for USB, Bluetooth, printers, and peripheral access on endpoints. - [Host firewall](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/protect-your-endpoints/endpoint-security/install-and-manage-endpoints/harden-endpoint-security/host-firewall.md): Configure Cortex XSIAM host firewall policies to control endpoint network traffic. - [Host firewall for Windows](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/protect-your-endpoints/endpoint-security/install-and-manage-endpoints/harden-endpoint-security/host-firewall/host-firewall-for-windows.md): Configure Cortex XSIAM host firewall policies to control inbound and outbound network traffic on Windows endpoints. - [Host firewall for macOS](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/protect-your-endpoints/endpoint-security/install-and-manage-endpoints/harden-endpoint-security/host-firewall/host-firewall-for-macos.md): Configure Cortex XSIAM host firewall policies for macOS endpoints. - [Disk encryption](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/protect-your-endpoints/endpoint-security/install-and-manage-endpoints/harden-endpoint-security/disk-encryption.md): Manage Cortex XSIAM disk encryption settings to protect endpoint data. - [Host Inventory](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/protect-your-endpoints/endpoint-security/install-and-manage-endpoints/harden-endpoint-security/host-inventory.md): Use Cortex XSIAM Host Inventory to review endpoint hardware, software, services, and security details. - [Vulnerability Assessment](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/protect-your-endpoints/endpoint-security/install-and-manage-endpoints/harden-endpoint-security/vulnerability-assessment.md): Use Cortex XSIAM Vulnerability Assessment to identify endpoint software vulnerabilities. - [Set a Cortex XDR agent Critical Environment version](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/protect-your-endpoints/endpoint-security/install-and-manage-endpoints/harden-endpoint-security/set-a-cortex-xdr-agent-critical-environment-version.md): Set a Cortex XDR Critical Environment agent version for controlled endpoint upgrades in Cortex XSIAM. - [Manage endpoint protection](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/protect-your-endpoints/endpoint-security/install-and-manage-endpoints/manage-endpoint-protection.md): Manage endpoint protection, agents, tags, policies, and operational settings in Cortex XSIAM. - [Move agents between managing servers](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/protect-your-endpoints/endpoint-security/install-and-manage-endpoints/manage-endpoint-protection/move-agents-between-managing-servers.md): Move Cortex XDR agents between managing servers without reinstalling endpoints in Cortex XSIAM. - [Manage endpoint tags](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/protect-your-endpoints/endpoint-security/install-and-manage-endpoints/manage-endpoint-protection/manage-endpoint-tags.md): Manage endpoint tags to organize and target endpoints in Cortex XSIAM. - [Create an endpoint tag](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/protect-your-endpoints/endpoint-security/install-and-manage-endpoints/manage-endpoint-protection/manage-endpoint-tags/create-an-endpoint-tag.md): Create endpoint tags for endpoint organization and policy targeting in Cortex XSIAM. - [Remove an endpoint tag](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/protect-your-endpoints/endpoint-security/install-and-manage-endpoints/manage-endpoint-protection/manage-endpoint-tags/remove-an-endpoint-tag.md): Remove endpoint tags that are no longer needed in Cortex XSIAM. - [Track your endpoint tags](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/protect-your-endpoints/endpoint-security/install-and-manage-endpoints/manage-endpoint-protection/manage-endpoint-tags/track-your-endpoint-tags.md): View and filter Cortex XSIAM endpoint tags assigned by the Cortex XDR agent or in Cortex XSIAM. - [Permanently remove Endpoint tags from the system](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/protect-your-endpoints/endpoint-security/install-and-manage-endpoints/manage-endpoint-protection/manage-endpoint-tags/permanently-remove-endpoint-tags-from-the-system.md): Permanently remove endpoint tags from Cortex XSIAM. - [Set an alias for an endpoint](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/protect-your-endpoints/endpoint-security/install-and-manage-endpoints/manage-endpoint-protection/manage-endpoint-tags/set-an-alias-for-an-endpoint.md): Set an alias to identify an endpoint more clearly in Cortex XSIAM. - [Manage endpoint prevention profiles](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/protect-your-endpoints/endpoint-security/install-and-manage-endpoints/manage-endpoint-protection/manage-endpoint-prevention-profiles.md): Manage Cortex XSIAM endpoint prevention profiles and their applied protection settings. - [Create a new prevention policy rule for serverless function](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/protect-your-endpoints/endpoint-security/install-and-manage-endpoints/manage-endpoint-protection/create-a-new-prevention-policy-rule-for-serverless-function.md): Create Cortex XSIAM prevention policy rules for serverless functions. - [View information about your endpoint prevention profiles](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/protect-your-endpoints/endpoint-security/install-and-manage-endpoints/manage-endpoint-protection/view-information-about-your-endpoint-prevention-profiles.md): View Cortex XSIAM endpoint prevention profiles and their configured protection settings. - [Upgrade Cortex XDR agents](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/protect-your-endpoints/endpoint-security/install-and-manage-endpoints/manage-endpoint-protection/upgrade-cortex-xdr-agents.md): Upgrade Cortex XDR agents with Cortex XSIAM to maintain endpoint protection. - [Restart agent](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/protect-your-endpoints/endpoint-security/install-and-manage-endpoints/manage-endpoint-protection/restart-agent.md): Restart Cortex XDR agents from Cortex XSIAM for endpoint troubleshooting. - [Uninstall the Cortex XDR agent](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/protect-your-endpoints/endpoint-security/install-and-manage-endpoints/manage-endpoint-protection/uninstall-the-cortex-xdr-agent.md): Uninstall Cortex XDR agents from endpoints through Cortex XSIAM. - [Clear agent database](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/protect-your-endpoints/endpoint-security/install-and-manage-endpoints/manage-endpoint-protection/clear-agent-database.md): Clear the Cortex XSIAM agent database for endpoint troubleshooting. - [Delete Cortex XDR agents](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/protect-your-endpoints/endpoint-security/install-and-manage-endpoints/manage-endpoint-protection/delete-cortex-xdr-agents.md): Delete Cortex XDR agents from Cortex XSIAM when endpoints are decommissioned. - [Manage agent tokens](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/protect-your-endpoints/endpoint-security/install-and-manage-endpoints/manage-endpoint-protection/manage-agent-tokens.md): Manage Cortex XSIAM agent tokens for endpoint installation and registration. - [Retrieve support file password](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/protect-your-endpoints/endpoint-security/install-and-manage-endpoints/manage-endpoint-protection/retrieve-support-file-password.md): Retrieve the Cortex XSIAM support file password for endpoint troubleshooting. - [Send push notifications to iOS](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/protect-your-endpoints/endpoint-security/install-and-manage-endpoints/manage-endpoint-protection/send-push-notifications-to-ios.md): Send Cortex XSIAM push notifications to supported iOS endpoints. - [Monitor agent operational status](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/protect-your-endpoints/endpoint-security/install-and-manage-endpoints/manage-endpoint-protection/monitor-agent-operational-status.md): Monitor Cortex XSIAM agent operational status across managed endpoints. - [Monitor agent activity](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/protect-your-endpoints/endpoint-security/install-and-manage-endpoints/manage-endpoint-protection/monitor-agent-activity.md): Monitor Cortex XSIAM agent activity and endpoint events. - [Monitor agent upgrade status](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/protect-your-endpoints/endpoint-security/install-and-manage-endpoints/manage-endpoint-protection/monitor-agent-upgrade-status.md): Monitor Cortex XSIAM agent upgrade status across your endpoint fleet. - [Endpoint DLP](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/protect-your-endpoints/endpoint-dlp-1.md): Protect sensitive endpoint data and prevent exfiltration with Cortex XSIAM Endpoint DLP. - [Cortex Data Loss Prevention (DLP) module overview](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/protect-your-endpoints/endpoint-dlp-1/cortex-data-loss-prevention-dlp-module-overview.md): Learn about the Cortex Data Loss Prevention (DLP) module in Cortex XSIAM, which provides a solution to prevent sensitive data exfiltration. - [Archive file classification](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/protect-your-endpoints/endpoint-dlp-1/cortex-data-loss-prevention-dlp-module-overview/archive-file-classification.md): Learn how Cortex Data Loss Prevention in Cortex XSIAM inspects archive files and applies data-in-motion rules to protect sensitive data. - [True-file type detection](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/protect-your-endpoints/endpoint-dlp-1/cortex-data-loss-prevention-dlp-module-overview/true-file-type-detection.md): Learn how Cortex Data Loss Prevention in Cortex XSIAM identifies true file types to enforce data-in-motion policies and prevent file-extension evasion. - [Personas workflow for DLP](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/protect-your-endpoints/endpoint-dlp-1/personas-workflow-for-dlp.md): The data security administrator and data security viewer in Cortex XSIAM are responsible for identifying DLP requirements for creating data-in-motion rules and investigating issues and cases. - [Best Practices](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/protect-your-endpoints/endpoint-dlp-1/best-practices.md): Apply Cortex XSIAM Endpoint DLP best practices to design effective data-in-motion rules. - [Configure DLP end-to-end](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/protect-your-endpoints/endpoint-dlp-1/configure-dlp-end-to-end.md): Set up Cortex Data Loss Prevention in Cortex XSIAM, including endpoint settings, browser extensions, applications, and data-in-motion rules. - [DLP status in all endpoints](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/protect-your-endpoints/endpoint-dlp-1/dlp-status-in-all-endpoints.md): View Cortex Data Loss Prevention status and browser extension status for managed endpoints in Cortex XSIAM. - [Cortex DLP threat detection and issues](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/protect-your-endpoints/endpoint-dlp-1/cortex-dlp-threat-detection-and-issues.md): Investigate Cortex DLP issues in Cortex XSIAM triggered by data-in-motion rule violations and sensitive data exfiltration attempts. - [Monitor dashboards and reports](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/detect-investigate-and-respond-to-threats/monitor-dashboards-and-reports.md): Learn how to use Cortex XSIAM dashboards and reports to monitor security operations, visualize data, and share actionable insights. - [Overview of dashboards and reports](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/detect-investigate-and-respond-to-threats/monitor-dashboards-and-reports/overview-of-dashboards-and-reports.md): Learn how Cortex XSIAM dashboards, widgets, and reports turn security data into operational insights. - [Dashboard interface basics](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/detect-investigate-and-respond-to-threats/monitor-dashboards-and-reports/overview-of-dashboards-and-reports/dashboard-interface-basics.md): Learn the Cortex XSIAM dashboard interface, including navigation, widgets, filters, and available actions. - [Dashboard types](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/detect-investigate-and-respond-to-threats/monitor-dashboards-and-reports/overview-of-dashboards-and-reports/dashboard-types.md): Explore Cortex XSIAM dashboard types and choose the right view for your security operations. - [Report basics](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/detect-investigate-and-respond-to-threats/monitor-dashboards-and-reports/overview-of-dashboards-and-reports/report-basics.md): Learn Cortex XSIAM report concepts, including report templates, scheduling, and data presentation. - [Widget Library](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/detect-investigate-and-respond-to-threats/monitor-dashboards-and-reports/overview-of-dashboards-and-reports/widget-library.md): Explore the Cortex XSIAM Widget Library to find visualizations for dashboards and security monitoring. - [Access and visibility for dashboards and reports](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/detect-investigate-and-respond-to-threats/monitor-dashboards-and-reports/access-and-visibility-for-dashboards-and-reports.md): Control Cortex XSIAM dashboard and report access, visibility, ownership, and sharing. - [Visibility settings](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/detect-investigate-and-respond-to-threats/monitor-dashboards-and-reports/access-and-visibility-for-dashboards-and-reports/visibility-settings.md): Configure Cortex XSIAM dashboard and report visibility settings for the appropriate audience. - [Access to widgets](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/detect-investigate-and-respond-to-threats/monitor-dashboards-and-reports/access-and-visibility-for-dashboards-and-reports/access-to-widgets.md): Manage Cortex XSIAM access to dashboard widgets and the data they display. - [Sharing icons](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/detect-investigate-and-respond-to-threats/monitor-dashboards-and-reports/access-and-visibility-for-dashboards-and-reports/sharing-icons.md): Understand Cortex XSIAM sharing icons and their dashboard and report visibility meanings. - [Access and sharing cheat sheet](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/detect-investigate-and-respond-to-threats/monitor-dashboards-and-reports/access-and-visibility-for-dashboards-and-reports/access-and-sharing-cheat-sheet.md): Use this Cortex XSIAM reference to manage dashboard and report access and sharing. - [Manage dashboards and reports](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/detect-investigate-and-respond-to-threats/monitor-dashboards-and-reports/manage-dashboards-and-reports.md): Manage Cortex XSIAM dashboards and reports, including ownership, sharing, imports, and deleted content. - [Dashboard Manager](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/detect-investigate-and-respond-to-threats/monitor-dashboards-and-reports/manage-dashboards-and-reports/dashboard-manager.md): Use Cortex XSIAM Dashboard Manager to organize, find, and manage dashboards. - [Reports](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/detect-investigate-and-respond-to-threats/monitor-dashboards-and-reports/manage-dashboards-and-reports/reports.md): Manage Cortex XSIAM reports and report templates for security operations and stakeholder communication. - [Duplicate dashboards and reports](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/detect-investigate-and-respond-to-threats/monitor-dashboards-and-reports/manage-dashboards-and-reports/duplicate-dashboards-and-reports.md): Duplicate Cortex XSIAM dashboards and reports to reuse existing visualizations and templates. - [Share custom dashboards and report templates](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/detect-investigate-and-respond-to-threats/monitor-dashboards-and-reports/manage-dashboards-and-reports/share-custom-dashboards-and-report-templates.md): Share Cortex XSIAM custom dashboards and report templates with users and teams. - [Change ownership to dashboards and report templates](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/detect-investigate-and-respond-to-threats/monitor-dashboards-and-reports/manage-dashboards-and-reports/change-ownership-to-dashboards-and-report-templates.md): Change Cortex XSIAM dashboard and report template ownership to maintain access and accountability. - [Import and export dashboards and report templates](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/detect-investigate-and-respond-to-threats/monitor-dashboards-and-reports/manage-dashboards-and-reports/import-and-export-dashboards-and-report-templates.md): Import and export Cortex XSIAM dashboards and report templates for reuse across environments. - [Configure the notification rule for a failed report](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/detect-investigate-and-respond-to-threats/monitor-dashboards-and-reports/manage-dashboards-and-reports/configure-the-notification-rule-for-a-failed-report.md): Configure Cortex XSIAM notifications for failed report generation and delivery. - [Deleted content](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/detect-investigate-and-respond-to-threats/monitor-dashboards-and-reports/manage-dashboards-and-reports/deleted-content.md): Restore or permanently manage deleted Cortex XSIAM dashboards, reports, and related content. - [Create dashboards](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/detect-investigate-and-respond-to-threats/monitor-dashboards-and-reports/create-dashboards.md): Create Cortex XSIAM dashboards to monitor security data, trends, and operational outcomes. - [Create a dashboard](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/detect-investigate-and-respond-to-threats/monitor-dashboards-and-reports/create-dashboards/create-a-dashboard.md): Create a Cortex XSIAM dashboard with widgets, filters, and layouts for focused monitoring. - [Create reports](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/detect-investigate-and-respond-to-threats/monitor-dashboards-and-reports/create-reports.md): Create Cortex XSIAM reports to present and share security data with stakeholders. - [Create a report template from scratch](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/detect-investigate-and-respond-to-threats/monitor-dashboards-and-reports/create-reports/create-a-report-template-from-scratch.md): Create a Cortex XSIAM report template from scratch for repeatable security reporting. - [Advanced configuration](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/detect-investigate-and-respond-to-threats/monitor-dashboards-and-reports/advanced-configuration.md): Configure Cortex XSIAM dashboards with custom widgets, global filters, and drilldowns. - [Create custom widgets](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/detect-investigate-and-respond-to-threats/monitor-dashboards-and-reports/advanced-configuration/create-custom-widgets.md): Create custom Cortex XSIAM dashboard widgets using AI, XQL, scripts, and parameters. - [Create widgets using AI](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/detect-investigate-and-respond-to-threats/monitor-dashboards-and-reports/advanced-configuration/create-custom-widgets/create-widgets-using-ai.md): Use AI to create Cortex XSIAM dashboard widgets from natural language prompts. - [Create XQL widgets](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/detect-investigate-and-respond-to-threats/monitor-dashboards-and-reports/advanced-configuration/create-custom-widgets/create-xql-widgets.md): Create Cortex XSIAM XQL widgets to visualize query results on dashboards. - [Add parameters to a custom XQL widget](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/detect-investigate-and-respond-to-threats/monitor-dashboards-and-reports/advanced-configuration/create-custom-widgets/add-parameters-to-a-custom-xql-widget.md): Add parameters to Cortex XSIAM custom XQL widgets for interactive dashboard filtering. - [Create script-based widgets](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/detect-investigate-and-respond-to-threats/monitor-dashboards-and-reports/advanced-configuration/create-custom-widgets/create-script-based-widgets.md): Create Cortex XSIAM script-based widgets to display custom dashboard data and insights. - [Configure global filters](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/detect-investigate-and-respond-to-threats/monitor-dashboards-and-reports/advanced-configuration/configure-global-filters.md): Configure Cortex XSIAM global dashboard filters to refine data across multiple widgets. - [Configure drilldowns](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/detect-investigate-and-respond-to-threats/monitor-dashboards-and-reports/advanced-configuration/configure-drilldowns.md): Configure Cortex XSIAM dashboard drilldowns to investigate data from widget visualizations. - [Dashboard reference](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/detect-investigate-and-respond-to-threats/monitor-dashboards-and-reports/dashboard-reference.md): Reference Cortex XSIAM dashboards, including Command Center and system dashboard views. - [Command Center reference](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/detect-investigate-and-respond-to-threats/monitor-dashboards-and-reports/dashboard-reference/command-center-reference.md): Reference Cortex XSIAM Command Center dashboards for security operations visibility and monitoring. - [Cortex Command Center](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/detect-investigate-and-respond-to-threats/monitor-dashboards-and-reports/dashboard-reference/command-center-reference/cortex-command-center.md): Use Cortex Command Center in Cortex XSIAM to monitor operational security insights and priorities. - [Cortex Agentic Assistant dashboard](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/detect-investigate-and-respond-to-threats/monitor-dashboards-and-reports/dashboard-reference/command-center-reference/cortex-agentic-assistant-dashboard.md): Use the Cortex XSIAM Agentic Assistant dashboard to monitor AI-assisted security operations. - [XSIAM Command Center](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/detect-investigate-and-respond-to-threats/monitor-dashboards-and-reports/dashboard-reference/command-center-reference/xsiam-command-center.md): Use the XSIAM Command Center to monitor Cortex XSIAM security operations and key metrics. - [Data Inventory](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/detect-investigate-and-respond-to-threats/monitor-dashboards-and-reports/dashboard-reference/command-center-reference/xsiam-command-center/data-inventory.md): Use Cortex XSIAM Data Inventory to monitor data sources, coverage, and security telemetry. - [Dynamic View](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/detect-investigate-and-respond-to-threats/monitor-dashboards-and-reports/dashboard-reference/command-center-reference/xsiam-command-center/dynamic-view.md): Use Cortex XSIAM Dynamic View to monitor changing security data and operational insights. - [Cases Overview](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/detect-investigate-and-respond-to-threats/monitor-dashboards-and-reports/dashboard-reference/command-center-reference/xsiam-command-center/cases-overview.md): Use Cortex XSIAM Cases Overview to monitor case status, priorities, and investigation workload. - [Cloud Detection and Response (CDR) Command Center](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/detect-investigate-and-respond-to-threats/monitor-dashboards-and-reports/dashboard-reference/command-center-reference/cloud-detection-and-response-cdr-command-center.md): Use the Cortex XSIAM CDR Command Center to monitor cloud detection and response operations. - [Cortex Cloud Command Center](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/detect-investigate-and-respond-to-threats/monitor-dashboards-and-reports/dashboard-reference/command-center-reference/cortex-cloud-command-center.md): Use Cortex Cloud Command Center in Cortex XSIAM to monitor cloud security operations and insights. - [System dashboards](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/detect-investigate-and-respond-to-threats/monitor-dashboards-and-reports/dashboard-reference/system-dashboards.md): Reference Cortex XSIAM system dashboards for operational, cloud security, and data ingestion monitoring. - [Cortex Cloud Consumption](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/detect-investigate-and-respond-to-threats/monitor-dashboards-and-reports/dashboard-reference/system-dashboards/cortex-cloud-consumption.md): Use Cortex Cloud Consumption in Cortex XSIAM to monitor cloud security usage and consumption. - [Cloud Security Operations](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/detect-investigate-and-respond-to-threats/monitor-dashboards-and-reports/dashboard-reference/system-dashboards/cloud-security-operations.md): Use Cortex XSIAM Cloud Security Operations to monitor cloud risks, findings, and remediation progress. - [Data Ingestion](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/detect-investigate-and-respond-to-threats/monitor-dashboards-and-reports/dashboard-reference/system-dashboards/data-ingestion.md): Use Cortex XSIAM Data Ingestion to monitor data collection health, volume, and coverage. - [Investigation and response](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/detect-investigate-and-respond-to-threats/investigation-and-response.md) - [Overview of cases](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/detect-investigate-and-respond-to-threats/investigation-and-response/overview-of-cases.md): Learn how cases group security issues, support investigations, and track responses through resolution in Cortex XSIAM. - [What are cases?](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/detect-investigate-and-respond-to-threats/investigation-and-response/overview-of-cases/what-are-cases.md): Learn how Cortex XSIAM cases unify issues, assets, and artifacts for streamlined investigations. - [Resolving cases with AI](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/detect-investigate-and-respond-to-threats/investigation-and-response/overview-of-cases/resolving-cases-with-ai.md): Use AI in Cortex XSIAM to prioritize, investigate, and resolve security cases faster. - [Case lifecycle](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/detect-investigate-and-respond-to-threats/investigation-and-response/overview-of-cases/case-lifecycle.md): Understand how Cortex XSIAM moves security cases from detection through resolution. - [Case thresholds](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/detect-investigate-and-respond-to-threats/investigation-and-response/overview-of-cases/case-thresholds.md): Learn how Cortex XSIAM case thresholds control issue grouping and auto-resolved case reopening. - [Case scope and impact](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/detect-investigate-and-respond-to-threats/investigation-and-response/overview-of-cases/case-scope-and-impact.md): Learn how Cortex XSIAM uses severity, score, and domain to prioritize and scope cases. - [Case and issue domains](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/detect-investigate-and-respond-to-threats/investigation-and-response/overview-of-cases/case-and-issue-domains.md): Learn how Cortex XSIAM assigns case and issue domains to organize response work. - [Overview of case teams and roles](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/detect-investigate-and-respond-to-threats/investigation-and-response/overview-of-cases/overview-of-case-teams-and-roles.md): Learn how Cortex XSIAM case teams assign roles and control sensitive case access. - [Case concepts](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/detect-investigate-and-respond-to-threats/investigation-and-response/case-concepts.md): Learn Cortex XSIAM case concepts, including issues, grouping, scoring, SLAs, and causality. - [Issues, findings, and events](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/detect-investigate-and-respond-to-threats/investigation-and-response/case-concepts/issues-findings-and-events.md): Understand how Cortex XSIAM connects issues, findings, and events to support case investigations. - [Case grouping](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/detect-investigate-and-respond-to-threats/investigation-and-response/case-concepts/case-grouping.md): Learn how Cortex XSIAM automatically groups related issues and artifacts into unified cases. - [Case scoring](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/detect-investigate-and-respond-to-threats/investigation-and-response/case-concepts/case-scoring.md): Learn how Cortex XSIAM scores cases using rules, SmartScore, and manual input. - [Case starring](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/detect-investigate-and-respond-to-threats/investigation-and-response/case-concepts/case-starring.md): Learn how Cortex XSIAM stars important cases manually or through automated configurations. - [SLAs and tracking](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/detect-investigate-and-respond-to-threats/investigation-and-response/case-concepts/slas-and-tracking.md): Learn how Cortex XSIAM tracks case SLAs, timers, and severity-based response targets. - [What is Causality?](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/detect-investigate-and-respond-to-threats/investigation-and-response/case-concepts/what-is-causality.md): Learn how Cortex XSIAM connects activity into causality chains for faster investigations. - [Analyze and resolve cases](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/detect-investigate-and-respond-to-threats/investigation-and-response/analyze-and-resolve-cases.md): Learn how Cortex XSIAM helps you analyze, investigate, and resolve security cases. - [Review all cases](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/detect-investigate-and-respond-to-threats/investigation-and-response/analyze-and-resolve-cases/review-all-cases.md): Review and prioritize Cortex XSIAM cases using status, severity, scores, and saved views. - [Start case analysis](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/detect-investigate-and-respond-to-threats/investigation-and-response/analyze-and-resolve-cases/start-case-analysis.md): Start Cortex XSIAM case analysis from the Cases page, a unified workspace for investigation and response. - [Agentic Assistant- Case Investigation agent](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/detect-investigate-and-respond-to-threats/investigation-and-response/analyze-and-resolve-cases/start-case-analysis/agentic-assistant-case-investigation-agent.md): Use the Case Investigation agent in Cortex XSIAM for contextual summaries and investigation guidance. - [Establish case context](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/detect-investigate-and-respond-to-threats/investigation-and-response/analyze-and-resolve-cases/establish-case-context.md): Establish Cortex XSIAM case context by reviewing titles, descriptions, scores, and ownership. - [AI-generated case summaries](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/detect-investigate-and-respond-to-threats/investigation-and-response/analyze-and-resolve-cases/establish-case-context/ai-generated-case-summaries.md): Use Cortex XSIAM AI-generated summaries to understand current case scope and context. - [Assess case severity and score](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/detect-investigate-and-respond-to-threats/investigation-and-response/analyze-and-resolve-cases/establish-case-context/assess-case-severity-and-score.md): Assess and update Cortex XSIAM case severity and scores to prioritize response. - [Update case attributes](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/detect-investigate-and-respond-to-threats/investigation-and-response/analyze-and-resolve-cases/establish-case-context/update-case-attributes.md): In Cortex XSIAM you can update case titles, descriptions, assignments, and starred status. - [Analyze case details](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/detect-investigate-and-respond-to-threats/investigation-and-response/analyze-and-resolve-cases/analyze-case-details.md): To analyze a case in Cortex XSIAM you can review details about case relationships, evidence, issues, assets, tactics, and timelines. - [Grouping graph](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/detect-investigate-and-respond-to-threats/investigation-and-response/analyze-and-resolve-cases/analyze-case-details/grouping-graph.md): Use the Cortex XSIAM grouping graph to understand linked issues and artifacts. - [Evidence](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/detect-investigate-and-respond-to-threats/investigation-and-response/analyze-and-resolve-cases/analyze-case-details/evidence.md): Review Cortex XSIAM evidence to understand threats, validate findings, and guide remediation. - [Issue feed](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/detect-investigate-and-respond-to-threats/investigation-and-response/analyze-and-resolve-cases/analyze-case-details/issue-feed.md): Review the case issue feed in Cortex XSIAM to trace case activity chronologically. - [Associated assets and artifacts](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/detect-investigate-and-respond-to-threats/investigation-and-response/analyze-and-resolve-cases/analyze-case-details/associated-assets-and-artifacts.md): Investigate Cortex XSIAM assets and artifacts associated with a case. - [MITRE ATT\&CK tactics and techniques](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/detect-investigate-and-respond-to-threats/investigation-and-response/analyze-and-resolve-cases/analyze-case-details/mitre-att-and-ck-tactics-and-techniques.md): Review the MITRE ATT\&CK tactics and techniques associated with issues in Cortex XSIAM. - [Compliance standards and controls](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/detect-investigate-and-respond-to-threats/investigation-and-response/analyze-and-resolve-cases/analyze-case-details/compliance-standards-and-controls.md): Review compliance standards and violated controls for Posture cases in Cortex XSIAM. - [Case timeline](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/detect-investigate-and-respond-to-threats/investigation-and-response/analyze-and-resolve-cases/analyze-case-details/case-timeline.md): Use the case timeline to track events, actions, and investigation evidence in Cortex XSIAM. - [Detailed View](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/detect-investigate-and-respond-to-threats/investigation-and-response/analyze-and-resolve-cases/analyze-case-details/detailed-view.md): Use the Detailed View for table-based case investigation and analysis in Cortex XSIAM. - [Resolve the case](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/detect-investigate-and-respond-to-threats/investigation-and-response/analyze-and-resolve-cases/resolve-the-case.md): Resolve Cortex XSIAM cases through remediation tasks and verified closure workflows. - [Resolution Center](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/detect-investigate-and-respond-to-threats/investigation-and-response/analyze-and-resolve-cases/resolve-the-case/resolution-center.md): Use Cortex XSIAM Resolution Center to manage remediation tasks and resolve cases. - [Collaborative notes and comments](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/detect-investigate-and-respond-to-threats/investigation-and-response/analyze-and-resolve-cases/resolve-the-case/collaborative-notes-and-comments.md): Use notes and comments to coordinate case investigations and responses in Cortex XSIAM. - [How to resolve a case](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/detect-investigate-and-respond-to-threats/investigation-and-response/analyze-and-resolve-cases/resolve-the-case/resolve-a-case.md): Resolve Cortex XSIAM cases manually, through playbooks, or with the API. - [Resolution reasons for cases and issues](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/detect-investigate-and-respond-to-threats/investigation-and-response/analyze-and-resolve-cases/resolve-the-case/resolution-reasons-for-cases-and-issues.md): Select resolution reasons when closing cases and issues in Cortex XSIAM. - [Monitor and track resolution times](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/detect-investigate-and-respond-to-threats/investigation-and-response/analyze-and-resolve-cases/resolve-the-case/monitor-and-track-resolution-times.md): Monitor case and issue resolution times in Cortex XSIAM against configured SLAs. - [Cortex Response and Remediation content pack](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/detect-investigate-and-respond-to-threats/investigation-and-response/analyze-and-resolve-cases/resolve-the-case/cortex-response-and-remediation-content-pack.md): Use Response and Remediation playbooks to automate incident workflows in Cortex XSIAM. - [Investigate an issue using Cortex Response and Remediation playbooks](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/detect-investigate-and-respond-to-threats/investigation-and-response/analyze-and-resolve-cases/resolve-the-case/cortex-response-and-remediation-content-pack/investigate-an-issue-using-cortex-response-and-remediation-playbooks.md): Investigate Cortex XSIAM issues using Response and Remediation playbooks. - [Example use cases](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/detect-investigate-and-respond-to-threats/investigation-and-response/analyze-and-resolve-cases/resolve-the-case/cortex-response-and-remediation-content-pack/example-use-cases.md): Explore Response and Remediation playbook use cases in Cortex XSIAM. - [Additional case actions](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/detect-investigate-and-respond-to-threats/investigation-and-response/analyze-and-resolve-cases/additional-case-actions.md): Manage Cortex XSIAM cases with creation, merging, access, and unified-view actions. - [Create a case](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/detect-investigate-and-respond-to-threats/investigation-and-response/analyze-and-resolve-cases/additional-case-actions/create-a-case.md): Create Cortex XSIAM cases manually and link or create associated issues. - [Merge a case](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/detect-investigate-and-respond-to-threats/investigation-and-response/analyze-and-resolve-cases/additional-case-actions/merge-a-case.md): Merge related Cortex XSIAM cases to consolidate investigations, teams, and response efforts. - [Assign a case team and restrict access](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/detect-investigate-and-respond-to-threats/investigation-and-response/analyze-and-resolve-cases/additional-case-actions/assign-a-case-team-and-restrict-access.md): Assign case teams and restrict access to sensitive investigations in Cortex XSIAM. - [Playbook examples](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/detect-investigate-and-respond-to-threats/investigation-and-response/analyze-and-resolve-cases/additional-case-actions/assign-a-case-team-and-restrict-access/playbook-examples.md): See playbook example for assigning case teams and restricting access to cases in Cortex XSIAM. - [Unified case view](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/detect-investigate-and-respond-to-threats/investigation-and-response/analyze-and-resolve-cases/additional-case-actions/unified-case-view.md): Use Cortex XSIAM Unified Case View to manage cases across child tenants. - [Investigate issues](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/detect-investigate-and-respond-to-threats/investigation-and-response/investigate-issues.md): Cortex XSIAM generates issues to bring your attention to security risks in your framework. - [Overview of the Issues page](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/detect-investigate-and-respond-to-threats/investigation-and-response/investigate-issues/overview-of-the-issues-page.md): Review and prioritize Cortex XSIAM issues from the Issues page. - [Issue card](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/detect-investigate-and-respond-to-threats/investigation-and-response/investigate-issues/issue-card.md): Use the issue card to investigate and respond to issues in Cortex XSIAM. - [Resolution actions](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/detect-investigate-and-respond-to-threats/investigation-and-response/investigate-issues/resolution-actions.md): Use the Resolution tab to see all resolution actions to remediate and close issues in Cortex XSIAM. - [Link or unlink issues from a case](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/detect-investigate-and-respond-to-threats/investigation-and-response/investigate-issues/link-or-unlink-issues-from-a-case.md): You can link or unlink issues from cases in Cortex XSIAM. - [Run an automation on an issue](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/detect-investigate-and-respond-to-threats/investigation-and-response/investigate-issues/run-an-automation-on-an-issue.md): Run automations on issues to accelerate investigation and remediation in Cortex XSIAM. - [Use the War Room in an investigation](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/detect-investigate-and-respond-to-threats/investigation-and-response/investigate-issues/use-the-war-room-in-an-investigation.md): Use the Cortex XSIAM War Room to investigate issues and run response actions. - [Use the Work Plan in an investigation](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/detect-investigate-and-respond-to-threats/investigation-and-response/investigate-issues/use-the-work-plan-in-an-investigation.md): Use the Cortex XSIAM Work Plan to manage issue playbook tasks. - [Issue syncing](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/detect-investigate-and-respond-to-threats/investigation-and-response/investigate-issues/issue-syncing.md): Sync Cortex XSIAM issues with external tickets to coordinate remediation. - [Issue deduplication](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/detect-investigate-and-respond-to-threats/investigation-and-response/investigate-issues/issue-deduplication.md): Cortex XSIAM uses issue deduplication to reduce duplicate security events. - [Causality view](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/detect-investigate-and-respond-to-threats/investigation-and-response/investigate-issues/causality-view.md): Investigate event chains behind issues in Cortex XSIAM with the causality view. - [Network causality view](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/detect-investigate-and-respond-to-threats/investigation-and-response/investigate-issues/causality-view/network-causality-view.md): Investigate connected endpoint and firewall events in Cortex XSIAM with the network causality view. - [Cloud causality view](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/detect-investigate-and-respond-to-threats/investigation-and-response/investigate-issues/causality-view/cloud-causality-view.md): Investigate cloud identities and resources in Cortex XSIAM with the cloud causality view. - [Cloud causality view for audit log issues](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/detect-investigate-and-respond-to-threats/investigation-and-response/investigate-issues/causality-view/cloud-causality-view-for-audit-log-issues.md): Investigate cloud audit log issues in Cortex XSIAM with the cloud causality view. - [SaaS causality view](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/detect-investigate-and-respond-to-threats/investigation-and-response/investigate-issues/causality-view/saas-causality-view.md): Investigate SaaS-related issues in Cortex XSIAM with the SaaS causality view.. - [Timeline](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/detect-investigate-and-respond-to-threats/investigation-and-response/investigate-issues/causality-view/timeline.md): Use the Cortex XSIAM timeline to trace events and issues during an attack. - [Causality icons key](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/detect-investigate-and-respond-to-threats/investigation-and-response/investigate-issues/causality-view/causality-icons-key.md): Use the causality icons key to interpret investigation data in causality chains in Cortex XSIAM. - [Issue investigation actions](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/detect-investigate-and-respond-to-threats/investigation-and-response/investigate-issues/issue-investigation-actions.md): Use issue actions to investigate, enrich, and remediate issues in Cortex XSIAM. - [Copy issues](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/detect-investigate-and-respond-to-threats/investigation-and-response/investigate-issues/issue-investigation-actions/copy-issues.md): Copy issue details, rows, or URLs for sharing and analysis in Cortex XSIAM. - [Analyze an issue](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/detect-investigate-and-respond-to-threats/investigation-and-response/investigate-issues/issue-investigation-actions/analyze-an-issue.md): Analyze Cortex XSIAM issues using issue cards and causality views. - [Update issue fields](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/detect-investigate-and-respond-to-threats/investigation-and-response/investigate-issues/issue-investigation-actions/update-issue-fields.md): Use CLI commands to update issue fields and statuses through commands, scripts, or playbooks in Cortex XSIAM. - [Query case and issue data](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/detect-investigate-and-respond-to-threats/investigation-and-response/investigate-issues/issue-investigation-actions/query-case-and-issue-data.md): Query case and issue data with Cortex Query Language in Cortex XSIAM. - [Exclude an issue](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/detect-investigate-and-respond-to-threats/investigation-and-response/investigate-issues/issue-investigation-actions/exclude-an-issue.md): Exclude Cortex XSIAM issues that do not indicate a security threat. - [Create a featured field](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/detect-investigate-and-respond-to-threats/investigation-and-response/investigate-issues/issue-investigation-actions/create-a-featured-field.md): Create featured fields to highlight important issue attributes in Cortex XSIAM. - [Export issue details to a file](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/detect-investigate-and-respond-to-threats/investigation-and-response/investigate-issues/issue-investigation-actions/export-issue-details-to-a-file.md): Export Cortex XSIAM issue details to a TSV file for offline analysis. - [Investigate contributing events](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/detect-investigate-and-respond-to-threats/investigation-and-response/investigate-issues/issue-investigation-actions/investigate-contributing-events.md): Investigate correlation rule events in Cortex XSIAM that contributed to an issue. - [Retrieve additional issue details](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/detect-investigate-and-respond-to-threats/investigation-and-response/investigate-issues/issue-investigation-actions/retrieve-additional-issue-details.md): Retrieve Cortex XSIAM issue data, related files, and packet captures for analysis. - [View generating BIOC or IOC rule](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/detect-investigate-and-respond-to-threats/investigation-and-response/investigate-issues/issue-investigation-actions/view-generating-bioc-or-ioc-rule.md): View the BIOC or IOC rule that generated a Cortex XSIAM issue. - [Create profile exceptions](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/detect-investigate-and-respond-to-threats/investigation-and-response/investigate-issues/issue-investigation-actions/create-profile-exceptions.md): Create profile exceptions in Cortex XSIAM for relevant XDR agent issues. - [Add a file path to a malware profile allow list](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/detect-investigate-and-respond-to-threats/investigation-and-response/investigate-issues/issue-investigation-actions/add-a-file-path-to-a-malware-profile-allow-list.md): Add safe file paths to Cortex XSIAM malware profile allow lists. - [Close an issue](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/detect-investigate-and-respond-to-threats/investigation-and-response/investigate-issues/issue-investigation-actions/close-an-issue.md): Close Cortex XSIAM issues after completing investigation and remediation. - [Review findings](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/detect-investigate-and-respond-to-threats/investigation-and-response/review-findings.md): Review findings for an asset to gain insights into an asset’s posture status in Cortex XSIAM. - [Findings card](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/detect-investigate-and-respond-to-threats/investigation-and-response/review-findings/findings-card.md): View selected finding details and investigation context in Cortex XSIAM. - [Investigate artifacts and assets](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/detect-investigate-and-respond-to-threats/investigation-and-response/investigate-artifacts-and-assets.md): Investigate IP addresses, assets, hosts, users, and file hashes in Cortex XSIAM. - [Investigate an IP address](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/detect-investigate-and-respond-to-threats/investigation-and-response/investigate-artifacts-and-assets/investigate-an-ip-address.md): Investigate IP address activity, threat intelligence, and related cases in Cortex XSIAM. - [Investigate an asset](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/detect-investigate-and-respond-to-threats/investigation-and-response/investigate-artifacts-and-assets/investigate-an-asset.md): Investigate the assets associated with an issue in Cortex XSIAM. - [Investigate a host](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/detect-investigate-and-respond-to-threats/investigation-and-response/investigate-artifacts-and-assets/investigate-a-host.md): Investigate host activity, risk scores, and related issues in Cortex XSIAM. - [Investigate a file and process hash](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/detect-investigate-and-respond-to-threats/investigation-and-response/investigate-artifacts-and-assets/investigate-a-file-and-process-hash.md): Investigate SHA256 file and process hashes in Cortex XSIAM. - [Investigate a user](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/detect-investigate-and-respond-to-threats/investigation-and-response/investigate-artifacts-and-assets/investigate-a-user.md): Investigate user activity, risk scores, and identity insights in Cortex XSIAM. - [Investigate endpoints](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/detect-investigate-and-respond-to-threats/investigation-and-response/investigate-endpoints.md): Investigate and take actions on your endpoints in the Cortex XSIAM Action Center. - [Overview of the Action Center](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/detect-investigate-and-respond-to-threats/investigation-and-response/investigate-endpoints/overview-of-the-action-center.md): Track investigation, response, and maintenance actions on protected endpoints in the Cortex XSIAM Action Center. - [Initiate and monitor endpoint actions](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/detect-investigate-and-respond-to-threats/investigation-and-response/investigate-endpoints/overview-of-the-action-center/initiate-and-monitor-endpoint-actions.md): Initiate endpoint actions and monitor their progress in Cortex XSIAM. - [Action Center reference information](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/detect-investigate-and-respond-to-threats/investigation-and-response/investigate-endpoints/overview-of-the-action-center/action-center-reference-information.md): Review Cortex XSIAM Action Center fields, statuses, and action details. - [Manage endpoints](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/detect-investigate-and-respond-to-threats/investigation-and-response/investigate-endpoints/manage-endpoints.md): View, manage, and take actions on endpoints in Cortex XSIAM. - [Retrieve files from an endpoint](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/detect-investigate-and-respond-to-threats/investigation-and-response/investigate-endpoints/retrieve-files-from-an-endpoint.md): Retrieve investigation files from endpoints and download them in Cortex XSIAM. - [Retrieve support logs from an endpoint](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/detect-investigate-and-respond-to-threats/investigation-and-response/investigate-endpoints/retrieve-support-logs-from-an-endpoint.md): Retrieve endpoint support logs and forensic data through Cortex XSIAM. - [Retrieve support file password](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/detect-investigate-and-respond-to-threats/investigation-and-response/investigate-endpoints/retrieve-support-file-password.md): Retrieve the password needed to decrypt Cortex XSIAM endpoint support files. - [Scan an endpoint for malware](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/detect-investigate-and-respond-to-threats/investigation-and-response/investigate-endpoints/scan-an-endpoint-for-malware.md): Run and monitor on-demand malware scans on endpoints with Cortex XSIAM. - [Investigate files](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/detect-investigate-and-respond-to-threats/investigation-and-response/investigate-files.md): Investigate files, manage execution, and review analysis results in Cortex XSIAM. - [Manage file execution](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/detect-investigate-and-respond-to-threats/investigation-and-response/investigate-files/manage-file-execution.md): Manage allow and block lists for endpoint file execution in Cortex XSIAM. - [Manage quarantined files](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/detect-investigate-and-respond-to-threats/investigation-and-response/investigate-files/manage-quarantined-files.md): View, restore, and delete quarantined endpoint files in Cortex XSIAM. - [Review WildFire analysis details](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/detect-investigate-and-respond-to-threats/investigation-and-response/investigate-files/review-wildfire-analysis-details.md): Review WildFire verdicts and file analysis reports in Cortex XSIAM. - [Import file hash exceptions](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/detect-investigate-and-respond-to-threats/investigation-and-response/investigate-files/import-file-hash-exceptions.md): Import file hash exceptions into allow and block lists in Cortex XSIAM. - [Cortex Assistant](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/detect-investigate-and-respond-to-threats/investigation-and-response/cortex-assistant.md): Use Cortex Assistant in Cortex XSIAM to triage, investigate, and remediate security cases. - [Cortex Assistant layout](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/detect-investigate-and-respond-to-threats/investigation-and-response/cortex-assistant/cortex-assistant-layout.md): Navigate the Cortex Assistant layout to investigate security data in Cortex XSIAM. - [Cortex Assistant capabilities](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/detect-investigate-and-respond-to-threats/investigation-and-response/cortex-assistant/cortex-assistant-capabilities.md): Use Cortex Assistant capabilities to investigate and respond to threats in Cortex XSIAM. - [Response actions](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/detect-investigate-and-respond-to-threats/investigation-and-response/response-actions.md): Use Cortex XSIAM response actions to contain threats and remediate affected endpoints. - [Initiate a Live Terminal session](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/detect-investigate-and-respond-to-threats/investigation-and-response/response-actions/initiate-a-live-terminal-session.md): Start a Live Terminal session to investigate and manage remote endpoints in Cortex XSIAM. - [Isolate an endpoint](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/detect-investigate-and-respond-to-threats/investigation-and-response/response-actions/isolate-an-endpoint.md): Isolate compromised endpoints to contain threats and protect your network with Cortex XSIAM. - [Pause endpoint protection](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/detect-investigate-and-respond-to-threats/investigation-and-response/response-actions/pause-endpoint-protection.md): Temporarily pause Cortex XSIAM endpoint protection for approved troubleshooting or maintenance tasks. - [Run agent scripts on an endpoint](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/detect-investigate-and-respond-to-threats/investigation-and-response/response-actions/run-agent-scripts-on-an-endpoint.md): Run agent scripts to investigate, manage, and remediate endpoints from Cortex XSIAM. - [Remediate changes from malicious activity](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/detect-investigate-and-respond-to-threats/investigation-and-response/response-actions/remediate-changes-from-malicious-activity.md): Use Cortex XSIAM to remediate endpoint changes caused by malicious activity. - [Search and destroy malicious files](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/detect-investigate-and-respond-to-threats/investigation-and-response/response-actions/search-and-destroy-malicious-files.md): Use Cortex XSIAM to find and remove malicious files across managed endpoints. - [Manage external dynamic lists](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/detect-investigate-and-respond-to-threats/investigation-and-response/response-actions/manage-external-dynamic-lists.md): Manage external dynamic lists to share indicators with network security products with Cortex XSIAM. - [Collect a memory image](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/detect-investigate-and-respond-to-threats/investigation-and-response/response-actions/collect-a-memory-image.md): Collect endpoint memory images in Cortex XSIAM for forensic investigation and analysis. - [Forensics](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/detect-investigate-and-respond-to-threats/investigation-and-response/forensics.md): Use the Cortex XSIAM Forensics add-on to collect, analyze, and document endpoint evidence. - [Forensic investigations](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/detect-investigate-and-respond-to-threats/investigation-and-response/forensics/forensic-investigations.md): Use Cortex XSIAM forensic investigations to organize endpoint hunt and triage collections. - [Manage an investigation](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/detect-investigate-and-respond-to-threats/investigation-and-response/forensics/manage-an-investigation.md): Manage Cortex XSIAM forensic investigations, collections, alerts, evidence, exports, and access controls. - [Create a new investigation](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/detect-investigate-and-respond-to-threats/investigation-and-response/forensics/manage-an-investigation/create-a-new-investigation.md): Create forensic investigations to organize collections, evidence, alerts, and user access with Cortex XSIAM. - [Edit an investigation](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/detect-investigate-and-respond-to-threats/investigation-and-response/forensics/manage-an-investigation/edit-an-investigation.md): Update a Cortex XSIAM forensic investigation's name, description, and user permissions. - [Close an investigation](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/detect-investigate-and-respond-to-threats/investigation-and-response/forensics/manage-an-investigation/close-an-investigation.md): Close, reopen, or permanently delete Cortex XSIAM forensic investigations and their collections. - [User permissions](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/detect-investigate-and-respond-to-threats/investigation-and-response/forensics/manage-an-investigation/user-permissions.md): Control access to Cortex XSIAM forensic investigations with RBAC and scope-based permissions. - [Data collection](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/detect-investigate-and-respond-to-threats/investigation-and-response/forensics/data-collection.md): Collect endpoint forensic evidence in Cortex XSIAM through hunt and triage collections. - [Hunting](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/detect-investigate-and-respond-to-threats/investigation-and-response/forensics/data-collection/hunting.md): Use Cortex XSIAM hunt collections to search for targeted activity across many endpoints. - [Create a hunt](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/detect-investigate-and-respond-to-threats/investigation-and-response/forensics/data-collection/hunting/create-a-hunt.md): Create Cortex XSIAM hunt collections for scheduled or one-time endpoint artifact searches. - [Hunt results](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/detect-investigate-and-respond-to-threats/investigation-and-response/forensics/data-collection/hunting/hunt-results.md): Analyze Cortex XSIAM hunt results across collected endpoint forensic artifacts. - [Hunt status](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/detect-investigate-and-respond-to-threats/investigation-and-response/forensics/data-collection/hunting/hunt-status.md): Monitor Cortex XSIAM hunt searches and results across targeted endpoints. - [Triage](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/detect-investigate-and-respond-to-threats/investigation-and-response/forensics/data-collection/triage.md): Use Cortex XSIAM triage collections for in-depth forensic analysis of specific endpoints. - [Create a triage](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/detect-investigate-and-respond-to-threats/investigation-and-response/forensics/data-collection/triage/create-a-triage.md): Create Cortex XSIAM triage collections for detailed online and offline endpoint evidence gathering. - [Upload an offline triage package](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/detect-investigate-and-respond-to-threats/investigation-and-response/forensics/data-collection/triage/upload-an-offline-triage-package.md): Upload offline triage packages to Cortex XSIAM for forensic data ingestion and analysis. - [Offline triage collection](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/detect-investigate-and-respond-to-threats/investigation-and-response/forensics/data-collection/triage/offline-triage-collection.md): Collect Cortex XSIAM forensic evidence from offline endpoints without an installed agent. - [Triage results](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/detect-investigate-and-respond-to-threats/investigation-and-response/forensics/data-collection/triage/triage-results.md): Review Cortex XSIAM triage alerts, artifacts, and endpoint forensic timelines. - [Triage status](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/detect-investigate-and-respond-to-threats/investigation-and-response/forensics/data-collection/triage/triage-status.md): Track Cortex XSIAM triage collection and ingestion status for endpoint artifacts. - [Configure collection](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/detect-investigate-and-respond-to-threats/investigation-and-response/forensics/data-collection/configure-collection.md): Configure Cortex XSIAM hunt and triage artifact collection criteria and filters. - [Analysis and documentation](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/detect-investigate-and-respond-to-threats/investigation-and-response/forensics/analysis-and-documentation.md): Analyze Cortex XSIAM forensic evidence through issues, timelines, and key assets. - [Export](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/detect-investigate-and-respond-to-threats/investigation-and-response/forensics/export.md): Export Cortex XSIAM forensic collection data for retention or offline analysis. - [Notebooks](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/detect-investigate-and-respond-to-threats/investigation-and-response/notebooks.md): Leverage the data collected by Cortex XSIAM using Jupyter Notebooks' data analysis and visualization capabilities within your existing security infrastructure. - [Manage datasets in Notebooks](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/detect-investigate-and-respond-to-threats/investigation-and-response/notebooks/manage-datasets-in-notebooks.md): Create and manage Cortex XSIAM Notebook datasets for queries, rules, and access control. - [Notebooks scheduler](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/detect-investigate-and-respond-to-threats/investigation-and-response/notebooks/notebooks-scheduler.md): Schedule Cortex XSIAM Notebook jobs to automate recurring data enrichment. - [Build XQL queries](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/detect-investigate-and-respond-to-threats/investigation-and-response/build-xql-queries.md): Build XQL queries with Query Builder for investigation and analysis in Cortex XSIAM. - [About the Query Builder](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/detect-investigate-and-respond-to-threats/investigation-and-response/build-xql-queries/about-the-query-builder.md): Understand how Query Builder supports XQL queries and data analysis in Cortex XSIAM. - [How to build XQL queries](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/detect-investigate-and-respond-to-threats/investigation-and-response/build-xql-queries/how-to-build-xql-queries.md): Build XQL queries using Query Builder tools and workflows in Cortex XSIAM. - [Get started with XQL queries](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/detect-investigate-and-respond-to-threats/investigation-and-response/build-xql-queries/how-to-build-xql-queries/get-started-with-xql-queries.md): Get started building XQL queries in Query Builder with Cortex XSIAM. - [Useful XQL user interface features](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/detect-investigate-and-respond-to-threats/investigation-and-response/build-xql-queries/how-to-build-xql-queries/useful-xql-user-interface-features.md): Query Builder features help you to create and refine XQL queries in Cortex XSIAM. - [XQL Query best practices](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/detect-investigate-and-respond-to-threats/investigation-and-response/build-xql-queries/how-to-build-xql-queries/xql-query-best-practices.md): Review XQL query best practices for efficient, accurate results when creating queries in Cortex XSIAM. - [Expected results when querying fields](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/detect-investigate-and-respond-to-threats/investigation-and-response/build-xql-queries/how-to-build-xql-queries/expected-results-when-querying-fields.md): Understand expected field values and results in Cortex XSIAM XQL queries. - [Create XQL query](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/detect-investigate-and-respond-to-threats/investigation-and-response/build-xql-queries/how-to-build-xql-queries/create-xql-query.md): Create and run XQL queries with Query Builder in Cortex XSIAM. - [Review XQL query results](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/detect-investigate-and-respond-to-threats/investigation-and-response/build-xql-queries/how-to-build-xql-queries/review-xql-query-results.md): Review and analyze XQL query results in the Cortex XSIAM Query Builder. - [Translate to XQL](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/detect-investigate-and-respond-to-threats/investigation-and-response/build-xql-queries/how-to-build-xql-queries/translate-to-xql.md): Translate searches and query logic into XQL with Cortex XSIAM . - [Graph query results](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/detect-investigate-and-respond-to-threats/investigation-and-response/build-xql-queries/how-to-build-xql-queries/graph-query-results.md): Visualize XQL query results as graphs for faster analysis with Cortex XSIAM. - [Query Builder templates](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/detect-investigate-and-respond-to-threats/investigation-and-response/build-xql-queries/query-builder-templates.md): Use Cortex XSIAM Query Builder templates to query datasets without writing XQL. - [Get started with Query Builder templates](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/detect-investigate-and-respond-to-threats/investigation-and-response/build-xql-queries/query-builder-templates/get-started-with-query-builder-templates.md): Get started with Cortex XSIAM Query Builder templates for guided data queries. - [Considerations for using Query Builder templates](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/detect-investigate-and-respond-to-threats/investigation-and-response/build-xql-queries/query-builder-templates/considerations-for-using-query-builder-templates.md): Review Cortex XSIAM Query Builder template requirements and limitations. - [Create a query from a template](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/detect-investigate-and-respond-to-threats/investigation-and-response/build-xql-queries/query-builder-templates/create-a-query-from-a-template.md): Create data queries from Query Builder templates in Cortex XSIAM. - [Run a free text query](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/detect-investigate-and-respond-to-threats/investigation-and-response/build-xql-queries/query-builder-templates/run-a-free-text-query.md): Run free-text queries with Query Builder templates in Cortex XSIAM. - [Query Builder template examples](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/detect-investigate-and-respond-to-threats/investigation-and-response/build-xql-queries/query-builder-templates/query-builder-template-examples.md): Explore Cortex XSIAM Query Builder template examples for common data queries. - [Overview of the Query Center](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/detect-investigate-and-respond-to-threats/investigation-and-response/build-xql-queries/overview-of-the-query-center.md): Monitor in-progress and completed Cortex XSIAM queries in Query Center. - [Edit and run queries in Query Center](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/detect-investigate-and-respond-to-threats/investigation-and-response/build-xql-queries/overview-of-the-query-center/edit-and-run-queries-in-query-center.md): Edit and run Cortex XSIAM queries from Query Center. - [Query Center reference information](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/detect-investigate-and-respond-to-threats/investigation-and-response/build-xql-queries/overview-of-the-query-center/query-center-reference-information.md): Reference Cortex XSIAM Query Center fields, statuses, and query details. - [Manage scheduled queries](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/detect-investigate-and-respond-to-threats/investigation-and-response/build-xql-queries/manage-scheduled-queries.md): Create and manage scheduled queries for recurring analysis in Cortex XSIAM. - [Scheduled Queries reference information](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/detect-investigate-and-respond-to-threats/investigation-and-response/build-xql-queries/manage-scheduled-queries/scheduled-queries-reference-information.md): Review scheduled query settings, statuses, and run details in Cortex XSIAM . - [Manage your personal query library](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/detect-investigate-and-respond-to-threats/investigation-and-response/build-xql-queries/manage-your-personal-query-library.md): The Query Library is a personal library for saving and managing your queries in Cortex XSIAM. - [XQL macros](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/detect-investigate-and-respond-to-threats/investigation-and-response/build-xql-queries/xql-macros.md): Use XQL macros to reuse query logic and simplify searches in Cortex XSIAM. - [Manage your macros](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/detect-investigate-and-respond-to-threats/investigation-and-response/build-xql-queries/manage-your-macros.md): Create and manage XQL macros for reusable query logic in Cortex XSIAM. - [Federated Search](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/detect-investigate-and-respond-to-threats/investigation-and-response/build-xql-queries/federated-search.md): Use Federated Search to query supported external data sources in Cortex XSIAM. - [Federated Search configuration](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/detect-investigate-and-respond-to-threats/investigation-and-response/build-xql-queries/federated-search/federated-search-configuration.md): Configure Cortex XSIAM Federated Search connections for external data sources. - [Query using Federated Search](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/detect-investigate-and-respond-to-threats/investigation-and-response/build-xql-queries/federated-search/query-using-federated-search.md): Query external data sources with Federated Search in Cortex XSIAM. - [Manage external datasets](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/detect-investigate-and-respond-to-threats/investigation-and-response/build-xql-queries/federated-search/manage-external-datasets.md): Manage external datasets used by Federated Search in Cortex XSIAM. - [Legacy Query Builder](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/detect-investigate-and-respond-to-threats/investigation-and-response/build-xql-queries/legacy-query-builder.md): Use the Cortex XSIAM Legacy Query Builder to query security data entities. - [Create authentication query](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/detect-investigate-and-respond-to-threats/investigation-and-response/build-xql-queries/legacy-query-builder/create-authentication-query.md): Create legacy authentication queries to investigate login activity in Cortex XSIAM. - [Create event log query](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/detect-investigate-and-respond-to-threats/investigation-and-response/build-xql-queries/legacy-query-builder/create-event-log-query.md): Create legacy event log queries to investigate system activity in Cortex XSIAM. - [Create file query](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/detect-investigate-and-respond-to-threats/investigation-and-response/build-xql-queries/legacy-query-builder/create-file-query.md): Create legacy file queries to investigate file activity in Cortex XSIAM. - [Create image load query](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/detect-investigate-and-respond-to-threats/investigation-and-response/build-xql-queries/legacy-query-builder/create-image-load-query.md): Create legacy image load queries to investigate loaded modules in Cortex XSIAM. - [Create network connections query](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/detect-investigate-and-respond-to-threats/investigation-and-response/build-xql-queries/legacy-query-builder/create-network-connections-query.md): Create legacy network connection queries to investigate endpoint traffic in Cortex XSIAM. - [Create network query](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/detect-investigate-and-respond-to-threats/investigation-and-response/build-xql-queries/legacy-query-builder/create-network-query.md): Create legacy network queries to investigate network activity in Cortex XSIAM. - [Create process query](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/detect-investigate-and-respond-to-threats/investigation-and-response/build-xql-queries/legacy-query-builder/create-process-query.md): Create legacy process queries to investigate process activity in Cortex XSIAM. - [Create registry query](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/detect-investigate-and-respond-to-threats/investigation-and-response/build-xql-queries/legacy-query-builder/create-registry-query.md): Create legacy registry queries to investigate registry activity in Cortex XSIAM. - [Query across all entities](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/detect-investigate-and-respond-to-threats/investigation-and-response/build-xql-queries/legacy-query-builder/query-across-all-entities.md): Create legacy queries across all supported security data entities in Cortex XSIAM. - [Research a known threat](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/detect-investigate-and-respond-to-threats/investigation-and-response/research-a-known-threat.md): Cortex XSIAM enables you to investigate any threat, also referred to as a lead, which has been detected. - [Agentic Assistant chat](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/detect-investigate-and-respond-to-threats/agentic-assistant-chat.md): Chat with the Cortex Agentic Assistant in Cortex XSIAM using natural language prompts. - [Get started with Agentic Assistant chat](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/detect-investigate-and-respond-to-threats/agentic-assistant-chat/get-started-with-agentic-assistant-chat.md): Enable Agentic Assistant and access the chat interface in Cortex XSIAM. - [Choose an Agentic Assistant agent](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/detect-investigate-and-respond-to-threats/agentic-assistant-chat/choose-an-agentic-assistant-agent.md): Choose a system or custom agent for your chat in Cortex XSIAM. - [Chat with an Agentic Assistant agent](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/detect-investigate-and-respond-to-threats/agentic-assistant-chat/chat-with-an-agentic-assistant-agent.md): Tips for chatting with the Cortex Agentic Assistant in Cortex XSIAM. - [Chat with the Agentic Assistant from Slack](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/detect-investigate-and-respond-to-threats/agentic-assistant-chat/chat-with-the-agentic-assistant-from-slack.md): Enable chatting in Cortex XSIAM with an Agentic Assistant agent from Slack. - [Streamline troubleshooting and support with the Help Center agent](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/detect-investigate-and-respond-to-threats/agentic-assistant-chat/streamline-troubleshooting-and-support-with-the-help-center-agent.md) - [Help Center agent actions](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/detect-investigate-and-respond-to-threats/agentic-assistant-chat/streamline-troubleshooting-and-support-with-the-help-center-agent/help-center-agent-actions.md) - [Create and run XQL queries with Agentic Assistant chat](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/detect-investigate-and-respond-to-threats/agentic-assistant-chat/create-and-run-xql-queries-with-agentic-assistant-chat.md): Interact with Cortex Agentic Assistant agents to build and run XQL queries in Cortex XSIAM. - [Use natural language to query and visualize your data](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/detect-investigate-and-respond-to-threats/agentic-assistant-chat/use-natural-language-to-query-and-visualize-your-data.md): Prompt Cortex Agentic Assistant agents to create graphs and charts from its findings in Cortex XSIAM. - [Manage chat history](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/detect-investigate-and-respond-to-threats/agentic-assistant-chat/manage-chat-history.md): Manage and navigate your past chats with the Cortex Agentic Assistant in Cortex XSIAM. - [Asset management](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/detect-investigate-and-respond-to-threats/asset-management.md): Manage assets, inventory, groups, configurations, and risk scores in Cortex XSIAM. - [Asset inventory overview](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/detect-investigate-and-respond-to-threats/asset-management/asset-inventory-overview.md): Learn asset inventory concepts, features, and lifecycles in Cortex XSIAM. - [All assets](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/detect-investigate-and-respond-to-threats/asset-management/all-assets.md): View and manage all discovered assets in Cortex XSIAM Asset Inventory. - [All cloud assets](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/detect-investigate-and-respond-to-threats/asset-management/all-cloud-assets.md): View and assess cloud assets and your cloud footprint in Cortex XSIAM. - [Discovery Engine](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/detect-investigate-and-respond-to-threats/asset-management/all-cloud-assets/discovery-engine.md): Learn how Cortex XSIAM Discovery Engine identifies and discovers cloud assets. - [Asset hierarchy](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/detect-investigate-and-respond-to-threats/asset-management/all-cloud-assets/asset-hierarchy.md): Explore asset relationships and hierarchy views in Cortex XSIAM. - [Asset classes](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/detect-investigate-and-respond-to-threats/asset-management/asset-classes.md): Explore Cortex XSIAM asset classes and the resources each class represents. - [AI assets](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/detect-investigate-and-respond-to-threats/asset-management/asset-classes/ai-assets.md): View and investigate AI assets in Cortex XSIAM. - [API assets](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/detect-investigate-and-respond-to-threats/asset-management/asset-classes/api-assets.md): View and investigate API assets in Cortex XSIAM. - [Application assets](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/detect-investigate-and-respond-to-threats/asset-management/asset-classes/application-assets.md): View and investigate application assets in Cortex XSIAM. - [Code and Supply Chain Security assets](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/detect-investigate-and-respond-to-threats/asset-management/asset-classes/code-and-ci-cd-assets.md): View code and supply chain security assets in Cortex XSIAM. - [IaC resources assets](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/detect-investigate-and-respond-to-threats/asset-management/asset-classes/code-and-ci-cd-assets/iac-resources-assets.md): View infrastructure-as-code resource assets in Cortex XSIAM. - [Repository assets](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/detect-investigate-and-respond-to-threats/asset-management/asset-classes/code-and-ci-cd-assets/repository-assets.md): View repository assets in Cortex XSIAM. - [VCS organization assets](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/detect-investigate-and-respond-to-threats/asset-management/asset-classes/code-and-ci-cd-assets/vcs-organization-assets.md): View VCS organization assets in Cortex XSIAM. - [CI/CD pipeline assets](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/detect-investigate-and-respond-to-threats/asset-management/asset-classes/code-and-ci-cd-assets/ci-cd-pipeline-assets.md): View CI/CD pipeline assets in Cortex XSIAM. - [CI/CD instances assets](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/detect-investigate-and-respond-to-threats/asset-management/asset-classes/code-and-ci-cd-assets/ci-cd-instances-assets.md): View CI/CD instance assets in Cortex XSIAM. - [Software package assets](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/detect-investigate-and-respond-to-threats/asset-management/asset-classes/code-and-ci-cd-assets/software-package-assets.md): View software package assets in Cortex XSIAM. - [Compute assets](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/detect-investigate-and-respond-to-threats/asset-management/asset-classes/compute-assets.md): View compute assets across your environment in Cortex XSIAM. - [Container image assets](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/detect-investigate-and-respond-to-threats/asset-management/asset-classes/compute-assets/container-image-assets.md): View and investigate container image assets in Cortex XSIAM. - [Serverless functions assets](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/detect-investigate-and-respond-to-threats/asset-management/asset-classes/compute-assets/serverless-functions-assets.md): View and investigate serverless function assets in Cortex XSIAM. - [VM images assets](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/detect-investigate-and-respond-to-threats/asset-management/asset-classes/compute-assets/vm-images-assets.md): View and investigate virtual machine image assets in Cortex XSIAM. - [Data assets](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/detect-investigate-and-respond-to-threats/asset-management/asset-classes/data-assets.md): View and investigate data assets in Cortex XSIAM. - [Device assets](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/detect-investigate-and-respond-to-threats/asset-management/asset-classes/device-assets.md): View and investigate device assets in Cortex XSIAM. - [External Surface assets](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/detect-investigate-and-respond-to-threats/asset-management/asset-classes/external-surface-assets.md): View external surface assets discovered by Cortex XSIAM. - [Website assets](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/detect-investigate-and-respond-to-threats/asset-management/asset-classes/external-surface-assets/website-assets.md): View and investigate website assets in Cortex XSIAM. - [Service assets](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/detect-investigate-and-respond-to-threats/asset-management/asset-classes/external-surface-assets/service-assets.md): View and investigate service assets in Cortex XSIAM. - [Domain assets](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/detect-investigate-and-respond-to-threats/asset-management/asset-classes/external-surface-assets/domain-assets.md): View and investigate domain assets in Cortex XSIAM. - [Certificate assets](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/detect-investigate-and-respond-to-threats/asset-management/asset-classes/external-surface-assets/certificate-assets.md): View and investigate certificate assets in Cortex XSIAM. - [External Surface attribution evidence](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/detect-investigate-and-respond-to-threats/asset-management/asset-classes/external-surface-assets/external-surface-attribution-evidence.md): Review external surface attribution evidence in Cortex XSIAM. - [Identity assets](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/detect-investigate-and-respond-to-threats/asset-management/asset-classes/identity-assets.md): View and investigate identity assets in Cortex XSIAM. - [Network assets](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/detect-investigate-and-respond-to-threats/asset-management/asset-classes/network-assets.md): View and investigate network assets in Cortex XSIAM. - [Security services assets](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/detect-investigate-and-respond-to-threats/asset-management/asset-classes/security-services-assets.md): View managed security service assets in Cortex XSIAM. - [Asset groups](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/detect-investigate-and-respond-to-threats/asset-management/asset-groups.md): Create and manage asset groups in Cortex XSIAM for filtering and access control. - [Manage Risk Scores](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/detect-investigate-and-respond-to-threats/asset-management/manage-asset-scores.md): View and investigate user and host risk scores in Cortex XSIAM. - [Asset configurations](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/detect-investigate-and-respond-to-threats/asset-management/asset-configurations.md): Configure networks, application criteria, and asset roles in Cortex XSIAM. - [Network configurations](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/detect-investigate-and-respond-to-threats/asset-management/asset-configurations/network-configuration.md): Configure your internal network parameters, trusted networks, and external IP ranges to help Cortex XSIAM identify and map your network assets. - [Application criteria](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/detect-investigate-and-respond-to-threats/asset-management/asset-configurations/application-criteria.md): Configure application criteria for asset management in Cortex XSIAM. - [Asset Roles](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/detect-investigate-and-respond-to-threats/asset-management/asset-configurations/asset-roles.md): View and manage user and endpoint asset roles in Cortex XSIAM. - [Manage Asset Roles for Endpoints](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/detect-investigate-and-respond-to-threats/asset-management/asset-configurations/asset-roles/manage-asset-roles-for-endpoints.md): Manage endpoint asset roles in Cortex XSIAM. - [Manage Asset Roles for Users](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/detect-investigate-and-respond-to-threats/asset-management/asset-configurations/asset-roles/manage-asset-roles-for-users.md): Manage user asset roles in Cortex XSIAM. - [Honey user](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/detect-investigate-and-respond-to-threats/asset-management/asset-configurations/asset-roles/manage-asset-roles-for-users/honey-user.md): Configure and manage honey users in Cortex XSIAM. - [Vulnerability Assessment](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/detect-investigate-and-respond-to-threats/asset-management/vulnerability-assessment.md): Assess asset vulnerabilities and associated risk in Cortex XSIAM. - [Query the asset inventory via XQL](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/detect-investigate-and-respond-to-threats/asset-management/query-the-asset-inventory-via-xql.md): Query asset inventory data with XQL in Cortex XSIAM. - [Threat management](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/detect-investigate-and-respond-to-threats/threat-management.md) - [Detection rules](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/detect-investigate-and-respond-to-threats/threat-management/detection-rules.md): Learn how Cortex XSIAM detection rules identify threats using IOC, BIOC, and correlation logic. - [What are detection rules?](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/detect-investigate-and-respond-to-threats/threat-management/detection-rules/what-are-detection-rules.md): Explore Cortex XSIAM IOC, BIOC, and correlation rules for detecting threats and generating issues. - [What's an IOC?](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/detect-investigate-and-respond-to-threats/threat-management/detection-rules/what-are-detection-rules/whats-an-ioc.md): Learn how Cortex XSIAM IOC rules detect known malicious or suspicious artifacts. - [IOC rule details](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/detect-investigate-and-respond-to-threats/threat-management/detection-rules/what-are-detection-rules/whats-an-ioc/ioc-rule-details.md): Review Cortex XSIAM IOC rule fields, conditions, and detection behavior. - [Create an IOC rule](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/detect-investigate-and-respond-to-threats/threat-management/detection-rules/what-are-detection-rules/whats-an-ioc/create-an-ioc-rule.md): Create Cortex XSIAM IOC rules to generate issues from known threat indicators. - [What's a BIOC?](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/detect-investigate-and-respond-to-threats/threat-management/detection-rules/what-are-detection-rules/whats-a-bioc.md): Learn how Cortex XSIAM BIOC rules detect suspicious endpoint and network behavior. - [BIOC rule details](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/detect-investigate-and-respond-to-threats/threat-management/detection-rules/what-are-detection-rules/whats-a-bioc/bioc-rule-details.md): Review Cortex XSIAM BIOC rule fields, conditions, and detection behavior. - [Create a BIOC rule](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/detect-investigate-and-respond-to-threats/threat-management/detection-rules/what-are-detection-rules/whats-a-bioc/create-a-bioc-rule.md): Create Cortex XSIAM BIOC rules to detect suspicious behavior and generate issues. - [Manage Global BIOC Rules](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/detect-investigate-and-respond-to-threats/threat-management/detection-rules/what-are-detection-rules/whats-a-bioc/manage-global-bioc-rules.md): Manage Cortex XSIAM Global BIOC rules for consistent detections across endpoints. - [What's a correlation rule?](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/detect-investigate-and-respond-to-threats/threat-management/detection-rules/what-are-detection-rules/whats-a-correlation-rule.md): Learn how Cortex XSIAM correlation rules detect relationships across events and data sources. - [Correlation rule details](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/detect-investigate-and-respond-to-threats/threat-management/detection-rules/what-are-detection-rules/whats-a-correlation-rule/correlation-rule-details.md): Review Cortex XSIAM correlation rule settings, query logic, and issue generation. - [Create a correlation rule](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/detect-investigate-and-respond-to-threats/threat-management/detection-rules/what-are-detection-rules/whats-a-correlation-rule/create-a-correlation-rule.md): Create Cortex XSIAM correlation rules using XQL to detect patterns across data sources. - [Field replacement syntax in correlation rules](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/detect-investigate-and-respond-to-threats/threat-management/detection-rules/what-are-detection-rules/whats-a-correlation-rule/field-replacement-syntax-in-correlation-rules.md): Use Cortex XSIAM field replacement syntax in correlation rule queries. - [Manage correlation rules](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/detect-investigate-and-respond-to-threats/threat-management/detection-rules/what-are-detection-rules/whats-a-correlation-rule/manage-correlation-rules.md): Manage Cortex XSIAM correlation rules, including rule settings, status, and configuration. - [Monitor correlation rules](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/detect-investigate-and-respond-to-threats/threat-management/detection-rules/what-are-detection-rules/whats-a-correlation-rule/monitor-correlation-rules.md): Monitor Cortex XSIAM correlation rule runs, errors, and detection health. - [Troubleshoot server errors in scheduled correlation rules](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/detect-investigate-and-respond-to-threats/threat-management/detection-rules/what-are-detection-rules/whats-a-correlation-rule/troubleshoot-server-errors-in-scheduled-correlation-rules.md): Troubleshoot scheduled Cortex XSIAM correlation rule server errors and failed executions. - [Manage IOC and BIOC rules](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/detect-investigate-and-respond-to-threats/threat-management/detection-rules/what-are-detection-rules/manage-ioc-and-bioc-rules.md): Manage Cortex XSIAM IOC and BIOC rules to maintain threat detections. - [Analytics](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/detect-investigate-and-respond-to-threats/threat-management/analytics.md): Learn how Cortex XSIAM Analytics detects anomalous behavior using analytics engines, sensors, and rules. - [Analytics overview](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/detect-investigate-and-respond-to-threats/threat-management/analytics/analytics-overview.md): Learn how Cortex XSIAM Analytics establishes behavioral baselines, identifies anomalies, and creates issues for investigation. - [Analytics engine](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/detect-investigate-and-respond-to-threats/threat-management/analytics/analytics-engine.md): Learn how the Cortex XSIAM Analytics engine analyzes data to detect anomalous behavior and generate issues. - [Analytics sensors](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/detect-investigate-and-respond-to-threats/threat-management/analytics/analytics-sensors.md): Explore Cortex XSIAM Analytics sensors that collect telemetry for behavioral baselines and anomaly detection. - [Coverage of MITRE Attack tactics](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/detect-investigate-and-respond-to-threats/threat-management/analytics/coverage-of-mitre-attack-tactics.md): Review Cortex XSIAM Analytics coverage of MITRE ATT\&CK tactics to understand detection visibility. - [Review MITRE ATT\&CK framework coverage](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/detect-investigate-and-respond-to-threats/threat-management/analytics/review-mitre-att-and-ck-framework-coverage.md): Review Cortex XSIAM Analytics coverage across the MITRE ATT\&CK framework, tactics, and techniques. - [Analytics detection time intervals](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/detect-investigate-and-respond-to-threats/threat-management/analytics/analytics-detection-time-intervals.md): Understand Cortex XSIAM Analytics detection time intervals and their effect on anomaly identification. - [Analytics issues and Analytics BIOCs](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/detect-investigate-and-respond-to-threats/threat-management/analytics/analytics-issues-and-analytics-biocs.md): Learn how Cortex XSIAM Analytics issues and BIOCs identify anomalous activity for investigation. - [Identity Analytics](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/detect-investigate-and-respond-to-threats/threat-management/analytics/identity-analytics.md): Use Cortex XSIAM Identity Analytics to identify anomalous user and identity-related behavior. - [View and manage Analytics rules](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/detect-investigate-and-respond-to-threats/threat-management/analytics/view-and-manage-analytics-rules.md): View and manage Cortex XSIAM Analytics rules that detect anomalous behavior and generate issues. - [AI Detection & Response in Cortex XSIAM](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/detect-investigate-and-respond-to-threats/threat-management/analytics/ai-detection-and-response-in-cortex-xsiam-beta.md): Use AI Detection & Response in Cortex XSIAM to identify and investigate AI-related security risks. - [Data sources and supported services](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/detect-investigate-and-respond-to-threats/threat-management/analytics/ai-detection-and-response-in-cortex-xsiam-beta/data-sources-and-supported-services.md): Review data sources and supported services for AI Detection & Response in Cortex XSIAM. - [Collect prompt logs](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/detect-investigate-and-respond-to-threats/threat-management/analytics/ai-detection-and-response-in-cortex-xsiam-beta/collect-prompt-logs.md): Collect prompt logs in Cortex XSIAM to support AI Detection & Response monitoring and investigations. - [Prompt log collection in AWS](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/detect-investigate-and-respond-to-threats/threat-management/analytics/ai-detection-and-response-in-cortex-xsiam-beta/collect-prompt-logs/prompt-log-collection-in-aws.md): Configure Cortex XSIAM to collect prompt logs from AWS for AI Detection & Response. - [Enable prompt log collection in Azure](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/detect-investigate-and-respond-to-threats/threat-management/analytics/ai-detection-and-response-in-cortex-xsiam-beta/collect-prompt-logs/enable-prompt-log-collection-in-azure.md): Enable Azure prompt log collection in Cortex XSIAM for AI Detection & Response monitoring. - [Configure the Azure Event Hub collection in Cortex XSIAM](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/detect-investigate-and-respond-to-threats/threat-management/analytics/ai-detection-and-response-in-cortex-xsiam-beta/collect-prompt-logs/enable-prompt-log-collection-in-azure/configure-the-azure-event-hub-collection-in-cortex-xsiam.md): Configure Azure Event Hub collection in Cortex XSIAM to ingest prompt logs for AI Detection & Response. - [Set up prompt logging](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/detect-investigate-and-respond-to-threats/threat-management/analytics/ai-detection-and-response-in-cortex-xsiam-beta/collect-prompt-logs/enable-prompt-log-collection-in-azure/set-up-prompt-logging.md): Set up prompt logging in Cortex XSIAM to collect AI interaction data for security monitoring. - [Log HTTP data](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/detect-investigate-and-respond-to-threats/threat-management/analytics/ai-detection-and-response-in-cortex-xsiam-beta/collect-prompt-logs/enable-prompt-log-collection-in-azure/log-http-data.md): Configure Cortex XSIAM to collect HTTP data for AI Detection & Response monitoring and investigation. - [Configure diagnostic settings](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/detect-investigate-and-respond-to-threats/threat-management/analytics/ai-detection-and-response-in-cortex-xsiam-beta/collect-prompt-logs/enable-prompt-log-collection-in-azure/configure-diagnostic-settings.md): Configure Azure diagnostic settings for Cortex XSIAM prompt log collection and AI Detection & Response. - [Extended Threat Intelligence](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/detect-investigate-and-respond-to-threats/threat-management/extended-threat-intelligence.md): Explore Extended Threat Intelligence in Cortex XSIAM to research threats, investigate indicators, and strengthen security workflows. - [XTI Threat Intel Library](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/detect-investigate-and-respond-to-threats/threat-management/extended-threat-intelligence/xti-threat-intel-library.md): Explore the Cortex XSIAM XTI Threat Intel Library for Unit 42 threat actors, malware families, vulnerabilities, and reports. - [XTI Indicators](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/detect-investigate-and-respond-to-threats/threat-management/extended-threat-intelligence/xti-indicators.md): Investigate, manage, and enrich threat indicators in Cortex XSIAM, including domains, IP addresses, URLs, and file hashes. - [Threat intel context in cases and issues](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/detect-investigate-and-respond-to-threats/threat-management/extended-threat-intelligence/threat-intel-context-in-cases-and-issues.md): Use Cortex XSIAM threat intelligence context to analyze indicators and Behavioral Threat Analysis findings in cases and issues. - [XTI indicator rules](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/detect-investigate-and-respond-to-threats/threat-management/extended-threat-intelligence/xti-indicator-rules.md): Create Cortex XSIAM XTI indicator rules to detect known threat indicators and generate issues from matching data. - [Threat intel investigation through XQL](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/detect-investigate-and-respond-to-threats/threat-management/extended-threat-intelligence/threat-intel-investigation-through-xql.md): Use Cortex XSIAM XQL to query XTI indicators, threat objects, and relationships for threat intelligence investigations. - [Threat Intel Dashboard](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/detect-investigate-and-respond-to-threats/threat-management/extended-threat-intelligence/threat-intel-dashboard.md): Use the Cortex XSIAM Threat Intel Dashboard to monitor intelligence distribution, ingestion health, and emerging threats. - [Using XTI with Threat Intel Agent](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/detect-investigate-and-respond-to-threats/threat-management/extended-threat-intelligence/using-xti-with-threat-intel-agent.md): Use the Cortex XSIAM Threat Intel Agent to list, enrich, and update Extended Threat Intelligence indicators. - [Using XTI in playbooks](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/detect-investigate-and-respond-to-threats/threat-management/extended-threat-intelligence/using-xti-in-playbooks.md): Use Cortex XSIAM playbooks to automate XTI indicator triage, enrichment, and response with supported commands. - [Threat Intel Management](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/detect-investigate-and-respond-to-threats/threat-management/threat-intel-management.md): Manage threat indicators, feeds, enrichment, and detection workflows with Threat Intel Management. - [Get started with Threat Intel Management](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/detect-investigate-and-respond-to-threats/threat-management/threat-intel-management/get-started-with-threat-intel-management.md): Learn Threat Intel Management concepts, use cases, roles, and the indicator lifecycle. - [What is Threat Intel Management?](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/detect-investigate-and-respond-to-threats/threat-management/threat-intel-management/get-started-with-threat-intel-management/what-is-threat-intel-management.md): Learn how Threat Intel Management centralizes indicators, enrichment, and investigation workflows. - [Threat Intel Management use cases](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/detect-investigate-and-respond-to-threats/threat-management/threat-intel-management/get-started-with-threat-intel-management/threat-intel-management-use-cases.md): Explore workflows for ingesting, enriching, investigating, and acting on threat indicators. - [Roles and responsibilities in Threat Intel Management](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/detect-investigate-and-respond-to-threats/threat-management/threat-intel-management/get-started-with-threat-intel-management/roles-and-responsibilities-in-threat-intel-management.md): Understand the roles and responsibilities for configuring and operating Threat Intel Management. - [Indicator concepts](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/detect-investigate-and-respond-to-threats/threat-management/threat-intel-management/get-started-with-threat-intel-management/indicator-concepts.md): Learn the indicator concepts, fields, types, and sources used in Threat Intel Management. - [Indicator lifecycle](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/detect-investigate-and-respond-to-threats/threat-management/threat-intel-management/get-started-with-threat-intel-management/indicator-lifecycle.md): Understand how indicators are created, enriched, managed, expired, and removed. - [Indicator configuration](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/detect-investigate-and-respond-to-threats/threat-management/threat-intel-management/indicator-configuration.md): Configure feeds, indicator types, fields, extraction, enrichment, and indicator rules. - [Configure Threat Intelligence feed integrations](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/detect-investigate-and-respond-to-threats/threat-management/threat-intel-management/indicator-configuration/configure-threat-intelligence-feed-integrations.md): Connect threat intelligence feeds to ingest indicators into Cortex XSIAM. - [Customize indicator fields and types](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/detect-investigate-and-respond-to-threats/threat-management/threat-intel-management/indicator-configuration/customize-indicator-fields-and-types.md): Customize indicator types and fields to organize threat intelligence data. - [Create an indicator type](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/detect-investigate-and-respond-to-threats/threat-management/threat-intel-management/indicator-configuration/customize-indicator-fields-and-types/create-an-indicator-type.md): Create custom indicator types and configure their profiles, scripts, and field mappings. - [Indicator type profile](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/detect-investigate-and-respond-to-threats/threat-management/threat-intel-management/indicator-configuration/customize-indicator-fields-and-types/create-an-indicator-type/indicator-type-profile.md): Configure profile settings that define an indicator type's behavior and appearance. - [Formatting scripts](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/detect-investigate-and-respond-to-threats/threat-management/threat-intel-management/indicator-configuration/customize-indicator-fields-and-types/create-an-indicator-type/formatting-scripts.md): Use formatting scripts to normalize indicator values before storage. - [Enhancement scripts](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/detect-investigate-and-respond-to-threats/threat-management/threat-intel-management/indicator-configuration/customize-indicator-fields-and-types/create-an-indicator-type/enhancement-scripts.md): Use enhancement scripts to add threat intelligence context to indicators. - [Reputation scripts](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/detect-investigate-and-respond-to-threats/threat-management/threat-intel-management/indicator-configuration/customize-indicator-fields-and-types/create-an-indicator-type/reputation-scripts.md): Use reputation scripts to calculate or update an indicator's reputation. - [Reputation commands](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/detect-investigate-and-respond-to-threats/threat-management/threat-intel-management/indicator-configuration/customize-indicator-fields-and-types/create-an-indicator-type/reputation-commands.md): Configure integration commands that retrieve reputation data for indicators. - [Map custom indicator fields](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/detect-investigate-and-respond-to-threats/threat-management/threat-intel-management/indicator-configuration/customize-indicator-fields-and-types/create-an-indicator-type/map-custom-indicator-fields.md): Map custom fields to indicator types for consistent indicator data. - [Create an indicator field](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/detect-investigate-and-respond-to-threats/threat-management/threat-intel-management/indicator-configuration/customize-indicator-fields-and-types/create-an-indicator-field.md): Create custom fields to store additional threat indicator information. - [Indicator field structure](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/detect-investigate-and-respond-to-threats/threat-management/threat-intel-management/indicator-configuration/customize-indicator-fields-and-types/create-an-indicator-field/indicator-field-structure.md): Understand the structure and settings available for custom indicator fields. - [Indicator field trigger scripts](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/detect-investigate-and-respond-to-threats/threat-management/threat-intel-management/indicator-configuration/customize-indicator-fields-and-types/create-an-indicator-field/indicator-field-trigger-scripts.md): Use trigger scripts to run actions when indicator field values change. - [Indicator classification and mapping](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/detect-investigate-and-respond-to-threats/threat-management/threat-intel-management/indicator-configuration/indicator-classification-and-mapping.md): Classify and map extracted values to the appropriate indicator types and fields. - [Indicator extraction](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/detect-investigate-and-respond-to-threats/threat-management/threat-intel-management/indicator-configuration/indicator-extraction.md): Configure how Cortex XSIAM extracts indicators from tasks, scripts, and integrations. - [Set the indicator extraction mode for a playbook task](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/detect-investigate-and-respond-to-threats/threat-management/threat-intel-management/indicator-configuration/indicator-extraction/set-the-indicator-extraction-mode-for-a-playbook-task.md): Choose how a playbook task extracts and creates indicators from its output. - [Disable indicator extraction for scripts or integrations](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/detect-investigate-and-respond-to-threats/threat-management/threat-intel-management/indicator-configuration/indicator-extraction/disable-indicator-extraction-for-scripts-or-integrations.md): Prevent selected scripts or integrations from automatically extracting indicators. - [Configure Threat Intelligence feed integrations](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/detect-investigate-and-respond-to-threats/threat-management/threat-intel-management/indicator-configuration/configure-threat-intelligence-feed-integrations-1.md): Configure threat intelligence feed integrations and manage their indicator ingestion. - [Exclude indicators from enrichment](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/detect-investigate-and-respond-to-threats/threat-management/threat-intel-management/indicator-configuration/exclude-indicators-from-enrichment.md): Exclude selected indicators from enrichment to control processing and data usage. - [Generate issues from indicators using indicator rules for prevention and detection](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/detect-investigate-and-respond-to-threats/threat-management/threat-intel-management/indicator-configuration/generate-issues-from-indicators-using-indicator-rules-for-prevention-and-detection.md): Create rules that generate prevention or detection issues from matching indicators. - [Export indicators](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/detect-investigate-and-respond-to-threats/threat-management/threat-intel-management/indicator-configuration/export-indicators.md): Export threat indicators for use in external systems and workflows. - [Indicator management](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/detect-investigate-and-respond-to-threats/threat-management/threat-intel-management/indicator-management.md): Create, view, edit, and organize threat indicators throughout their lifecycle. - [Indicator investigation](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/detect-investigate-and-respond-to-threats/threat-management/threat-intel-management/indicator-investigation.md): Investigate indicators using verdicts, enrichment, relationships, expiration, and exclusions. - [Indicator verdict](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/detect-investigate-and-respond-to-threats/threat-management/threat-intel-management/indicator-investigation/indicator-verdict.md): Understand indicator verdicts and how they assess threat relevance. - [Extract and enrich an indicator](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/detect-investigate-and-respond-to-threats/threat-management/threat-intel-management/indicator-investigation/extract-and-enrich-an-indicator.md): Extract indicators from data and enrich them with context from supported integrations. - [Expire an indicator](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/detect-investigate-and-respond-to-threats/threat-management/threat-intel-management/indicator-investigation/expire-an-indicator.md): Expire indicators when they no longer require active monitoring or matching. - [Manage indicator relationships](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/detect-investigate-and-respond-to-threats/threat-management/threat-intel-management/indicator-investigation/manage-indicator-relationships.md): Create and manage relationships between indicators to capture threat context. - [Delete and exclude indicators](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/detect-investigate-and-respond-to-threats/threat-management/threat-intel-management/indicator-investigation/delete-and-exclude-indicators.md): Delete unwanted indicators or exclude them from future ingestion and enrichment. - [Attack surface management](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/detect-investigate-and-respond-to-threats/attack-surface-management.md): Learn how to discover, monitor, and remediate external asset exposures with Cortex XSIAM attack surface management. - [Learn about Attack Surface Management](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/detect-investigate-and-respond-to-threats/attack-surface-management/get-started-with-attack-surface-management.md): Learn about Cortex XSIAM Attack Surface Management (ASM) capabilities for finding, prioritizing, and remediating external asset exposures. - [Network mapping](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/detect-investigate-and-respond-to-threats/attack-surface-management/get-started-with-attack-surface-management/network-mapping.md): Learn how Cortex XSIAM discovers, attributes, and validates internet-facing assets to map your public attack surface. - [Scanning](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/detect-investigate-and-respond-to-threats/attack-surface-management/get-started-with-attack-surface-management/scanning.md): Learn how Cortex XSIAM ASM scans internet-facing assets, monitors known assets, and identifies exposed services. - [GeoIP data collection](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/detect-investigate-and-respond-to-threats/attack-surface-management/get-started-with-attack-surface-management/geoip-data-collection.md): ASM in Cortex XSIAM uses GeoIP data to validate network distribution, identify location-based compliance risks, and route remediation efforts. - [Attack Surface Management detections](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/detect-investigate-and-respond-to-threats/attack-surface-management/attack-surface-management-detections.md): Learn about Cortex XSIAM Attack Surface Management detections, findings, and issues. - [Attack surface rules](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/detect-investigate-and-respond-to-threats/attack-surface-management/attack-surface-management-detections/attack-surface-rules.md): Cortex XSIAM ASM uses attack surface rules to identify risks, generate findings, and manage severity. - [Attack Surface Testing](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/detect-investigate-and-respond-to-threats/attack-surface-management/attack-surface-management-detections/attack-surface-testing.md): Use Cortex XSIAM Attack Surface Testing to validate external asset exposure and detection coverage. - [Externally inferred CVEs](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/detect-investigate-and-respond-to-threats/attack-surface-management/attack-surface-management-detections/externally-inferred-cves.md): Use Cortex XSIAM to identify externally inferred CVEs affecting internet-facing assets and prioritize remediation. - [Digital Risk Protection](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/detect-investigate-and-respond-to-threats/attack-surface-management/attack-surface-management-detections/digital-risk-protection.md): Use Cortex XSIAM Digital Risk Protection to identify external threats, exposure, and brand-related risks. - [Attack surface assets](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/detect-investigate-and-respond-to-threats/attack-surface-management/attack-surface-assets.md): Manage Cortex XSIAM attack surface assets and submit CSV requests to add or remove them. - [Deploy ASM and Exposure Management enrichment and remediation automation](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/detect-investigate-and-respond-to-threats/attack-surface-management/deploy-asm-and-exposure-management-enrichment-and-remediation-automation.md): Enable the Exposure Management playbooks in Cortex XSIAM to automate ASM and vulnerability issue enrichment and remediation. - [ASM enrichment of cloud assets](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/detect-investigate-and-respond-to-threats/attack-surface-management/asm-enrichment-of-cloud-assets.md): ASM enrichment of cloud assets in Cortex XSIAM provides visibility into all the assets in your cloud infrastructure that are exposed to the internet. - [Emerging Vulnerabilities](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/detect-investigate-and-respond-to-threats/attack-surface-management/emerging-vulnerabilities.md): Identify external exposures linked to emerging vulnerabilities, zero-day exploits, and global threat events on the Emerging Vulnerabilities page in Cortex XSIAM. - [Global Lookup](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/detect-investigate-and-respond-to-threats/attack-surface-management/global-lookup.md): Query and enrich global internet scan data for IP addresses, domains, and certificate hashes in Cortex XSIAM. - [Vulnerability management](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/detect-investigate-and-respond-to-threats/vulnerability-management.md): Manage, prioritize, and remediate vulnerabilities across endpoints, code, and cloud with Cortex XSIAM. - [Vulnerability management in Cortex XSIAM](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/detect-investigate-and-respond-to-threats/vulnerability-management/vulnerability-management-in-cortex-xsiam.md): Use Cortex XSIAM Vulnerability Management to identify, assess, prioritize, and remediate vulnerabilities across your environment. - [Cortex Vulnerability Risk Score](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/detect-investigate-and-respond-to-threats/vulnerability-management/cortex-vulnerability-risk-score.md): Learn how Cortex XSIAM calculates and displays Cortex Vulnerability Risk Scores for prioritized remediation. - [Vulnerability policies](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/detect-investigate-and-respond-to-threats/vulnerability-management/vulnerability-policies.md): Configure Cortex XSIAM vulnerability policies to define actions for selected vulnerability findings. - [Investigate and remediate vulnerabilities](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/detect-investigate-and-respond-to-threats/vulnerability-management/investigate-and-remediate-vulnerabilities.md): Investigate, prioritize, and remediate vulnerabilities through Cortex XSIAM issues, findings, and vulnerable assets. - [Vulnerability Intelligence](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/detect-investigate-and-respond-to-threats/vulnerability-management/vulnerability-intelligence.md): Use Cortex XSIAM Vulnerability Intelligence for real-time data and threat intelligence from certified sources. - [Emerging Vulnerabilities](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/detect-investigate-and-respond-to-threats/vulnerability-management/emerging-vulnerabilities.md): Use Cortex XSIAM Emerging Vulnerabilities to research, assess, and respond to zero-day exploits and global threats. - [Recast CVSS scores and CVSS severities](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/detect-investigate-and-respond-to-threats/vulnerability-management/recast-cvss-scores-and-cvss-severities.md): Recast CVSS scores and severities in Cortex XSIAM to align vulnerability risk with organizational priorities. - [Exposure management](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/detect-investigate-and-respond-to-threats/exposure-management.md): Assess, prioritize, and remediate organizational exposures with Cortex XSIAM Exposure Management. - [Learn about Exposure Management](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/detect-investigate-and-respond-to-threats/exposure-management/exposure-management.md): Learn how Cortex XSIAM Exposure Management unifies exposure data, prioritization, and remediation workflows. - [Get started with Exposure Management](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/detect-investigate-and-respond-to-threats/exposure-management/get-started-with-exposure-management.md): Set up Cortex XSIAM Exposure Management with scanners, integrations, policies, security controls, and automation. - [Ingest assets and vulnerabilities from third-party applications](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/detect-investigate-and-respond-to-threats/exposure-management/ingest-assets-and-vulnerabilities-from-third-party-applications.md): Ingest assets and vulnerabilities from third-party applications into Cortex XSIAM Exposure Management. - [Security controls](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/detect-investigate-and-respond-to-threats/exposure-management/security-controls.md): Use Cortex XSIAM security controls to assess compensating-control effectiveness and residual exposure risk. - [Cortex Network Scanner](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/detect-investigate-and-respond-to-threats/exposure-management/cortex-network-scanner.md): Deploy Cortex XSIAM Network Scanner to discover assets, assess vulnerabilities, and investigate issues. - [Exposure Management Command Center](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/detect-investigate-and-respond-to-threats/exposure-management/exposure-management-command-center.md): Use Cortex XSIAM Exposure Management Command Center to prioritize findings and track remediation. - [Cortex Advanced Email Security](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/detect-investigate-and-respond-to-threats/cortex-advanced-email-security.md): Configure, monitor, and respond to email security threats with Cortex XSIAM Advanced Email Security. - [Cortex Advanced Email Security module overview](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/detect-investigate-and-respond-to-threats/cortex-advanced-email-security/cortex-advanced-email-security-module-overview.md): Learn how Cortex XSIAM Advanced Email Security detects, investigates, and remediates email threats. - [Cortex Advanced Email Security module architecture and data flow](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/detect-investigate-and-respond-to-threats/cortex-advanced-email-security/cortex-advanced-email-security-module-architecture-and-data-flow.md): Understand Cortex XSIAM Advanced Email Security architecture, integrations, and email threat data flow. - [Getting started with the Cortex Advanced Email Security module](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/detect-investigate-and-respond-to-threats/cortex-advanced-email-security/getting-started-with-the-cortex-advanced-email-security-module.md): Get started with Cortex XSIAM Advanced Email Security using the deployment workflow and setup requirements. - [Deploy and configure the Email Security module](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/detect-investigate-and-respond-to-threats/cortex-advanced-email-security/deploy-and-configure-the-email-security-module.md): Deploy and configure Cortex XSIAM Advanced Email Security to protect your email environment. - [Cortex Advanced Email Security threat detection and issues](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/detect-investigate-and-respond-to-threats/cortex-advanced-email-security/cortex-advanced-email-security-threat-detection-and-issues.md): Use Cortex XSIAM Advanced Email Security to detect email threats and investigate related issues. - [Email Security Analytics Rules](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/detect-investigate-and-respond-to-threats/cortex-advanced-email-security/cortex-advanced-email-security-threat-detection-and-issues/email-security-analytics-rules.md): Configure Cortex XSIAM Email Security Analytics Rules to detect suspicious email activity and create issues. - [Investigate and respond to email security issues](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/detect-investigate-and-respond-to-threats/cortex-advanced-email-security/investigate-and-respond-to-email-security-issues.md): Investigate and respond to email security issues with Cortex XSIAM Advanced Email Security. - [Automate remediation for the Cortex Advanced Email Security module](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/detect-investigate-and-respond-to-threats/cortex-advanced-email-security/automate-remediation-for-the-cortex-advanced-email-security-module.md): Automate Cortex XSIAM Advanced Email Security remediation workflows for detected email threats. - [Email Remediation Response Rules](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/detect-investigate-and-respond-to-threats/cortex-advanced-email-security/automate-remediation-for-the-cortex-advanced-email-security-module/email-remediation-response-rules.md): Configure Cortex XSIAM Email Remediation Response Rules to automate responses to email threats. - [Email Security Remediation Action Center](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/detect-investigate-and-respond-to-threats/cortex-advanced-email-security/automate-remediation-for-the-cortex-advanced-email-security-module/email-security-remediation-action-center.md): Use the Cortex XSIAM Email Security Remediation Action Center to track and manage response actions. - [Email Command Center](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/detect-investigate-and-respond-to-threats/cortex-advanced-email-security/email-command-center.md): Use the Cortex XSIAM Email Command Center to monitor email security status and threat activity. - [Malicious Email Inventory](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/detect-investigate-and-respond-to-threats/cortex-advanced-email-security/malicious-email-inventory.md): Use Cortex XSIAM Malicious Email Inventory to investigate and manage detected malicious messages. - [Mailbox Inventory](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/detect-investigate-and-respond-to-threats/cortex-advanced-email-security/mailbox-inventory.md): Use Cortex XSIAM Mailbox Inventory to view and investigate protected email mailboxes. - [Advanced Email Security module security and compliance](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/detect-investigate-and-respond-to-threats/cortex-advanced-email-security/advanced-email-security-module-security-and-compliance.md): Review Cortex XSIAM Advanced Email Security security controls and compliance considerations. - [Identity Threat Detection and Response (ITDR)](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/detect-investigate-and-respond-to-threats/identity-threat-module-itdr.md): Use Cortex XSIAM Identity Threat Detection and Response to detect, investigate, and respond to identity threats. - [Get started with ITDR](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/detect-investigate-and-respond-to-threats/identity-threat-module-itdr/get-started-with-itdr.md): Get started with Cortex XSIAM Identity Threat Detection and Response to protect identities and investigate threats. - [Manage role based access control (RBAC) in ITDR](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/detect-investigate-and-respond-to-threats/identity-threat-module-itdr/manage-role-based-access-control-rbac-in-itdr.md): Manage role-based access control in Cortex XSIAM ITDR to control access to identity security capabilities. - [Monitor user risk exposure](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/detect-investigate-and-respond-to-threats/identity-threat-module-itdr/monitor-user-risk-exposure.md): Monitor user risk exposure in Cortex XSIAM ITDR to identify risky identity activity and prioritize response. - [Investigate user risk](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/detect-investigate-and-respond-to-threats/identity-threat-module-itdr/investigate-user-risk.md): Investigate user risk in Cortex XSIAM ITDR to assess identity threats and guide response actions. - [Manage user asset roles](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/detect-investigate-and-respond-to-threats/identity-threat-module-itdr/asset-roles.md): Manage user asset roles in Cortex XSIAM ITDR to classify identities and strengthen identity risk analysis. - [Improve Active Directory posture with AD-SPM](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/detect-investigate-and-respond-to-threats/identity-threat-module-itdr/active-directory-security-posture-management.md): Use Cortex XSIAM ITDR AD-SPM to improve Active Directory posture and reduce identity attack risks. - [Enforce dynamic access control with CAP](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/detect-investigate-and-respond-to-threats/identity-threat-module-itdr/conditional-access-policy.md): Use Cortex XSIAM ITDR Conditional Access Policies to enforce dynamic access control and reduce identity risk. - [Prevent malicious LDAP queries](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/detect-investigate-and-respond-to-threats/identity-threat-module-itdr/prevent-malicious-ldap-queries.md): Use Cortex XSIAM ITDR to detect and prevent malicious LDAP queries that target Active Directory. - [Rules and Policies](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/cloud-security/rules-and-policies.md): Discover how Cortex XSIAM detects security risks across your infrastructure, workloads, and container images, and how policies automate the response. - [Cloud security rules and policies](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/cloud-security/rules-and-policies/cloud-security-rules-and-policies.md): Learn how cloud security rules and policies detect threats and misconfigurations across your Cortex XSIAM environment. - [Cloud security rules](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/cloud-security/rules-and-policies/cloud-security-rules-and-policies/cloud-security-rules.md): Learn about out-of-the-box and custom cloud security rules in Cortex XSIAM. - [Cloud security policies](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/cloud-security/rules-and-policies/cloud-security-rules-and-policies/cloud-security-policies.md): Learn about cloud security policies in Cortex XSIAM. - [Create and manage cloud security rules](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/cloud-security/rules-and-policies/cloud-security-rules-and-policies/create-and-manage-cloud-security-rules.md): Create and manage custom cloud security rules for detecting cloud security risks in Cortex XSIAM. - [Create a graph rule](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/cloud-security/rules-and-policies/cloud-security-rules-and-policies/create-and-manage-cloud-security-rules/create-a-graph-rule.md): Create custom graph detection rules that identify risky relationships and attack paths in Cortex XSIAM. - [Create a configuration rule](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/cloud-security/rules-and-policies/cloud-security-rules-and-policies/create-and-manage-cloud-security-rules/create-a-configuration-rule.md): Create Cortex XSIAM configuration rules that identify cloud resource misconfigurations and policy violations. - [Create a data rule](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/cloud-security/rules-and-policies/cloud-security-rules-and-policies/create-and-manage-cloud-security-rules/create-a-data-rule.md): Create Cortex XSIAM data rules to detect data risks, malware, and classification issues. - [Create an identity rule](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/cloud-security/rules-and-policies/cloud-security-rules-and-policies/create-and-manage-cloud-security-rules/create-an-identity-rule.md): Create Cortex XSIAM identity rules to detect excessive or unused cloud permissions. - [Create a network exposure rule](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/cloud-security/rules-and-policies/cloud-security-rules-and-policies/create-and-manage-cloud-security-rules/create-a-network-exposure-rule.md): Create Cortex XSIAM network exposure rules to detect risky inbound, outbound, and east-west access. - [Create an AI rule](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/cloud-security/rules-and-policies/cloud-security-rules-and-policies/create-and-manage-cloud-security-rules/create-an-ai-rule.md): Create Cortex XSIAM AI rules to detect risks and misconfigurations across your AI ecosystem. - [Create an attack path (legacy) rule](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/cloud-security/rules-and-policies/cloud-security-rules-and-policies/create-and-manage-cloud-security-rules/create-an-attack-path-rule.md): Create Cortex XSIAM attack path rules that identify breach paths to high-value cloud assets. - [View cloud security rule status](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/cloud-security/rules-and-policies/cloud-security-rules-and-policies/create-and-manage-cloud-security-rules/view-cloud-security-rule-status.md): View, filter, and sort the status of cloud security rules in Cortex XSIAM. - [Edit a cloud security rule](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/cloud-security/rules-and-policies/cloud-security-rules-and-policies/create-and-manage-cloud-security-rules/edit-a-cloud-security-rule.md): Edit cloud security rules in Cortex XSIAM and understand how changes affect related issues. - [Enable or disable a rule](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/cloud-security/rules-and-policies/cloud-security-rules-and-policies/create-and-manage-cloud-security-rules/enable-or-disable-a-rule.md): Enable or disable cloud security rules in Cortex XSIAM to control when they evaluate assets. - [Use an existing rule to create a new one](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/cloud-security/rules-and-policies/cloud-security-rules-and-policies/create-and-manage-cloud-security-rules/use-an-existing-rule-to-create-a-new-one.md): Duplicate an existing cloud security rule in Cortex XSIAM and customize it for your needs. - [Delete a custom cloud security rule](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/cloud-security/rules-and-policies/cloud-security-rules-and-policies/create-and-manage-cloud-security-rules/delete-a-custom-cloud-security-rule.md): Delete custom cloud security rules in Cortex XSIAM that are no longer needed. - [Create and manage cloud security policies](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/cloud-security/rules-and-policies/cloud-security-rules-and-policies/create-and-manage-cloud-security-policies.md): Create and manage cloud security policies in Cortex XSIAM. - [Create a cloud security policy](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/cloud-security/rules-and-policies/cloud-security-rules-and-policies/create-and-manage-cloud-security-policies/create-a-cloud-security-policy.md): Create a cloud security policy in Cortex XSIAM that applies security rules to selected cloud assets. - [Edit a cloud security policy](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/cloud-security/rules-and-policies/cloud-security-rules-and-policies/create-and-manage-cloud-security-policies/edit-a-cloud-security-policy.md): Edit cloud security policies in Cortex XSIAM to update their details, rules, and scopes. - [Enable or disable a policy](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/cloud-security/rules-and-policies/cloud-security-rules-and-policies/create-and-manage-cloud-security-policies/enable-or-disable-a-policy.md): Enable or disable custom and default cloud security policies in Cortex XSIAM. - [Use an existing policy to create a new one](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/cloud-security/rules-and-policies/cloud-security-rules-and-policies/create-and-manage-cloud-security-policies/use-an-existing-policy-to-create-a-new-one.md): Clone an existing cloud security policy in Cortex XSIAM and tailor it to your needs. - [Delete a custom cloud security policy](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/cloud-security/rules-and-policies/cloud-security-rules-and-policies/create-and-manage-cloud-security-policies/delete-a-custom-cloud-security-policy.md): Remove custom cloud security policies in Cortex XSIAM that are no longer needed. - [Cloud workload policies and rules](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/cloud-security/rules-and-policies/cloud-workload-policies-and-rules.md): Use Cortex XSIAM cloud workload policies and rules to detect security violations, create issues, and prevent misconfigurations. - [How policies and rules work together](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/cloud-security/rules-and-policies/cloud-workload-policies-and-rules/how-policies-and-rules-work-together.md): Understand how Cortex XSIAM cloud workload rules detect violations and policies create issues or apply preventive actions. - [Cloud workload policies](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/cloud-security/rules-and-policies/cloud-workload-policies-and-rules/cloud-workload-policies.md): Configure Cortex XSIAM cloud workload policies to detect violations, create issues, and prevent risks across SDLC stages. - [Types of cloud workload policies](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/cloud-security/rules-and-policies/cloud-workload-policies-and-rules/cloud-workload-policies/types-of-cloud-workload-policies.md): Explore Cortex XSIAM cloud workload policy types for misconfigurations, malware, secrets, and trusted images. - [Trusted image cloud workload policies](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/cloud-security/rules-and-policies/cloud-workload-policies-and-rules/cloud-workload-policies/types-of-cloud-workload-policies/types-of-cloud-workload-policies.md): Configure Cortex XSIAM trusted image policies to evaluate image trust, prevent untrusted deployments, and create security issues. - [Cloud Workload Policies page](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/cloud-security/rules-and-policies/cloud-workload-policies-and-rules/cloud-workload-policies/cloud-workload-policies-page.md): Use the Cortex XSIAM Cloud Workload Policies page to view, filter, configure, and manage workload security policies. - [Enable or disable a cloud workload policy](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/cloud-security/rules-and-policies/cloud-workload-policies-and-rules/cloud-workload-policies/enable-or-disable-a-cloud-workload-policy.md): Enable or disable a Cortex XSIAM cloud workload policy to control its evaluation and enforcement. - [Create a cloud workload policy](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/cloud-security/rules-and-policies/cloud-workload-policies-and-rules/cloud-workload-policies/create-a-cloud-workload-policy.md): Create Cortex XSIAM cloud workload policies for misconfiguration, malware, secret, and trusted image protection. - [Use an existing policy to create a new cloud workload policy](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/cloud-security/rules-and-policies/cloud-workload-policies-and-rules/cloud-workload-policies/use-an-existing-policy-to-create-a-new-cloud-workload-policy.md): Duplicate an existing Cortex XSIAM cloud workload policy to reuse and modify its conditions, scope, and actions. - [Edit a cloud workload policy](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/cloud-security/rules-and-policies/cloud-workload-policies-and-rules/cloud-workload-policies/edit-a-cloud-workload-policy.md): Edit a Cortex XSIAM cloud workload policy to update its configuration and security enforcement settings. - [Delete a cloud workload policy](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/cloud-security/rules-and-policies/cloud-workload-policies-and-rules/cloud-workload-policies/delete-a-cloud-workload-policy.md): Delete a Cortex XSIAM cloud workload policy that is no longer needed for workload security. - [Cloud workload preventive action](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/cloud-security/rules-and-policies/cloud-workload-policies-and-rules/cloud-workload-policies/cloud-workload-preventive-action.md): Learn how Cortex XSIAM cloud workload preventive actions block Kubernetes deployments and fail CI pipelines. - [Cloud workload rules](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/cloud-security/rules-and-policies/cloud-workload-policies-and-rules/cloud-workload-rules.md): Use Cortex XSIAM cloud workload rules to define detection criteria for security violations and policy enforcement. - [Default (pre-defined) rules](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/cloud-security/rules-and-policies/cloud-workload-policies-and-rules/cloud-workload-rules/default-pre-defined-rules.md): Review Cortex XSIAM predefined cloud workload rules that detect risks, prevent violations, and create issues. - [Custom (user-defined) rules](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/cloud-security/rules-and-policies/cloud-workload-policies-and-rules/cloud-workload-rules/custom-user-defined-rules.md): Create Cortex XSIAM custom cloud workload rules for organization-specific security, compliance, and misconfiguration checks. - [Cloud Workload Rules page](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/cloud-security/rules-and-policies/cloud-workload-policies-and-rules/cloud-workload-rules/cloud-workload-rules-page.md): Use the Cortex XSIAM Cloud Workload Rules page to view, filter, and manage built-in and custom rules. - [Create a new custom detection rule](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/cloud-security/rules-and-policies/cloud-workload-policies-and-rules/cloud-workload-rules/create-a-new-custom-detection-rule.md): Create Cortex XSIAM custom cloud workload detection rules using agentless, Kubernetes, or XDR Agent scanners. - [Use an existing rule to create a new custom detection rule](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/cloud-security/rules-and-policies/cloud-workload-policies-and-rules/cloud-workload-rules/use-an-existing-rule-to-create-a-new-custom-detection-rule.md): Duplicate an existing Cortex XSIAM cloud workload rule to create and customize a new detection rule. - [Edit a custom detection rule](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/cloud-security/rules-and-policies/cloud-workload-policies-and-rules/cloud-workload-rules/edit-a-custom-detection-rule.md): Edit a Cortex XSIAM custom cloud workload detection rule to update its security and compliance checks. - [Delete a custom detection rule](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/cloud-security/rules-and-policies/cloud-workload-policies-and-rules/cloud-workload-rules/delete-a-custom-detection-rule.md): Delete a Cortex XSIAM custom cloud workload detection rule that is no longer required. - [Base image rules](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/cloud-security/rules-and-policies/base-images-rule.md): Use Cortex XSIAM base image rules to map container image lineage, trace vulnerabilities, and manage approved foundational images. - [Create a base image rule](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/cloud-security/rules-and-policies/base-images-rule/create-a-base-images-rule.md): Create and manage Cortex XSIAM base image rules for scanned registry images, including filters, previews, and rule updates. - [Find the base image for an asset](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/cloud-security/rules-and-policies/base-images-rule/prerequisites.md): Find a container asset's base image in Cortex XSIAM to inspect registry image details and upstream or downstream lineage. - [Monitor and track compliance adherence](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/cloud-security/monitor-and-track-compliance-adherence.md): Evaluate and track Cortex XSIAM asset compliance against industry standards and organizational policies. - [Choose compliance standards from the compliance catalog](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/cloud-security/monitor-and-track-compliance-adherence/choose-compliance-standards-from-the-compliance-catalog.md): Select built-in or custom compliance standards and controls from the compliance catalogs in Cortex XSIAM. - [Standards catalog](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/cloud-security/monitor-and-track-compliance-adherence/choose-compliance-standards-from-the-compliance-catalog/standards-catalog.md): Browse available compliance standards in Cortex XSIAM. - [Use a built-in or custom standard](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/cloud-security/monitor-and-track-compliance-adherence/choose-compliance-standards-from-the-compliance-catalog/use-a-built-in-or-custom-standard.md): Use built-in standards or create and edit custom standards in Cortex XSIAM. - [Use a built-in or custom control](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/cloud-security/monitor-and-track-compliance-adherence/choose-compliance-standards-from-the-compliance-catalog/use-a-built-in-or-custom-control.md): Add built-in controls or create and manage custom controls for custom standards in Cortex XSIAM. - [Create a new custom detection rule](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/cloud-security/monitor-and-track-compliance-adherence/choose-compliance-standards-from-the-compliance-catalog/create-a-new-custom-detection-rule.md): Create custom Cortex XSIAM detection rules to enforce compliance requirements and security best practices. - [Use an assessment profile to run compliance checks on your assets](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/cloud-security/monitor-and-track-compliance-adherence/use-an-assessment-profile-to-run-compliance-checks-on-your-assets.md): Create assessment profiles to evaluate selected asset groups against compliance standards in Cortex XSIAM. - [View and manage compliance assessments and reports](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/cloud-security/monitor-and-track-compliance-adherence/view-and-manage-compliance-assessments-and-reports.md): Review Cortex XSIAM assessment results and generate or schedule downloadable compliance reports. - [Review compliance assessments](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/cloud-security/monitor-and-track-compliance-adherence/view-and-manage-compliance-assessments-and-reports/assessments.md): View Cortex XSIAM assessment results and drill into control, rule, and asset compliance details. - [Review compliance reports](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/cloud-security/monitor-and-track-compliance-adherence/view-and-manage-compliance-assessments-and-reports/reports.md): View, export, and manage historical Cortex XSIAM compliance assessment reports. - [Compliance Overview Dashboard](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/cloud-security/monitor-and-track-compliance-adherence/compliance-overview-dashboard.md): Monitor organization-wide Cortex XSIAM compliance scores, standards, failed controls, and asset group performance. - [Cloud Data Classification](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/cloud-security/cortex-cloud-data-classification.md): Manage data patterns, profiles, OCR, and masked sample collection for cloud data classification in Cortex XSIAM. - [How to create and validate a custom data pattern](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/cloud-security/cortex-cloud-data-classification/how-to-create-and-validate-a-custom-data-pattern.md): Create and validate custom data patterns in Cortex XSIAM. - [Custom data patterns: Guardrails and syntax guide](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/cloud-security/cortex-cloud-data-classification/how-to-create-and-validate-a-custom-data-pattern/custom-data-patterns-guardrails-and-syntax-guide.md): Follow guardrails and syntax requirements for custom data patterns in Cortex XSIAM. - [How to disable and enable data patterns in Data Classification](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/cloud-security/cortex-cloud-data-classification/how-to-disable-and-enable-data-patterns-in-data-classification.md): Enable or disable data patterns in Cortex XSIAM Data Classification. - [How to create and validate a custom data profile](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/cloud-security/cortex-cloud-data-classification/how-to-create-and-validate-a-custom-data-profile.md): Create and validate custom data profiles in Cortex XSIAM. - [How to disable and enable data profiles in Cloud Data Classification](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/cloud-security/cortex-cloud-data-classification/how-to-disable-and-enable-data-profiles-in-cortex-cloud-data-classification.md): Enable or disable data profiles in Cortex XSIAM Data Classification. - [How to report a false positive in Cloud Data Classification](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/cloud-security/cortex-cloud-data-classification/how-to-report-a-false-positive-in-cortex-cloud-data-classification.md): Report false positives in Cortex XSIAM Data Classification. - [Topic classification](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/cloud-security/cortex-cloud-data-classification/topic-classification.md): Classify cloud data by topic in Cortex XSIAM. - [Cloud Identity Security](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/cloud-security/cortex-cloud-identity-security.md): Address cloud identity security challenges by managing identity risks and permissions in Cortex XSIAM. - [What is Cloud Identity Security?](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/cloud-security/cortex-cloud-identity-security/what-is-cortex-cloud-identity-security.md): Learn how Cloud Identity Security in Cortex XSIAM secures cloud identities and permissions. - [Review and improve your Identity Security posture](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/cloud-security/cortex-cloud-identity-security/review-and-improve-your-identity-security-posture.md): Learn how to review and improve your Identity Security posture in Cortex XSIAM. - [How does Effective Permission Calculation work?](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/cloud-security/cortex-cloud-identity-security/how-does-effective-permission-calculation-work.md): An explanation of how Effective Permission Calculation works in Cloud Identity Security. - [Cloud Identity Security functionality](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/cloud-security/cortex-cloud-identity-security/cortex-cloud-identity-security-functionality.md): Explore Cloud Identity Security functionality in Cortex XSIAM. - [Configure Cloud Identity Security](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/cloud-security/cortex-cloud-identity-security/configure-cortex-cloud-identity-security.md): Configure Cloud Identity Security settings in Cortex XSIAM. - [Unified Human Identities](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/cloud-security/cortex-cloud-identity-security/unified-human-identities.md): Learn how Unified Human Identities correlate accounts in Cortex XSIAM. - [Achieve the principle of least privilege access](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/cloud-security/cortex-cloud-identity-security/achieve-the-principle-of-least-privilege-access.md): Use Cloud Identity Security in Cortex XSIAM to achieve least privilege access. - [Explore permissions using the simple and advanced access tables](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/cloud-security/cortex-cloud-identity-security/explore-permissions-using-the-simple-and-advanced-access-tables.md): Explore permissions with the Simple and Advanced access tables in Cortex XSIAM. - [Create a custom detection rule in Cloud Identity Security](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/cloud-security/cortex-cloud-identity-security/create-a-custom-detection-rule-in-cortex-cloud-identity-security.md): Create custom Cloud Identity Security detection rules in Cortex XSIAM. - [Perform advanced Identity Security investigations using XQL](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/cloud-security/cortex-cloud-identity-security/perform-advanced-identity-security-investigations-using-xql.md): Use XQL in Cortex XSIAM to investigate Cloud Identity Security permissions, identity risks, and access data. - [Ingest logs and data from Okta](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/cloud-security/cortex-cloud-identity-security/ingest-logs-and-data-from-okta.md): Ingest Okta logs and configuration data into Cortex XSIAM. - [Enable inactive human identity logs on Azure in Cloud Identity Security](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/cloud-security/cortex-cloud-identity-security/enable-inactive-human-identity-logs-on-azure-in-cortex-cloud-identity-security.md): Enable Azure inactive human identity logs for Cloud Identity Security in Cortex XSIAM. - [Manage RBAC and SBAC in Cloud Identity Security](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/cloud-security/cortex-cloud-identity-security/manage-rbac-and-sbac-in-cortex-cloud-identity-security.md): Manage RBAC and SBAC for Cloud Identity Security in Cortex XSIAM. - [Network exposure detection](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/cloud-security/network-exposure-detection.md): Discover how to identify, prioritize, and remediate internet, outbound, and lateral network exposure risks in Cortex XSIAM. - [What is Cloud Network Analyzer?](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/cloud-security/network-exposure-detection/what-is-cloud-network-analyzer.md): Learn how Cloud Network Analyzer in Cortex XSIAM identifies internet, outbound, and lateral exposure risks across cloud accounts. - [Internet exposure detection](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/cloud-security/network-exposure-detection/internet-exposure-detection.md): Learn how to detect publicly exposed cloud assets in Cortex XSIAM and validate internet exposure through external network scanning. - [Outbound exposure detection](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/cloud-security/network-exposure-detection/outbound-exposure-detection.md): Learn how to detect cloud workloads with unrestricted outbound internet access in Cortex XSIAM and identify responsible security controls. - [East-west exposure detection](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/cloud-security/network-exposure-detection/east-west-exposure-detection.md): Learn how to identify cloud workloads with unrestricted lateral access in Cortex XSIAM and the controls creating east-west exposure. - [Investigate an internet exposure](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/cloud-security/network-exposure-detection/investigate-an-internet-exposure.md): Investigate internet-exposed cloud assets in Cortex XSIAM using Issues and Graph Search to prioritize and remediate risk. - [Configure trusted IPs](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/cloud-security/network-exposure-detection/configure-trusted-ips.md): Configure trusted public IP ranges in Cortex XSIAM to exclude approved addresses from Cloud Network Analyzer internet exposure evaluations. - [Cortex Cloud SaaS Security](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/cloud-security/cortex-cloud-saas-security.md): Discover continuous SaaS visibility and control in Cortex XSIAM across identities, connected applications, and AI agents. - [Setup SaaS Security](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/cloud-security/cortex-cloud-saas-security/setup-saas-security.md): Get started with SaaS Security in Cortex XSIAM. - [Connect a SaaS application](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/cloud-security/cortex-cloud-saas-security/connect-a-saas-application.md): Connect supported SaaS applications in Cortex XSIAM to track misconfigurations and compliance violations. - [Onboard Asana](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/cloud-security/cortex-cloud-saas-security/connect-a-saas-application/onboard-asana.md): Connect an Asana instance in Cortex XSIAM to detect posture risks and compliance violations. - [Onboard Atlassian](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/cloud-security/cortex-cloud-saas-security/connect-a-saas-application/onboard-atlassian.md): Connect an Atlassian instance in Cortex XSIAM to detect posture and compliance risks. - [Onboard Automox](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/cloud-security/cortex-cloud-saas-security/connect-a-saas-application/onboard-automox.md): Connect an Automox instance in Cortex XSIAM to detect posture risks and compliance violations. - [Onboard Businessmap](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/cloud-security/cortex-cloud-saas-security/connect-a-saas-application/onboard-businessmap.md): Connect a Businessmap instance in Cortex XSIAM to detect posture risks and compliance violations. - [Onboard Celonis](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/cloud-security/cortex-cloud-saas-security/connect-a-saas-application/onboard-celonis.md): Connect a Celonis instance in Cortex XSIAM to detect posture risks and compliance violations. - [Onboard Cisco Duo](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/cloud-security/cortex-cloud-saas-security/connect-a-saas-application/onboard-cisco-duo.md): Connect a Cisco Duo instance in Cortex XSIAM to detect posture risks and compliance violations. - [Onboard Cisco Meraki](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/cloud-security/cortex-cloud-saas-security/connect-a-saas-application/onboard-cisco-meraki.md): Connect a Cisco Meraki instance in Cortex XSIAM to detect posture risks and compliance violations. - [Onboard ClickUp](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/cloud-security/cortex-cloud-saas-security/connect-a-saas-application/onboard-clickup.md): Connect a ClickUp instance in Cortex XSIAM to detect posture risks and compliance violations. - [Onboard Contentful](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/cloud-security/cortex-cloud-saas-security/connect-a-saas-application/onboard-contentful.md): Connect a Contentful instance in Cortex XSIAM to detect posture risks and compliance violations. - [Onboard Couchbase](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/cloud-security/cortex-cloud-saas-security/connect-a-saas-application/onboard-couchbase.md): Connect a Couchbase instance in Cortex XSIAM to detect posture risks and compliance violations. - [Onboard Coveo](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/cloud-security/cortex-cloud-saas-security/connect-a-saas-application/onboard-coveo.md): Connect a Coveo instance in Cortex XSIAM to detect posture risks and compliance violations. - [Onboard Databricks](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/cloud-security/cortex-cloud-saas-security/connect-a-saas-application/onboard-databricks.md): Connect a Databricks instance in Cortex XSIAM to detect posture risks and compliance violations. - [Onboard Datadog](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/cloud-security/cortex-cloud-saas-security/connect-a-saas-application/onboard-datadog.md): Connect a Datadog instance in Cortex XSIAM to detect posture risks and compliance violations. - [Onboard Gainsight PX](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/cloud-security/cortex-cloud-saas-security/connect-a-saas-application/onboard-gainsight-px.md): Connect a Gainsight PX instance in Cortex XSIAM to detect posture risks and compliance violations. - [Onboard Grammarly](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/cloud-security/cortex-cloud-saas-security/connect-a-saas-application/onboard-grammarly.md): Connect a Grammarly instance in Cortex XSIAM to detect posture risks and compliance violations. - [Onboard Harness](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/cloud-security/cortex-cloud-saas-security/connect-a-saas-application/onboard-harness.md): Connect a Harness instance in Cortex XSIAM to detect posture risks and compliance violations. - [Onboard Intercom](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/cloud-security/cortex-cloud-saas-security/connect-a-saas-application/onboard-intercom.md): Connect an Intercom instance in Cortex XSIAM to detect posture risks and compliance violations. - [Onboard Jamf Pro](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/cloud-security/cortex-cloud-saas-security/connect-a-saas-application/onboard-jamf-pro.md): Connect a Jamf Pro instance in Cortex XSIAM to detect posture risks and compliance violations. - [Onboard JumpCloud](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/cloud-security/cortex-cloud-saas-security/connect-a-saas-application/onboard-jumpcloud.md): Connect a JumpCloud instance in Cortex XSIAM to detect posture risks and compliance violations. - [Onboard Kustomer](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/cloud-security/cortex-cloud-saas-security/connect-a-saas-application/onboard-kustomer.md): Connect a Kustomer instance in Cortex XSIAM to detect posture risks and compliance violations. - [Onboard Microsoft Entra ID](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/cloud-security/cortex-cloud-saas-security/connect-a-saas-application/onboard-microsoft-entra-id.md): Connect a Microsoft Entra ID instance in Cortex XSIAM to detect posture risks and compliance violations. - [Onboard Monday.com](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/cloud-security/cortex-cloud-saas-security/connect-a-saas-application/onboard-monday.com.md): Connect a Monday.com instance in Cortex XSIAM to detect posture risks and compliance violations. - [Onboard MongoDB Atlas](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/cloud-security/cortex-cloud-saas-security/connect-a-saas-application/onboard-mongodb-atlas.md): Connect a MongoDB Atlas instance in Cortex XSIAM to detect posture risks and compliance violations. - [Onboard MuleSoft](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/cloud-security/cortex-cloud-saas-security/connect-a-saas-application/onboard-mulesoft.md): Connect a MuleSoft instance in Cortex XSIAM to detect posture risks and compliance violations. - [Onboard Mural](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/cloud-security/cortex-cloud-saas-security/connect-a-saas-application/onboard-mural.md): Connect a Mural instance in Cortex XSIAM to detect posture risks and compliance violations. - [Onboard Office 365](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/cloud-security/cortex-cloud-saas-security/connect-a-saas-application/onboard-office-365.md): Connect an Office 365 instance in Cortex XSIAM to detect posture risks and compliance violations. - [Onboard Okta](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/cloud-security/cortex-cloud-saas-security/connect-a-saas-application/onboard-okta.md): Connect an Okta instance in Cortex XSIAM to detect posture risks and compliance violations. - [Onboard PagerDuty](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/cloud-security/cortex-cloud-saas-security/connect-a-saas-application/onboard-pagerduty.md): Connect a PagerDuty instance in Cortex XSIAM to detect posture risks and compliance violations. - [Onboard Redis Labs](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/cloud-security/cortex-cloud-saas-security/connect-a-saas-application/onboard-redis-labs.md): Connect a Redis Labs instance in Cortex XSIAM to detect posture risks and compliance violations. - [Onboard Salesforce](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/cloud-security/cortex-cloud-saas-security/connect-a-saas-application/onboard-salesforce.md): Connect a Salesforce instance in Cortex XSIAM to detect posture risks and compliance violations. - [Onboard SAP Ariba](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/cloud-security/cortex-cloud-saas-security/connect-a-saas-application/onboard-sap-ariba.md): Connect an SAP Ariba instance in Cortex XSIAM to detect posture risks and compliance violations. - [Onboard Sentry](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/cloud-security/cortex-cloud-saas-security/connect-a-saas-application/onboard-sentry.md): Connect a Sentry instance in Cortex XSIAM to detect posture risks and compliance violations. - [Onboard ServiceNow](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/cloud-security/cortex-cloud-saas-security/connect-a-saas-application/onboard-servicenow.md): Connect a ServiceNow instance in Cortex XSIAM to detect posture risks and compliance violations. - [Onboard Shopify](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/cloud-security/cortex-cloud-saas-security/connect-a-saas-application/onboard-shopify.md): Connect a Shopify instance in Cortex XSIAM to detect posture risks and compliance violations. - [Onboard Slack Enterprise](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/cloud-security/cortex-cloud-saas-security/connect-a-saas-application/onboard-slack-enterprise.md): Connect a Slack instance in Cortex XSIAM to detect posture risks and compliance violations. - [Onboard Sumo Logic](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/cloud-security/cortex-cloud-saas-security/connect-a-saas-application/onboard-sumo-logic.md): Connect a Sumo Logic instance in Cortex XSIAM to detect posture risks and compliance violations. - [Onboard Workday](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/cloud-security/cortex-cloud-saas-security/connect-a-saas-application/onboard-workday.md): Connect a Workday instance in Cortex XSIAM to detect posture risks and compliance violations. - [Onboard Wrike](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/cloud-security/cortex-cloud-saas-security/connect-a-saas-application/onboard-wrike.md): Connect a Wrike instance in Cortex XSIAM to detect posture risks and compliance violations. - [Onboard YouTrack](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/cloud-security/cortex-cloud-saas-security/connect-a-saas-application/onboard-youtrack.md): Connect a YouTrack instance in Cortex XSIAM to detect posture risks and compliance violations. - [SaaS Security Overview](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/cloud-security/cortex-cloud-saas-security/saas-security-overview.md): Use the SaaS Security Overview in Cortex XSIAM to monitor posture, identity, data, and AI agent security. - [SaaS Security Checks](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/cloud-security/cortex-cloud-saas-security/saas-security-checks.md): Use SaaS Security Checks in Cortex XSIAM to identify at-risk assets and prioritize remediation. - [Provider Instances Security Check](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/cloud-security/cortex-cloud-saas-security/provider-instances-security-check.md): Use Provider Instances Security Check in Cortex XSIAM to assess security posture across application instances. - [Detection Rules](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/cloud-security/cortex-cloud-saas-security/detection-rules.md): View Cloud Security Posture Rules in Cortex XSIAM to detect SaaS application risks. - [Remediation Actions](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/cloud-security/cortex-cloud-saas-security/remediation-actions.md): Use remediation actions in Cortex XSIAM to resolve SaaS Security issues. - [Create and monitor tickets](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/cloud-security/cortex-cloud-saas-security/create-and-monitor-tickets.md): Create and monitor synced tickets in Cortex XSIAM to remediate SaaS Security issues. - [SaaS AI Agent Security](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/cloud-security/cortex-cloud-saas-security/saas-ai-agent-security.md): Use SaaS AI Agent Security in Cortex XSIAM to secure enterprise SaaS AI agents. - [Setup SaaS Security for AISPM](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/cloud-security/cortex-cloud-saas-security/saas-ai-agent-security/setup-saas-security-for-aispm.md): Get started with SaaS AI Agent Security in Cortex XSIAM. - [Onboard SaaS AI Agents](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/cloud-security/cortex-cloud-saas-security/saas-ai-agent-security/onboard-saas-ai-agents.md): Learn how to onboard supported SaaS AI agents in Cortex XSIAM. - [Onboard Atlassian Rovo](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/cloud-security/cortex-cloud-saas-security/saas-ai-agent-security/onboard-saas-ai-agents/onboard-atlassian-rovo.md): Connect Atlassian Rovo in Cortex XSIAM SaaS Agent Security for visibility and control across your AI ecosystem. - [Onboard Box AI Agents](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/cloud-security/cortex-cloud-saas-security/saas-ai-agent-security/onboard-saas-ai-agents/onboard-box-ai-agents.md): Connect Box AI Agents in Cortex XSIAM SaaS Agent Security for visibility and control across your AI ecosystem. - [Onboard ChatGPT Enterprise](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/cloud-security/cortex-cloud-saas-security/saas-ai-agent-security/onboard-saas-ai-agents/onboard-chatgpt-enterprise.md): Connect ChatGPT Enterprise in Cortex XSIAM SaaS Agent Security for visibility and control across your AI ecosystem. - [Onboard Cursor Enterprise](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/cloud-security/cortex-cloud-saas-security/saas-ai-agent-security/onboard-saas-ai-agents/onboard-cursor-enterprise.md): Connect Cursor Enterprise in Cortex XSIAM SaaS Agent Security for visibility and control across your AI ecosystem. - [Onboard Gemini Enterprise](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/cloud-security/cortex-cloud-saas-security/saas-ai-agent-security/onboard-saas-ai-agents/onboard-gemini-enterprise.md): Connect Gemini Enterprise in Cortex XSIAM SaaS Agent Security for visibility and control across your AI ecosystem. - [Onboard M365 Copilot](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/cloud-security/cortex-cloud-saas-security/saas-ai-agent-security/onboard-saas-ai-agents/onboard-m365-copilot.md): Connect M365 Copilot in Cortex XSIAM SaaS Agent Security for visibility and control across your AI ecosystem. - [Onboard Microsoft Copilot Studio](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/cloud-security/cortex-cloud-saas-security/saas-ai-agent-security/onboard-saas-ai-agents/onboard-microsoft-copilot-studio.md): Connect Microsoft Copilot Studio in Cortex XSIAM SaaS Agent Security for visibility and control across your AI ecosystem. - [Onboard Service Now](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/cloud-security/cortex-cloud-saas-security/saas-ai-agent-security/onboard-saas-ai-agents/onboard-service-now.md): Connect ServiceNow in Cortex XSIAM SaaS Agent Security for visibility and control across your AI ecosystem. - [Manage SaaS AI Agents](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/cloud-security/cortex-cloud-saas-security/saas-ai-agent-security/manage-saas-ai-agents.md): Manage SaaS AI agents in Cortex XSIAM, including agents, datasets, and connected tools. - [View AI Agents](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/cloud-security/cortex-cloud-saas-security/saas-ai-agent-security/manage-saas-ai-agents/view-ai-agents.md): View SaaS AI agents in Cortex XSIAM to assess their security context. - [View Datasets](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/cloud-security/cortex-cloud-saas-security/saas-ai-agent-security/manage-saas-ai-agents/view-datasets.md): View inference datasets in Cortex XSIAM SaaS AI Agent Security. - [View Agent Tools](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/cloud-security/cortex-cloud-saas-security/saas-ai-agent-security/manage-saas-ai-agents/view-agent-tools.md): View tools connected to SaaS AI agents in Cortex XSIAM. - [Cortex Cloud AI Security](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/cloud-security/cortex-cloud-ai-security.md): Explore Cloud AI Security in Cortex XSIAM for AI asset discovery, risk detection, and security investigations. - [What is Cortex Cloud AI Security?](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/cloud-security/cortex-cloud-ai-security/what-is-cortex-cloud-ai-security.md): Learn how Cloud AI Security in Cortex XSIAM discovers AI assets, assesses risks, and supports remediation. - [Supported services in Cortex Cloud AI Security](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/cloud-security/cortex-cloud-ai-security/supported-services-in-cortex-cloud-ai-security.md): Review platforms and services supported by AI Security in Cortex XSIAM. - [Cortex Cloud AI Security concepts](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/cloud-security/cortex-cloud-ai-security/cortex-cloud-ai-security-concepts.md): Learn Cloud AI Security concepts in Cortex XSIAM, including AI assets, risks, and findings. - [Cortex Cloud AI Security use cases](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/cloud-security/cortex-cloud-ai-security/cortex-cloud-ai-security-use-cases.md): Explore Cloud AI Security use cases in Cortex XSIAM for discovering, assessing, and securing AI systems. - [How to perform advanced AI Security investigations using XQL](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/cloud-security/cortex-cloud-ai-security/how-to-perform-advanced-ai-security-investigations-using-xql.md): Use XQL in Cortex XSIAM to investigate Cloud AI Security datasets and findings. - [Serverless function posture security](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/cloud-security/serverless-function-posture-security.md): Cortex XSIAM scans AWS, GCP, and Azure serverless functions for vulnerabilities, malware, and exposed secrets. - [Onboard cloud providers for serverless functions](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/cloud-security/serverless-function-posture-security/onboard-cloud-providers-for-serverless-functions.md): Connect cloud provider accounts to scan serverless functions for security vulnerabilities, malware, and exposed secrets in Cortex XSIAM. - [Serverless function posture rules](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/cloud-security/serverless-function-posture-security/serverless-function-posture-rules.md): Create and manage custom posture rules to identify attack paths, configuration issues, and network exposure in serverless functions in Cortex XSIAM. - [Manage serverless function rules](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/cloud-security/serverless-function-posture-security/serverless-function-posture-rules/manage-serverless-function-rules.md): Manage, edit, and clone serverless function security rules in Cortex XSIAM. - [Create serverless function rules](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/cloud-security/serverless-function-posture-security/serverless-function-posture-rules/create-serverless-function-rules.md): Create attack path, configuration, and network exposure rules in Cortex XSIAM. - [Create an attack path rule for serverless functions](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/cloud-security/serverless-function-posture-security/serverless-function-posture-rules/create-an-attack-path-rule-for-serverless-functions.md): Create serverless function attack path rules to identify connected risks in Cortex XSIAM. - [Create a configuration rule for serverless functions](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/cloud-security/serverless-function-posture-security/serverless-function-posture-rules/create-a-configuration-rule-for-serverless-functions.md): Create serverless function configuration rules to detect misconfigurations in Cortex XSIAM. - [Create a network exposure rule for serverless functions](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/cloud-security/serverless-function-posture-security/serverless-function-posture-rules/create-a-network-exposure-rule-for-serverless-functions.md): Create serverless function network exposure rules to find internet access in Cortex XSIAM. - [Serverless function posture policies](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/cloud-security/serverless-function-posture-security/serverless-function-posture-policies.md): Create and manage serverless function posture policies to detect threats and drive remediation in Cortex XSIAM. - [Manage serverless function policies](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/cloud-security/serverless-function-posture-security/serverless-function-posture-policies/manage-serverless-function-policies.md): Manage serverless function policies, scopes, and response actions in Cortex XSIAM. - [Create serverless function policies](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/cloud-security/serverless-function-posture-security/serverless-function-posture-policies/create-serverless-function-policies.md): Create serverless function policies with rules and cloud account scopes in Cortex XSIAM. - [Serverless function usage](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/cloud-security/serverless-function-posture-security/serverless-function-usage.md): Manage serverless function assets, vulnerabilities, findings, and scan health in Cortex XSIAM. - [Cortex Cloud Application Security](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/cloud-security/cortex-cloud-application-security.md): Discover Cortex XSIAM Application Security for ASPM, supply chain security, and code security. - [Registry scanning](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/cloud-security/container-registry-scanning.md): Connect and scan cloud and third-party container registries in Cortex XSIAM to identify image vulnerabilities, malware, exposed secrets, and policy violations. - [Supported container registry integrations](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/cloud-security/container-registry-scanning/supported-container-registry-integrations.md): Learn about supported container registry integrations in Cortex XSIAM - [How Container Registry Scanning Works](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/cloud-security/container-registry-scanning/how-container-registry-scanning-works.md): Learn how Cortex XSIAM discovers, scans, and evaluates container images in onboarded registries to identify and continuously monitor security risks. - [Scan re-evaluation process](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/cloud-security/container-registry-scanning/how-container-registry-scanning-works/scan-re-evaluation-process.md): Understand how Cortex XSIAM re-evaluates container registry scan results. - [Configure registry scanning for cloud accounts](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/cloud-security/container-registry-scanning/configure-registry-scanning-for-cloud-accounts.md): Configure Cortex XSIAM to scan container registries in connected cloud accounts. - [Modify the container registry scanning scope](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/cloud-security/container-registry-scanning/configure-registry-scanning-for-cloud-accounts/modify-the-container-registry-scanning-scope.md): Modify the Cortex XSIAM container registry scanning scope for cloud accounts and registries. - [Configure registry scanning for third party integrations](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/cloud-security/container-registry-scanning/configure-registry-scanning-for-third-party-integrations.md): Learn how to configure Cortex XSIAM to scan container registries in third-party integrations - [Manage registry scanning with APIs](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/cloud-security/container-registry-scanning/manage-registry-scanning-with-apis.md): Learn how to onboard and manage registry scanning programatically with APIs for Cortex XSIAM. - [Web and API Security (WAAS)](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/cloud-security/overview.md): Use Cortex XSIAM Web and API Security (WAAS) to discover, assess, monitor, and protect APIs and web workloads. - [Personas workflow](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/cloud-security/overview/personas-workflow.md): Cortex XSIAM API security responsibilities and workflows for SOC analysts, security practitioners, and workload owners. - [Secure your API landscape](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/cloud-security/overview/secure-your-api-landscape.md): Secure APIs in Cortex XSIAM through gateway integration, risk assessment, threat monitoring, specification validation, and workload protection. - [Gain visibility and assess risk of API endpoints](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/cloud-security/overview/secure-your-api-landscape/gain-visibility-and-assess-risk-of-api-endpoints.md): Use Cortex XSIAM to discover API endpoints, inspect traffic, assess risks, and investigate API security findings. - [Monitor and investigate API threats](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/cloud-security/overview/secure-your-api-landscape/monitor-and-investigate-api-threats.md): Monitor, investigate, and respond to API attacks, threats, and security issues in Cortex XSIAM. - [Configure API security from end to end](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/cloud-security/overview/secure-your-api-landscape/configure-api-security-from-end-to-end.md): Configure Cortex XSIAM API security with gateway integrations, traffic collection, and agent-based protection policies. - [Ingest AWS API Gateway](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/cloud-security/overview/secure-your-api-landscape/configure-api-security-from-end-to-end/ingest-aws-api-gateway.md): Ingest AWS API Gateway logs into Cortex XSIAM for API traffic analysis, threat detection, and risk assessment. - [Ingest Azure APIM](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/cloud-security/overview/secure-your-api-landscape/configure-api-security-from-end-to-end/ingest-azure-apim.md): Ingest Azure API Management traffic into Cortex XSIAM for API security analysis, risk assessment, and threat detection. - [Ingest Apigee Proxy](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/cloud-security/overview/secure-your-api-landscape/configure-api-security-from-end-to-end/ingest-apigee-proxy.md): Configure Apigee Proxy traffic ingestion into Cortex XSIAM for API security analysis and threat detection. - [Ingest Kong](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/cloud-security/overview/secure-your-api-landscape/configure-api-security-from-end-to-end/ingest-kong.md): Configure Kong API gateway traffic ingestion into Cortex XSIAM for API security analysis and threat detection. - [Ingest F5](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/cloud-security/overview/secure-your-api-landscape/configure-api-security-from-end-to-end/ingest-f5.md): Configure F5 BIG-IP LTM traffic ingestion into Cortex XSIAM for API security analysis and threat detection. - [Agent-based protection](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/cloud-security/overview/secure-your-api-landscape/configure-api-security-from-end-to-end/agent-based-protection.md): Use Cortex XSIAM agent-based Web and API Security profiles to monitor or block threats on Linux workloads. - [Set up Web and API Security profiles](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/cloud-security/overview/secure-your-api-landscape/configure-api-security-from-end-to-end/agent-based-protection/set-up-web-and-api-security-profiles.md): Configure Cortex XSIAM Web and API Security profiles to detect, report, or block threats on Linux workloads. - [Apply Web and API Security profiles to workloads](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/cloud-security/overview/secure-your-api-landscape/configure-api-security-from-end-to-end/agent-based-protection/apply-web-and-api-security-profiles-to-workloads.md): Apply Cortex XSIAM Web and API Security profiles through prevention policies for selected workloads and workload groups. - [Manage Web and API Security prevention profiles](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/cloud-security/overview/secure-your-api-landscape/configure-api-security-from-end-to-end/agent-based-protection/manage-web-and-api-security-prevention-profiles.md): Manage Cortex XSIAM Web and API Security prevention profiles, including policy usage, editing, exporting, and deletion. - [Add a disable prevention rule for cloud workloads](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/cloud-security/overview/secure-your-api-landscape/configure-api-security-from-end-to-end/agent-based-protection/add-a-disable-prevention-rule-for-cloud-workloads.md): Create Cortex XSIAM Web and API Security rules that disable selected prevention actions for cloud workloads. - [Add a support exception rule for cloud workloads](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/cloud-security/overview/secure-your-api-landscape/configure-api-security-from-end-to-end/agent-based-protection/add-a-support-exception-rule-for-cloud-workloads.md): Import Cortex XSIAM support exception rules for Web and API Security protection on cloud workloads. - [Add a legacy exception rule for cloud workloads](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/cloud-security/overview/secure-your-api-landscape/configure-api-security-from-end-to-end/agent-based-protection/add-a-legacy-exception-rule-for-cloud-workloads.md): Create legacy Cortex XSIAM Web and API Security exception rules for prevention modules on cloud workloads. - [Additional workload management tasks](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/cloud-security/overview/secure-your-api-landscape/configure-api-security-from-end-to-end/agent-based-protection/additional-workload-management-tasks.md): Manage Cortex XSIAM workloads and workload groups for Web and API Security protection and related endpoint tasks. - [API specification inventory](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/cloud-security/overview/secure-your-api-landscape/api-specification-inventory.md): Use Cortex XSIAM API specification inventory to import, validate, scan, and assess OpenAPI specifications. - [Serverless function runtime security](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/cloud-security/overview-1.md): Cortex XSIAM serverless function runtime security: monitor AWS function activity, enforce policies, and investigate violations. - [Set up serverless function protection](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/cloud-security/overview-1/set-up-serverless-function-protection.md): Set up Cortex XSIAM serverless function protection with restriction profiles, policy rules, and agent packages. - [Serverless runtime issues](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/cloud-security/overview-1/serverless-runtime-issues.md): Investigate Cortex XSIAM serverless runtime issues from process, network, and filesystem policy violations. - [Cortex Data Security](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/data-security/cortex-data-security.md): Discover, classify, protect, and govern sensitive data across your organization in Cortex XSIAM. - [Cortex XSIAM XQL](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/reference-and-developer-docs/cortex-agentix-xql.md): Learn how to use XQL to query and investigate data in Cortex XSIAM. - [Get started with XQL](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/reference-and-developer-docs/cortex-agentix-xql/get-started-with-xql.md): XQL is the Palo Alto Networks Cortex Query Language used in Cortex XSIAM. - [XQL language features](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/reference-and-developer-docs/cortex-agentix-xql/get-started-with-xql/xql-language-features.md): Learn about XQL language features for querying network and endpoint data in Cortex XSIAM. - [XQL Language Structure](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/reference-and-developer-docs/cortex-agentix-xql/get-started-with-xql/xql-language-structure.md): Learn about XQL language structure for creating queries in Cortex XSIAM. - [Supported operators](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/reference-and-developer-docs/cortex-agentix-xql/get-started-with-xql/supported-operators.md): Learn about XQL comparison, boolean, and set operators in Cortex XSIAM. - [Datasets and presets](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/reference-and-developer-docs/cortex-agentix-xql/get-started-with-xql/datasets-and-presets.md): Learn about XQL built-in datasets, custom datasets, and presets in Cortex XSIAM. - [About examples](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/reference-and-developer-docs/cortex-agentix-xql/get-started-with-xql/about-examples.md): Explore XQL query examples in Cortex XSIAM. - [JSON functions](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/reference-and-developer-docs/cortex-agentix-xql/get-started-with-xql/json-functions.md): Learn how to use JSON functions in XQL in Cortex XSIAM. - [How to filter for empty values in the results table](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/reference-and-developer-docs/cortex-agentix-xql/get-started-with-xql/how-to-filter-for-empty-values-in-the-results-table.md): Learn how to filter empty values in XQL results in Cortex XSIAM. - [Understanding string manipulation in XQL](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/reference-and-developer-docs/cortex-agentix-xql/get-started-with-xql/understanding-string-manipulation-in-xql.md): Learn how to manipulate strings in XQL using double and triple quotes in Cortex XSIAM. - [Build XQL queries](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/reference-and-developer-docs/cortex-agentix-xql/build-xql-queries.md): Build XQL queries with Query Builder in Cortex XSIAM. - [About the Query Builder](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/reference-and-developer-docs/cortex-agentix-xql/build-xql-queries/about-the-query-builder.md): Learn how Query Builder supports threat detection and data analysis in Cortex XSIAM. - [How to build XQL queries](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/reference-and-developer-docs/cortex-agentix-xql/build-xql-queries/how-to-build-xql-queries.md): Learn how to build XQL queries with Query Builder in Cortex XSIAM. - [Get started with XQL queries](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/reference-and-developer-docs/cortex-agentix-xql/build-xql-queries/how-to-build-xql-queries/get-started-with-xql-queries.md): Get started with building XQL queries in Cortex XSIAM. - [Useful XQL user interface features](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/reference-and-developer-docs/cortex-agentix-xql/build-xql-queries/how-to-build-xql-queries/useful-xql-user-interface-features.md): Explore Query Builder features for creating XQL queries in Cortex XSIAM. - [XQL Query best practices](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/reference-and-developer-docs/cortex-agentix-xql/build-xql-queries/how-to-build-xql-queries/xql-query-best-practices.md): Apply XQL query best practices for efficient results in Cortex XSIAM. - [Expected results when querying fields](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/reference-and-developer-docs/cortex-agentix-xql/build-xql-queries/how-to-build-xql-queries/expected-results-when-querying-fields.md): Understand expected XQL field query results in Cortex XSIAM. - [Create XQL query](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/reference-and-developer-docs/cortex-agentix-xql/build-xql-queries/how-to-build-xql-queries/create-xql-query.md): Create and run XQL queries with Query Builder in Cortex XSIAM. - [Review XQL query results](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/reference-and-developer-docs/cortex-agentix-xql/build-xql-queries/how-to-build-xql-queries/review-xql-query-results.md): Review and analyze XQL query results in Cortex XSIAM. - [Translate to XQL](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/reference-and-developer-docs/cortex-agentix-xql/build-xql-queries/how-to-build-xql-queries/translate-to-xql.md): Translate search logic into XQL with Query Builder in Cortex XSIAM. - [Graph query results](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/reference-and-developer-docs/cortex-agentix-xql/build-xql-queries/how-to-build-xql-queries/graph-query-results.md): Visualize XQL query results as graphs in Cortex XSIAM. - [Query Builder templates](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/reference-and-developer-docs/cortex-agentix-xql/build-xql-queries/query-builder-templates.md): Use Query Builder templates to query data without writing XQL in Cortex XSIAM. - [Get started with Query Builder templates](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/reference-and-developer-docs/cortex-agentix-xql/build-xql-queries/query-builder-templates/get-started-with-query-builder-templates.md): Get started with Query Builder templates for guided queries in Cortex XSIAM. - [Considerations for using Query Builder templates](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/reference-and-developer-docs/cortex-agentix-xql/build-xql-queries/query-builder-templates/considerations-for-using-query-builder-templates.md): Review Query Builder template considerations in Cortex XSIAM. - [Create a query from a template](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/reference-and-developer-docs/cortex-agentix-xql/build-xql-queries/query-builder-templates/create-a-query-from-a-template.md): Create an XQL query from a Query Builder template in Cortex XSIAM. - [Run a free text query](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/reference-and-developer-docs/cortex-agentix-xql/build-xql-queries/query-builder-templates/run-a-free-text-query.md): Run free-text queries with Query Builder templates in Cortex XSIAM. - [Query Builder template examples](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/reference-and-developer-docs/cortex-agentix-xql/build-xql-queries/query-builder-templates/query-builder-template-examples.md): Explore Query Builder template examples for data queries in Cortex XSIAM. - [Overview of the Query Center](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/reference-and-developer-docs/cortex-agentix-xql/build-xql-queries/overview-of-the-query-center.md): View in-progress and completed queries in Query Center in Cortex XSIAM. - [Edit and run queries in Query Center](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/reference-and-developer-docs/cortex-agentix-xql/build-xql-queries/overview-of-the-query-center/edit-and-run-queries-in-query-center.md): Edit and run XQL queries from Query Center in Cortex XSIAM. - [Query Center reference information](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/reference-and-developer-docs/cortex-agentix-xql/build-xql-queries/overview-of-the-query-center/query-center-reference-information.md): Reference Query Center details, fields, and statuses in Cortex XSIAM. - [Manage scheduled queries](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/reference-and-developer-docs/cortex-agentix-xql/build-xql-queries/manage-scheduled-queries.md): Manage scheduled and recurring XQL queries in Cortex XSIAM. - [Scheduled Queries reference information](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/reference-and-developer-docs/cortex-agentix-xql/build-xql-queries/manage-scheduled-queries/scheduled-queries-reference-information.md): Reference scheduled query settings and run details in Cortex XSIAM. - [Manage your personal query library](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/reference-and-developer-docs/cortex-agentix-xql/build-xql-queries/manage-your-personal-query-library.md): Save and manage personal XQL queries in the Query Library in Cortex XSIAM. - [XQL macros](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/reference-and-developer-docs/cortex-agentix-xql/build-xql-queries/xql-macros.md): Use XQL macros to reuse query logic in Cortex XSIAM. - [Manage your macros](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/reference-and-developer-docs/cortex-agentix-xql/build-xql-queries/manage-your-macros.md): Create and manage XQL macros in Cortex XSIAM. - [Federated Search](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/reference-and-developer-docs/cortex-agentix-xql/build-xql-queries/federated-search.md): Use Federated Search to query external data sources in Cortex XSIAM. - [Federated Search configuration](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/reference-and-developer-docs/cortex-agentix-xql/build-xql-queries/federated-search/federated-search-configuration.md): Configure Federated Search connections for external data in Cortex XSIAM. - [Query using Federated Search](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/reference-and-developer-docs/cortex-agentix-xql/build-xql-queries/federated-search/query-using-federated-search.md): Query external data sources with Federated Search in Cortex XSIAM. - [Manage external datasets](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/reference-and-developer-docs/cortex-agentix-xql/build-xql-queries/federated-search/manage-external-datasets.md): Manage external datasets used by Federated Search in Cortex XSIAM. - [Legacy Query Builder](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/reference-and-developer-docs/cortex-agentix-xql/build-xql-queries/legacy-query-builder.md): Use Legacy Query Builder to query security data entities in Cortex XSIAM. - [Create authentication query](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/reference-and-developer-docs/cortex-agentix-xql/build-xql-queries/legacy-query-builder/create-authentication-query.md): Create legacy authentication queries in Cortex XSIAM. - [Create event log query](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/reference-and-developer-docs/cortex-agentix-xql/build-xql-queries/legacy-query-builder/create-event-log-query.md): Create legacy event log queries in Cortex XSIAM. - [Create file query](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/reference-and-developer-docs/cortex-agentix-xql/build-xql-queries/legacy-query-builder/create-file-query.md): Create legacy file queries in Cortex XSIAM. - [Create image load query](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/reference-and-developer-docs/cortex-agentix-xql/build-xql-queries/legacy-query-builder/create-image-load-query.md): Create legacy image load queries in Cortex XSIAM. - [Create network connections query](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/reference-and-developer-docs/cortex-agentix-xql/build-xql-queries/legacy-query-builder/create-network-connections-query.md): Create legacy network connection queries in Cortex XSIAM. - [Create network query](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/reference-and-developer-docs/cortex-agentix-xql/build-xql-queries/legacy-query-builder/create-network-query.md): Create legacy network queries in Cortex XSIAM. - [Create process query](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/reference-and-developer-docs/cortex-agentix-xql/build-xql-queries/legacy-query-builder/create-process-query.md): Create legacy process queries in Cortex XSIAM. - [Create registry query](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/reference-and-developer-docs/cortex-agentix-xql/build-xql-queries/legacy-query-builder/create-registry-query.md): Create legacy registry queries in Cortex XSIAM. - [Query across all entities](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/reference-and-developer-docs/cortex-agentix-xql/build-xql-queries/legacy-query-builder/query-across-all-entities.md): Create legacy queries across security data entities in Cortex XSIAM. - [Cortex XQL syntax, parameters, and examples](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/reference-and-developer-docs/cortex-agentix-xql/cortex-xql-syntax-parameters-and-examples.md): Comprehensive syntax rules and structural requirements for XQL queries in Cortex XSIAM. - [Graph Search](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/reference-and-developer-docs/graph-search.md): Explore Graph Search for cloud assets and findings in Cortex XSIAM. - [What is Graph Search?](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/reference-and-developer-docs/graph-search/what-is-graph-search.md): Learn how Graph Search connects assets, findings, and context in Cortex XSIAM. - [Get started with Graph Search queries](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/reference-and-developer-docs/graph-search/get-started-with-graph-search-queries.md): Get started with building Graph Search queries in Cortex XSIAM. - [How to build Graph Search queries?](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/reference-and-developer-docs/graph-search/how-to-build-graph-search-queries.md): Build Graph Search queries with the query interface in Cortex XSIAM. - [Understand Graph Search query results](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/reference-and-developer-docs/graph-search/understand-graph-search-query-results.md): Understand and analyze Graph Search query results in Cortex XSIAM. - [Create Graph Search query](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/reference-and-developer-docs/graph-search/create-graph-search-query.md): Create Graph Search queries to investigate assets and findings in Cortex XSIAM. - [Graph Search examples](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/reference-and-developer-docs/graph-search/graph-search-examples.md): Explore Graph Search query examples for investigations in Cortex XSIAM. - [Manage the Graph Search Query Library](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/reference-and-developer-docs/graph-search/manage-the-graph-search-query-library.md): Manage saved Graph Search queries in the Query Library in Cortex XSIAM. - [Edit and run queries in Query Center](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/reference-and-developer-docs/graph-search/edit-and-run-queries-in-query-center.md): Edit, rerun, and review Graph Search queries in Query Center in Cortex XSIAM. - [Supported assets and findings](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/reference-and-developer-docs/graph-search/supported-assets-and-findings.md): Review assets and findings supported by Graph Search in Cortex XSIAM. - [FAQ on Graph Search](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/reference-and-developer-docs/graph-search/faq-on-graph-search.md): Find answers to common Graph Search questions in Cortex XSIAM. - [Create detection rules based on graph search](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/reference-and-developer-docs/graph-search/create-detection-rules-based-on-graph-search.md): Create detection rules from Graph Search queries in Cortex XSIAM. - [About Cortex CLI](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/reference-and-developer-docs/about-cortex-cli.md): Use Cortex CLI to run Code, API, and Cloud Workload Protection scans in Cortex XSIAM. - [Connect Cortex CLI](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/reference-and-developer-docs/about-cortex-cli/connect-cortex-cli.md): Connect Cortex CLI to configure scans and authentication in Cortex XSIAM. - [Installation workflows](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/reference-and-developer-docs/about-cortex-cli/connect-cortex-cli/installation-workflows.md): Install Cortex CLI for security scans in Cortex XSIAM. - [Manage the CLI after installation](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/reference-and-developer-docs/about-cortex-cli/connect-cortex-cli/manage-the-cli-after-installation.md): Manage Cortex CLI installations and updates for security scans in Cortex XSIAM. - [Authenticate credentials](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/reference-and-developer-docs/about-cortex-cli/connect-cortex-cli/authenticate-credentials.md): Configure Cortex CLI credentials for secure scans in Cortex XSIAM. - [Self-service API keys for CLI scans](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/reference-and-developer-docs/about-cortex-cli/connect-cortex-cli/self-service-api-keys-for-cli-scans.md): Create self-service API keys for Cortex CLI scans in Cortex XSIAM. - [Cortex CLI usage](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/reference-and-developer-docs/about-cortex-cli/cortex-cli-usage.md): Run Cortex CLI commands for security scans in Cortex XSIAM. - [Exit codes and error handling](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/reference-and-developer-docs/about-cortex-cli/exit-codes-and-error-handling.md) - [Cortex CLI common command line reference guide](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/reference-and-developer-docs/about-cortex-cli/cortex-cli-common-command-line-reference-guide.md): Reference common Cortex CLI commands for security scans in Cortex XSIAM. - [Cortex CLI for Code Security](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/reference-and-developer-docs/about-cortex-cli/cortex-cli-for-code-security.md): Use Cortex CLI to scan application code and repositories in Cortex XSIAM. - [Cortex CLI usage for Cortex Cloud Application Security](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/reference-and-developer-docs/about-cortex-cli/cortex-cli-for-code-security/cortex-cli-usage-for-application-security.md): Run Cortex CLI Code Security scans for applications in Cortex XSIAM. - [Cortex CLI Cortex Cloud Application Security command line reference](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/reference-and-developer-docs/about-cortex-cli/cortex-cli-for-code-security/cortex-cli-application-security-command-line-reference.md): Reference Cortex CLI commands for Application Security scans in Cortex XSIAM. - [Custom Cortex checks and signature verification](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/reference-and-developer-docs/about-cortex-cli/cortex-cli-for-code-security/cortex-cli-application-security-command-line-reference/custom-cortex-checks-and-signature-verification.md): Load and verify custom Cortex checks with Cortex CLI in Cortex XSIAM. - [Cortex CLI pre-commit hooks](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/reference-and-developer-docs/about-cortex-cli/cortex-cli-for-code-security/cortex-cli-pre-commit-hooks.md): Use Cortex CLI pre-commit hooks to scan code before commits in Cortex XSIAM. - [Pre-commit hook usage](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/reference-and-developer-docs/about-cortex-cli/cortex-cli-for-code-security/cortex-cli-pre-commit-hooks/pre-commit-hook-usage.md): Run Cortex CLI pre-commit hooks for code security checks in Cortex XSIAM. - [Cortex CLI pre-receive hooks](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/reference-and-developer-docs/about-cortex-cli/cortex-cli-for-code-security/cortex-cli-pre-receive-hooks.md): Use Cortex CLI pre-receive hooks to scan code before acceptance in Cortex XSIAM. - [Pre-receive hook usage](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/reference-and-developer-docs/about-cortex-cli/cortex-cli-for-code-security/cortex-cli-pre-receive-hooks/pre-receive-hook-usage.md): Run Cortex CLI pre-receive hooks for code security checks in Cortex XSIAM. - [Cortex CLI for Cloud Workload Protection](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/reference-and-developer-docs/about-cortex-cli/cortex-cli-for-cloud-workload-protection.md): Use Cortex CLI for Cloud Workload Protection scans in Cortex XSIAM. - [Cloud Workload Protection command line reference](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/reference-and-developer-docs/about-cortex-cli/cortex-cli-for-cloud-workload-protection/cloud-workload-protection-command-line-reference.md): Reference Cortex CLI commands for Cloud Workload Protection scans in Cortex XSIAM. - [Cortex CLI for API Security](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/reference-and-developer-docs/about-cortex-cli/cortex-cli-for-api-security.md): Use Cortex CLI for API Security scans in Cortex XSIAM. - [Cortex CLI API Security command line reference guide](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/reference-and-developer-docs/about-cortex-cli/cortex-cli-for-api-security/cortex-cli-api-security-command-line-reference-guide.md): Reference Cortex CLI commands for API Security scans in Cortex XSIAM. - [API Security scan report schema](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/reference-and-developer-docs/about-cortex-cli/cortex-cli-for-api-security/cortex-cli-api-security-command-line-reference-guide/api-security-scan-report-schema.md): Reference the API Security scan report schema for Cortex CLI in Cortex XSIAM. - [API Security scan output example](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/reference-and-developer-docs/about-cortex-cli/cortex-cli-for-api-security/cortex-cli-api-security-command-line-reference-guide/api-security-scan-output-example.md): Review Cortex CLI API Security scan report output in Cortex XSIAM. - [Role-Based Access Control](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/reference-and-developer-docs/role-based-access-control.md): Learn how to limit role permissions in Cortex XSIAM. - [Role permissions by component](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/reference-and-developer-docs/role-based-access-control/role-permissions-by-component.md): Learn how to manage role permissions in Cortex XSIAM. - [Core tenant and administrative permissions](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/reference-and-developer-docs/role-based-access-control/core-tenant-and-administrative-permissions.md) - [Configuration permissions](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/reference-and-developer-docs/role-based-access-control/configuration-permissions.md): Learn about role permissions for Cortex XSIAM configuration components. - [Auditing permissions](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/reference-and-developer-docs/role-based-access-control/configuration-permissions/auditing-permissions.md): Manage access to Cortex XSIAM audit logs and administrative activity records. - [Alert Notifications permissions](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/reference-and-developer-docs/role-based-access-control/configuration-permissions/alert-notifications-permissions.md): Manage Cortex XSIAM alert notification rules, templates, and forwarding settings. - [General Configuration permissions](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/reference-and-developer-docs/role-based-access-control/configuration-permissions/general-configuration-permissions.md): Manage access to Cortex XSIAM general settings and system-wide configuration. - [Cortex XDR Analytics permissions](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/reference-and-developer-docs/role-based-access-control/configuration-permissions/cortex-xdr-analytics-permissions.md): Manage access to Cortex XSIAM analytics configuration and related settings. - [Access management permissions](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/reference-and-developer-docs/role-based-access-control/configuration-permissions/access-management-permissions.md): Manage access to Cortex XSIAM users, roles, and access management settings. - [Data Broker permissions](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/reference-and-developer-docs/role-based-access-control/configuration-permissions/data-broker-permissions.md): Manage access to Cortex XSIAM Data Broker configuration and operations. - [Log Collection permissions](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/reference-and-developer-docs/role-based-access-control/configuration-permissions/log-collection-permissions.md): Manage access to Cortex XSIAM log collection configuration and data sources. - [Data Sources permissions](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/reference-and-developer-docs/role-based-access-control/configuration-permissions/data-sources-permissions.md): Manage access to Cortex XSIAM data source configuration and ingestion settings. - [External Issues Mapping permissions](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/reference-and-developer-docs/role-based-access-control/configuration-permissions/external-issues-mapping-permissions.md): Manage access to Cortex XSIAM mappings for external issue integrations. - [Integrations - instance permissions](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/reference-and-developer-docs/role-based-access-control/configuration-permissions/integrations-instance-permissions.md): Manage access to individual Cortex XSIAM integration instances and settings. - [Integrations Permissions](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/reference-and-developer-docs/role-based-access-control/configuration-permissions/integrations-permissions.md): Manage access to Cortex XSIAM integration configuration and available instances. - [Data Management permissions](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/reference-and-developer-docs/role-based-access-control/configuration-permissions/data-management-permissions.md): Manage access to Cortex XSIAM data management and retention settings. - [Public API](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/reference-and-developer-docs/role-based-access-control/configuration-permissions/public-api.md): Manage access to Cortex XSIAM public API configuration and credentials. - [Threat Intelligence permission - API configuration](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/reference-and-developer-docs/role-based-access-control/configuration-permissions/threat-intelligence-permission-api-configuration.md): Manage access to Cortex XSIAM Threat Intelligence API configuration. - [Long-running HTTP Integrations configuration](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/reference-and-developer-docs/role-based-access-control/configuration-permissions/long-running-http-integrations-configuration.md): Manage access to Cortex XSIAM long-running HTTP integration configuration. - [Credentials permissions](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/reference-and-developer-docs/role-based-access-control/configuration-permissions/credentials-permissions.md): Manage access to Cortex XSIAM credentials and secure connection settings. - [Network Scanners permissions](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/reference-and-developer-docs/role-based-access-control/configuration-permissions/network-scanners-permissions.md): Manage access to Cortex XSIAM network scanner configuration and operations. - [Apps - Instance permissions](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/reference-and-developer-docs/role-based-access-control/configuration-permissions/apps-instance-permissions.md): Manage access to Cortex XSIAM app instances and their configuration. - [Object Setup permissions](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/reference-and-developer-docs/role-based-access-control/configuration-permissions/object-setup-permissions.md): Manage access to Cortex XSIAM object setup and related configuration. - [Case Properties permissions](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/reference-and-developer-docs/role-based-access-control/configuration-permissions/object-setup-permissions/case-properties-permissions.md): Configure access to case domains, custom statuses, and resolution statuses in Cortex XSIAM. - [Exclusion List permissions](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/reference-and-developer-docs/role-based-access-control/configuration-permissions/object-setup-permissions/exclusion-list-permissions.md): Control access to manage excluded threat indicators and their exclusion settings in Cortex XSIAM. - [Fields and Types permissions](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/reference-and-developer-docs/role-based-access-control/configuration-permissions/object-setup-permissions/fields-and-types-permissions.md): Control access to custom fields, indicator types, and SLA rule configurations in Cortex XSIAM. - [Layout permissions](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/reference-and-developer-docs/role-based-access-control/configuration-permissions/object-setup-permissions/layout-permissions.md): Control access to case and issue layouts, including their layout rules in Cortex XSIAM. - [Sync Profile permissions](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/reference-and-developer-docs/role-based-access-control/configuration-permissions/object-setup-permissions/sync-profile-permissions.md): Control access to sync profiles for mirroring cases with external platforms in Cortex XSIAM. - [Marketplace permissions](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/reference-and-developer-docs/role-based-access-control/marketplace-permissions.md): Control access to discover, install, and manage Marketplace content packs in Cortex XSIAM. - [Help permissions](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/reference-and-developer-docs/role-based-access-control/help-permissions.md): Control access to create and manage in-product technical support cases in Cortex XSIAM. - [SOC Operations, Investigation & Response permissions](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/reference-and-developer-docs/role-based-access-control/soc-operations-investigation-and-response-permissions.md) - [Dashboards and Reports permissions](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/reference-and-developer-docs/role-based-access-control/dashboards-and-reports-permissions.md): Set permissions for dashboards and reports in Cortex XSIAM. - [Dashboards permissions](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/reference-and-developer-docs/role-based-access-control/dashboards-and-reports-permissions/dashboards-permissions.md): Manage access to Cortex XSIAM dashboards, widgets, and dashboard sharing. - [Command Center Dashboard permissions](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/reference-and-developer-docs/role-based-access-control/dashboards-and-reports-permissions/command-center-dashboard-permissions.md): Manage access to Cortex XSIAM Command Center dashboards and their security metrics. - [Ingestion Monitoring dashboard permissions](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/reference-and-developer-docs/role-based-access-control/dashboards-and-reports-permissions/ingestion-monitoring-dashboard-permissions.md): Manage access to Cortex XSIAM data ingestion monitoring dashboards. - [Reports permissions](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/reference-and-developer-docs/role-based-access-control/dashboards-and-reports-permissions/reports-permissions.md): Manage access to Cortex XSIAM reports and custom report templates. - [Email Command Center permissions](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/reference-and-developer-docs/role-based-access-control/dashboards-and-reports-permissions/email-command-center-permissions.md): Manage access to the Cortex XSIAM Email Command Center and email threat metrics. - [Cloud Security Command Center permissions](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/reference-and-developer-docs/role-based-access-control/dashboards-and-reports-permissions/cloud-security-command-center-permissions.md): Manage access to the Cortex XSIAM Cloud Security Command Center. - [Cases and Issues permissions](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/reference-and-developer-docs/role-based-access-control/cases-and-issues-permissions.md): Control access to investigate, manage, and respond to cases and issues in Cortex XSIAM. - [Investigation and Response permissions](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/reference-and-developer-docs/role-based-access-control/investigation-and-response-permissions.md): Configure role permissions for search, response, and automation capabilities in Cortex XSIAM. - [Search permissions](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/reference-and-developer-docs/role-based-access-control/investigation-and-response-permissions/search-permissions.md): Configure access to threat hunting, query, and forensic investigation tools in Cortex XSIAM. - [Query Library permissions](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/reference-and-developer-docs/role-based-access-control/investigation-and-response-permissions/search-permissions/query-library-permissions.md): Manage access to saved XQL queries in Cortex XSIAM's Query Library. - [Query Center permissions](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/reference-and-developer-docs/role-based-access-control/investigation-and-response-permissions/search-permissions/query-center-permissions.md): Manage access to write, run, schedule, and export XQL queries in Cortex XSIAM. - [Forensics permissions](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/reference-and-developer-docs/role-based-access-control/investigation-and-response-permissions/search-permissions/forensics-permissions.md): Manage access to Cortex XSIAM forensic investigations, collections, and threat hunts. - [Host Insights permissions](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/reference-and-developer-docs/role-based-access-control/investigation-and-response-permissions/search-permissions/host-insights-permissions.md): Manage access to Cortex XSIAM's endpoint inventory, host details, and hygiene data. - [Graph Search permissions](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/reference-and-developer-docs/role-based-access-control/investigation-and-response-permissions/search-permissions/graph-search-permissions.md): Manage access to Cortex XSIAM's Graph Search for cloud assets and security findings. - [Response permissions](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/reference-and-developer-docs/role-based-access-control/investigation-and-response-permissions/response-permissions.md): Configure access to endpoint and network response actions and tools in Cortex XSIAM. - [Action Center permissions](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/reference-and-developer-docs/role-based-access-control/investigation-and-response-permissions/response-permissions/action-center-permissions.md): Manage access to Cortex XSIAM endpoint response actions and action history. - [EDL permissions](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/reference-and-developer-docs/role-based-access-control/investigation-and-response-permissions/response-permissions/edl-permissions.md): Manage Cortex XSIAM External Dynamic Lists for firewall-enforced threat blocking. - [Agent Scripts Library permissions](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/reference-and-developer-docs/role-based-access-control/investigation-and-response-permissions/response-permissions/agent-scripts-library-permissions.md): Manage Cortex XSIAM endpoint scripts for response, collection, and automation. - [Live Terminal permissions](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/reference-and-developer-docs/role-based-access-control/investigation-and-response-permissions/response-permissions/live-terminal-permissions.md): Manage Cortex XSIAM interactive endpoint shell access for investigation and remediation. - [Automation permissions](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/reference-and-developer-docs/role-based-access-control/investigation-and-response-permissions/automation-permissions.md): Configure permissions for playbooks, scripts, playground, and automated exclusions in Cortex XSIAM. - [Playbook permissions](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/reference-and-developer-docs/role-based-access-control/investigation-and-response-permissions/automation-permissions/playbook-permissions.md): Manage access to Cortex XSIAM playbooks and automated response workflows. - [Script permissions](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/reference-and-developer-docs/role-based-access-control/investigation-and-response-permissions/automation-permissions/script-permissions.md): Manage access to Cortex XSIAM scripts for automation and remediation. - [Jobs permissions](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/reference-and-developer-docs/role-based-access-control/investigation-and-response-permissions/automation-permissions/jobs-permissions.md): Manage access to Cortex XSIAM scheduled automation jobs and their execution. - [Playground permissions](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/reference-and-developer-docs/role-based-access-control/investigation-and-response-permissions/automation-permissions/playground-permissions.md): Manage access to the Cortex XSIAM playground for testing commands and scripts. - [Automation Exclusion Center permissions](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/reference-and-developer-docs/role-based-access-control/investigation-and-response-permissions/automation-permissions/automation-exclusion-center-permissions.md): Manage Cortex XSIAM automation exclusions for commands, scripts, and remediation. - [Jupyter and Observability apps permissions](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/reference-and-developer-docs/role-based-access-control/jupyter-and-observability-apps-permissions.md): Configure permissions to use Jupyter and Observability applications. - [Threat Management permissions](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/reference-and-developer-docs/role-based-access-control/threat-management-permissions.md): Configure Detection Rules and Threat Intel permissions in Cortex XSIAM. - [Detection Rules permissions](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/reference-and-developer-docs/role-based-access-control/threat-management-permissions/detection-rules-permissions.md): Configure Detection Rules permissions in Cortex XSIAM. - [Threat Intelligence permissions](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/reference-and-developer-docs/role-based-access-control/threat-management-permissions/threat-intelligence-permissions.md): Configure Threat Intelligence permissions in Cortex XSIAM - [Exceptions Configuration permissions](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/reference-and-developer-docs/role-based-access-control/exceptions-configuration-permissions.md): Configure issue exclusion permissions in Cortex XSIAM. - [Issue Exclusions permissions](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/reference-and-developer-docs/role-based-access-control/exceptions-configuration-permissions/issue-exclusions-permissions.md): Configure Issue Exclusions permissions in Cortex XSIAM. - [Exception Management Admin permissions](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/reference-and-developer-docs/role-based-access-control/exceptions-configuration-permissions/exception-management-admin-permissions.md): Configure Exception Management Admin permissions in Cortex XSIAM. - [Exception Approver Admin permissions](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/reference-and-developer-docs/role-based-access-control/exceptions-configuration-permissions/exception-approver-admin-permissions.md): Configure Exception Approver Admin permissions in Cortex XSIAM. - [Managed Services permissions](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/reference-and-developer-docs/role-based-access-control/managed-services-permissions.md): Configure access to Managed Services for Unit 42 Managed Threat Hunting and Managed Detection and Response. - [Cortex Agentic Assistant permissions](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/reference-and-developer-docs/role-based-access-control/cortex-agentic-assistant-permissions.md): Configure the Cortex Agentic Assistant permissions, which includes AI Prompts and Agent permissions in Cortex XSIAM. - [AI Prompts](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/reference-and-developer-docs/role-based-access-control/cortex-agentic-assistant-permissions/ai-prompts.md): Configure AI Prompts permissions in Cortex XSIAM. - [Cortex Agentic Assistant Agents](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/reference-and-developer-docs/role-based-access-control/cortex-agentic-assistant-permissions/cortex-agentic-assistant-agents.md): Configure Cortex Agentic Assistant Agents permissions in Cortex XSIAM. - [Agents and endpoint protection](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/reference-and-developer-docs/role-based-access-control/agents-and-endpoint-protection.md): Configure permissions for XDR Agent infrastructure and endpoint data loss prevention in Cortex XSIAM. - [Inventory - Agent permissions](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/reference-and-developer-docs/role-based-access-control/inventory-agent-permissions.md): Configure permissions for Endpoints (XDR Agent) in Cortex XSIAM. - [Agent Administrations](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/reference-and-developer-docs/role-based-access-control/inventory-agent-permissions/agent-administrations.md): Control access to endpoint inventory, agent health, and lifecycle operations in Cortex XSIAM. - [Agent Groups](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/reference-and-developer-docs/role-based-access-control/inventory-agent-permissions/agent-groups.md): Manage endpoint groups and policy targeting in Cortex XSIAM. - [Agent Prevention Policies](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/reference-and-developer-docs/role-based-access-control/inventory-agent-permissions/agent-prevention-policies.md): Configure endpoint prevention policies and protection settings in Cortex XSIAM. - [Global Exceptions](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/reference-and-developer-docs/role-based-access-control/inventory-agent-permissions/global-exceptions.md): Manage global prevention exceptions and their endpoint scope in Cortex XSIAM. - [Agent Profiles](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/reference-and-developer-docs/role-based-access-control/inventory-agent-permissions/agent-profiles.md): Configure endpoint agent profiles and communication settings in Cortex XSIAM. - [Agent Extension Policies](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/reference-and-developer-docs/role-based-access-control/inventory-agent-permissions/agent-extension-policies.md): Configure endpoint extension policies and capabilities in Cortex XSIAM. - [Agent Installations](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/reference-and-developer-docs/role-based-access-control/inventory-agent-permissions/agent-installations.md): Manage Cortex XSIAM agent installation packages and deployments. - [Host Firewall](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/reference-and-developer-docs/role-based-access-control/inventory-agent-permissions/host-firewall.md): Configure host firewall rules and review firewall events in Cortex XSIAM. - [Device Control](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/reference-and-developer-docs/role-based-access-control/inventory-agent-permissions/device-control.md): Manage device control policies, rules, and exceptions in Cortex XSIAM. - [Data Security - Endpoint DLP permissions](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/reference-and-developer-docs/role-based-access-control/data-security-endpoint-dlp-permissions.md): Configure Endpoint Data Loss Prevention permissions in Cortex XSIAM. - [Data-in-Motion Rules](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/reference-and-developer-docs/role-based-access-control/data-security-endpoint-dlp-permissions/data-in-motion-rules.md): Configure endpoint data-in-motion protection rules in Cortex XSIAM. - [Endpoint Applications](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/reference-and-developer-docs/role-based-access-control/data-security-endpoint-dlp-permissions/endpoint-applications.md): Manage endpoint applications monitored by Data Loss Prevention in Cortex XSIAM. - [Endpoint Applications Groups](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/reference-and-developer-docs/role-based-access-control/data-security-endpoint-dlp-permissions/endpoint-applications-groups.md): Manage endpoint application groups for Data Loss Prevention policies in Cortex XSIAM. - [Endpoint DLP Settings](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/reference-and-developer-docs/role-based-access-control/data-security-endpoint-dlp-permissions/endpoint-dlp-settings.md): Configure endpoint Data Loss Prevention settings in Cortex XSIAM. - [Inventory - Assets permissions](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/reference-and-developer-docs/role-based-access-control/inventory-assets-permissions.md): Configure inventory permissions for assets and endpoints in Cortex XSIAM. - [Network Configuration permissions](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/reference-and-developer-docs/role-based-access-control/inventory-assets-permissions/network-configuration-permissions.md): Configure network topology, ranges, and trusted networks in Cortex XSIAM. - [Compliance (Legacy) permissions](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/reference-and-developer-docs/role-based-access-control/inventory-assets-permissions/compliance-legacy-permissions.md): View legacy cloud compliance violations for assets in Cortex XSIAM. - [Asset Inventory permissions](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/reference-and-developer-docs/role-based-access-control/inventory-assets-permissions/asset-inventory-permissions.md): Control access to asset inventory data and metadata in Cortex XSIAM. - [Asset Roles configuration permissions](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/reference-and-developer-docs/role-based-access-control/inventory-assets-permissions/asset-roles-configuration-permissions.md): Configure functional asset roles and endpoint assignments in Cortex XSIAM. - [Asset Groups permissions](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/reference-and-developer-docs/role-based-access-control/inventory-assets-permissions/asset-groups-permissions.md): Manage asset groups and scoped access controls in Cortex XSIAM. - [Exposure and Vulnerability Management permissions](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/reference-and-developer-docs/role-based-access-control/exposure-and-vulnerability-management-permissions.md): Configure exposure, vulnerability, and attack surface management permissions in Cortex XSIAM. - [Attack Surface permissions](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/reference-and-developer-docs/role-based-access-control/exposure-and-vulnerability-management-permissions/attack-surface-permissions.md): Configure Attack Surface Management permissions in Cortex XSIAM. - [Vulnerability Management permissions](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/reference-and-developer-docs/role-based-access-control/exposure-and-vulnerability-management-permissions/vulnerability-management-permissions.md): Configure Vulnerability Management permissions in Cortex XSIAM. - [Exposure Management permissions](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/reference-and-developer-docs/role-based-access-control/exposure-and-vulnerability-management-permissions/exposure-management-permissions.md): Configure Exposure Management permissions in Cortex XSIAM. - [Cloud Security and Posture Management permissions](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/reference-and-developer-docs/role-based-access-control/cloud-security-and-posture-management-permissions.md): Configure Cloud Security and Posture Management permissions in Cortex XSIAM. - [CLI Tool permissions](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/reference-and-developer-docs/role-based-access-control/cloud-security-and-posture-management-permissions/cli-tool-permissions.md): Configure CLI Tool permissions in Cortex XSIAM. - [Application Security permissions](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/reference-and-developer-docs/role-based-access-control/cloud-security-and-posture-management-permissions/application-security-permissions.md): Configure Application Security permissions in Cortex XSIAM. - [Application Security - Generic Collector permissions](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/reference-and-developer-docs/role-based-access-control/cloud-security-and-posture-management-permissions/application-security-permissions/application-security-generic-collector-permissions.md): Configure Generic Collector permissions for Application Security in Cortex XSIAM. - [Application Security - Issues permissions](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/reference-and-developer-docs/role-based-access-control/cloud-security-and-posture-management-permissions/application-security-permissions/application-security-issues-permissions.md): Configure Application Security issue permissions in Cortex XSIAM. - [Application Security - Scans permissions](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/reference-and-developer-docs/role-based-access-control/cloud-security-and-posture-management-permissions/application-security-permissions/application-security-scans-permissions.md): Configure Application Security scan permissions in Cortex XSIAM. - [Application Security - Policy Management permissions](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/reference-and-developer-docs/role-based-access-control/cloud-security-and-posture-management-permissions/application-security-permissions/application-security-policy-management-permissions.md): Configure Application Security policy management permissions in Cortex XSIAM. - [Application Security - 3rd Party tools permissions](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/reference-and-developer-docs/role-based-access-control/cloud-security-and-posture-management-permissions/application-security-permissions/application-security-3rd-party-tools-permissions.md): Configure third-party tool permissions for Application Security in Cortex XSIAM. - [Configurations - Application Security permissions](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/reference-and-developer-docs/role-based-access-control/cloud-security-and-posture-management-permissions/application-security-permissions/configurations-application-security-permissions.md): Configure Application Security configuration permissions in Cortex XSIAM. - [Policies - Cloud Workload permissions](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/reference-and-developer-docs/role-based-access-control/cloud-security-and-posture-management-permissions/policies-cloud-workload-permissions.md): Configure Cloud Workload policy permissions in Cortex XSIAM. - [Cloud Security permissions](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/reference-and-developer-docs/role-based-access-control/cloud-security-and-posture-management-permissions/cloud-security-permissions.md): Configure Cloud Security permissions in Cortex XSIAM. - [Compliance - Cloud permissions](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/reference-and-developer-docs/role-based-access-control/cloud-security-and-posture-management-permissions/compliance-cloud-permissions.md): Configure cloud compliance permissions in Cortex XSIAM. - [Data Security permissions](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/reference-and-developer-docs/role-based-access-control/cloud-security-and-posture-management-permissions/data-security-permissions.md): Configure Data Security permissions in Cortex XSIAM. - [AI Security permissions](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/reference-and-developer-docs/role-based-access-control/cloud-security-and-posture-management-permissions/ai-security-permissions.md): Configure AI Security permissions in Cortex XSIAM. - [Data Classification permissions](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/reference-and-developer-docs/role-based-access-control/cloud-security-and-posture-management-permissions/data-classification-permissions.md): Configure Data Classification permissions in Cortex XSIAM. - [Identity Security permissions](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/reference-and-developer-docs/role-based-access-control/cloud-security-and-posture-management-permissions/identity-security-permissions.md): Configure Identity Security permissions in Cortex XSIAM. - [API documentation](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/reference-and-developer-docs/api-documentation.md): Use the Cortex XSIAM APIs to integrate Cortex XSIAM with third-party apps or services to ingest alerts and to leverage alert stitching and investigation capabilities. - [Reference](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/reference-and-developer-docs/reference.md): Cortex XSIAM reference material: cloud permissions, Windows auditing, XDM mapping, scanner licenses, and fair usage. - [Microsoft Windows security auditing setup](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/reference-and-developer-docs/reference/microsoft-windows-security-auditing-setup.md): Configure Windows security auditing and LDAP event logging for Cortex XSIAM data collection. - [Enable security auditing event IDs](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/reference-and-developer-docs/reference/microsoft-windows-security-auditing-setup/enable-security-auditing-event-ids.md): Enable Windows security auditing event IDs for Cortex XSIAM using GPO or local machine settings. - [Enable security auditing event IDs with GPO](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/reference-and-developer-docs/reference/microsoft-windows-security-auditing-setup/enable-security-auditing-event-ids/enable-security-auditing-event-ids-with-gpo.md): Use Group Policy to enable Windows security auditing event IDs for Cortex XSIAM data collection. - [Set up local machine security auditing without GPO](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/reference-and-developer-docs/reference/microsoft-windows-security-auditing-setup/enable-security-auditing-event-ids/set-up-local-machine-security-auditing-with-gpo.md): Use auditpol to enable Windows security auditing event IDs locally for Cortex XSIAM data collection. - [Additional setup for Active Directory Certificate Services (ADCS) events](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/reference-and-developer-docs/reference/microsoft-windows-security-auditing-setup/enable-security-auditing-event-ids/additional-setup-for-active-directory-certificate-services-adcs-events.md): Configure Active Directory Certificate Services (ADCS) auditing events for Cortex XSIAM data collection. - [Enable auditing access to AD domain objects - 4662](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/reference-and-developer-docs/reference/microsoft-windows-security-auditing-setup/enable-security-auditing-event-ids/enable-auditing-access-to-ad-domain-objects-4662.md): Configure Active Directory domain object auditing for Windows Event ID 4662 in Cortex XSIAM. - [Enable additional event logs using Event Viewer](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/reference-and-developer-docs/reference/microsoft-windows-security-auditing-setup/enable-additional-event-logs-using-event-viewer.md): Enable additional Windows Event Viewer logs, including PowerShell and Defender events, for Cortex XSIAM. - [Enable LDAP server events logging (1644)](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/reference-and-developer-docs/reference/microsoft-windows-security-auditing-setup/enable-ldap-server-events-logging-1644.md): Enable LDAP server Event ID 1644 logging for Cortex XSIAM through Registry Editor or Group Policy. - [Enable LDAP server events logging using RegEdit](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/reference-and-developer-docs/reference/microsoft-windows-security-auditing-setup/enable-ldap-server-events-logging-1644/enable-ldap-server-events-logging-using-regedit.md): Configure LDAP server Event ID 1644 logging through Registry Editor for Cortex XSIAM. - [Enable LDAP server events logging using GPO](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/reference-and-developer-docs/reference/microsoft-windows-security-auditing-setup/enable-ldap-server-events-logging-1644/enable-ldap-server-events-logging-using-gpo.md): Configure LDAP server Event ID 1644 logging through Group Policy for Cortex XSIAM. - [Validate log collection for LDAP Server events](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/reference-and-developer-docs/reference/microsoft-windows-security-auditing-setup/enable-ldap-server-events-logging-1644/validate-log-collection-for-ldap-server-events.md): Validate LDAP server Event ID 1644 collection in Windows Event Viewer for Cortex XSIAM. - [XDM fields for mapping authentication events](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/reference-and-developer-docs/reference/xdm-fields-for-mapping-authentication-events.md): Map authentication events to Cortex XSIAM XDM fields for normalized identity data and authentication stories. - [Authentication mapping: Advanced classification and deep dives](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/reference-and-developer-docs/reference/xdm-fields-for-mapping-authentication-events/authentication-mapping-advanced-classification-and-deep-dives.md): Learn more about technical conventions and implementation logic for complex authentication scenarios in Cortex XSIAM. - [XDM fields for mapping network events](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/reference-and-developer-docs/reference/xdm-fields-for-mapping-network-events.md): Map network events to Cortex XSIAM XDM fields for normalized identity data and authentication stories. - [Advanced network mapping: deep dives](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/reference-and-developer-docs/reference/xdm-fields-for-mapping-network-events/advanced-network-mapping-deep-dives.md): Learn more about technical conventions for complex network scenarios in Cortex XSIAM. - [Cortex Network Scanner OSS](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/reference-and-developer-docs/reference/cortex-network-scanner-oss.md): Review third-party open-source software licenses used by the Cortex Network Scanner for Cortex XSIAM. - [Fair Usage policy for Cortex XSIAM](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/reference-and-developer-docs/reference/fair-usage-policy-for-cortex-xsiam.md): Understand the Fair Usage Policy for data ingestion, connected sources, and API usage for Cortex XSIAM. - [Learn more about migrating to the latest broker VM image](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/migrating-to-a-new-broker-vm-image/migrating-to-a-new-broker-vm-image.md) - [Standalone Broker VM](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/migrating-to-a-new-broker-vm-image/standalone-broker-vm.md): Migrate a standalone Broker VM to the latest Cortex XSIAM broker image, including configuration import and log-source updates. - [Broker VM high availability cluster node](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/migrating-to-a-new-broker-vm-image/broker-vm-high-availability-cluster-node.md): Migrate a Broker VM high-availability cluster node to the latest Cortex XSIAM broker image, including cluster and load-balancer updates. ## Cortex XDR 5.x Documentation - [Navigate the Cortex XDR 5.x docs](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/learn-about-cortex-xdr-5.x/readme.md): Start here for a visual overview of the main Cortex XDR 5.x documentation areas. - [What is Cortex XDR ?](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/learn-about-cortex-xdr-5.x/readme-1.md): Learn about Cortex XDR and the security challenges it addresses. - [Cortex XDR architecture](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/learn-about-cortex-xdr-5.x/readme-1/cortex-xdr-architecture.md): Learn more about the Cortex XDR architecture. - [Agentic AI in Cortex XDR](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/learn-about-cortex-xdr-5.x/agentic-ai-in-cortex-xdr.md): Use the Cortex Agentic Assistant to investigate cases, perform threat hunting, and create scripts. Embed and run LLM prompts in playbooks. View AI case summaries. - [Agentic Assistant use cases](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/learn-about-cortex-xdr-5.x/agentic-ai-in-cortex-xdr/agentic-assistant-use-cases.md): Recommended prompts to automate your SOC using the Cortex Agentic Assistant - [Agentic Assistant security](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/learn-about-cortex-xdr-5.x/agentic-ai-in-cortex-xdr/agentic-assistant-security.md): Learn about how the Agentic Assistant is built using responsible AI principles. - [What is Cortex Gateway?](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/learn-about-cortex-xdr-5.x/what-is-cortex-gateway.md): A brief introduction to Cortex Gateway - [Fair Usage policy for Cortex XDR](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/learn-about-cortex-xdr-5.x/fair-usage-policy-for-cortex-xdr.md): Understand fair-use expectations for data ingestion, connected data sources, and API usage. - [Cortex XDR license plan](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/learn-about-cortex-xdr-5.x/cortex-xdr-license-plan.md): Explore Cortex XDR license variants, included capabilities, and available add-ons. - [Data retention in Cortex XDR](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/learn-about-cortex-xdr-5.x/cortex-xdr-license-plan/data-retention-in-cortex-xdr.md): Learn more about the default retention periods for all Cortex XDR licenses, and the available retention add-ons. - [Data storage lifecycle](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/learn-about-cortex-xdr-5.x/cortex-xdr-license-plan/data-storage-lifecycle.md): Understand Cortex XDR hot storage, cold storage, export, and data-retention options. - [License allocation](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/learn-about-cortex-xdr-5.x/cortex-xdr-license-plan/license-allocation.md): Learn more about how Cortex XDR regulates licenses. - [License expiration](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/learn-about-cortex-xdr-5.x/cortex-xdr-license-plan/license-expiration.md): Learn more about the Cortex XDR license expiration and validation period. - [Security Operations Center roles and responsibilities](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/learn-about-cortex-xdr-5.x/security-operations-center-roles-and-responsibilities.md): Learn about the typical core roles that make up a SOC team. - [In-product support ticket creation](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/learn-about-cortex-xdr-5.x/in-product-support-case-creation.md): Open a support ticket directly in Cortex XDR and record your console to capture your issues and have the ticket handled efficiently. - [Use the interface](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/learn-about-cortex-xdr-5.x/use-the-interface.md): Learn more about how to use the Cortex XDR interface. - [Supported web browsers](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/learn-about-cortex-xdr-5.x/supported-web-browsers.md): Review the web browsers and minimum versions supported by Cortex XDR. - [Upgrade to Cortex XDR 5.x](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/learn-about-cortex-xdr-5.x/upgrade-to-cortex-xdr-5.x.md): Review the Cortex XDR 5.x upgrade process, scheduling options, and key considerations. - [Extend Cortex XDR 5.x with Cortex Cloud Runtime Security](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/learn-about-cortex-xdr-5.x/extend-cortex-xdr-5.x-with-cortex-cloud-runtime-security.md): Extend Cortex XDR with Cortex Cloud Runtime Security capabilities for cloud environments. - [Deployment steps](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/onboard-cortex-xdr/deployment-steps.md): Plan, deploy, and onboard Cortex XDR using the required deployment steps. - [Plan and prepare](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/onboard-cortex-xdr/deployment-steps/plan-and-prepare.md): Learn more about deployment considerations and onboarding steps. - [Cortex XDR onboarding checklist](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/onboard-cortex-xdr/deployment-steps/cortex-xdr-onboarding-checklist.md): Review the steps to deploy and onboard Cortex XDR. - [Activate Cortex XDR](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/onboard-cortex-xdr/deployment-steps/activate-cortex-xdr.md): Learn how to activate your tenant. - [Cortex XDR supported regions](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/onboard-cortex-xdr/deployment-steps/activate-cortex-xdr/cortex-xdr-supported-regions.md): Review available Cortex XDR hosting regions and their data residency details. - [Enable access to required PANW resources](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/onboard-cortex-xdr/deployment-steps/activate-cortex-xdr/enable-access-to-required-panw-resources.md): Configure firewall access for Cortex XDR resources. - [Regional egress resources](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/onboard-cortex-xdr/deployment-steps/activate-cortex-xdr/enable-access-to-required-panw-resources/regional-egress-resources.md): Allow required regional endpoints for Cortex XDR agent and tenant communication. - [Engines IP addresses (outbound)](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/onboard-cortex-xdr/deployment-steps/activate-cortex-xdr/enable-access-to-required-panw-resources/engines-ip-addresses-outbound.md): Allow outbound engine IP addresses to access your network resources. - [Inbound source resources](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/onboard-cortex-xdr/deployment-steps/activate-cortex-xdr/enable-access-to-required-panw-resources/inbound-source-resources.md): Allow Cortex XDR source IP addresses to access your resources. - [FedRamp and the US Federal Government required resources](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/onboard-cortex-xdr/deployment-steps/activate-cortex-xdr/enable-access-to-required-panw-resources/fedramp-and-the-us-federal-government-required-resources.md): Configure required resources for FedRAMP and US federal deployments. - [Set up users, groups, and roles](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/onboard-cortex-xdr/deployment-steps/set-up-users-and-roles.md): Learn how to set up users, groups, and roles in Cortex XDR. - [User group management](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/onboard-cortex-xdr/deployment-steps/set-up-users-and-roles/user-group-management.md): Create and manage user groups, group mappings, and group-based access in Cortex XDR. - [Assign user roles and groups](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/onboard-cortex-xdr/deployment-steps/set-up-users-and-roles/assign-user-roles-and-groups.md): Assign roles and groups to control each user's Cortex XDR access. - [Set up authentication](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/onboard-cortex-xdr/deployment-steps/set-up-authentication.md): Authenticate Cortex XDR users using SAML 2.0 or Customer Support Portal (CSP). - [Authenticate users through the Customer Support Portal](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/onboard-cortex-xdr/deployment-steps/set-up-authentication/authenticate-users-through-the-customer-support-portal.md): Add Customer Support Portal users and grant them access to Cortex Gateway and Cortex XDR. - [Authenticate users using SSO](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/onboard-cortex-xdr/deployment-steps/set-up-authentication/authenticate-users-using-sso.md): Configure single sign-on authentication for Cortex XDR users. - [Set up okta as the Identity provider using SAML 2.0](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/onboard-cortex-xdr/deployment-steps/set-up-authentication/set-up-okta-as-the-identity-provider-using-saml-2.0.md): Configure Okta as a SAML 2.0 identity provider for Cortex XDR. - [Set up Microsoft Entra ID as the Identity Provider Using SAML 2.0](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/onboard-cortex-xdr/deployment-steps/set-up-authentication/set-up-microsoft-entra-id-as-the-identity-provider-using-saml-2.0.md): Configure Microsoft Entra ID as a SAML 2.0 identity provider. - [Authenticate users through the Customer Support Portal](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/onboard-cortex-xdr/deployment-steps/set-up-authentication/authenticate-users-through-the-customer-support-portal-1.md): Add Customer Support Portal users and grant tenant access. - [Authenticate users using SSO](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/onboard-cortex-xdr/deployment-steps/set-up-authentication/authenticate-users-using-sso-1.md): Configure SAML 2.0 single sign-on for Cortex XDR users. - [Set up Okta as the Identity Provider Using SAML 2.0](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/onboard-cortex-xdr/deployment-steps/set-up-authentication/authenticate-users-using-sso-1/set-up-okta-as-the-identity-provider-using-saml-2.0.md): Configure Okta SAML single sign-on for Cortex XDR. - [Set up Microsoft Entra ID as the Identity Provider Using SAML 2.0](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/onboard-cortex-xdr/deployment-steps/set-up-authentication/authenticate-users-using-sso-1/set-up-microsoft-entra-id-as-the-identity-provider-using-saml-2.0.md): Configure Microsoft Entra ID SAML single sign-on for Cortex XDR. - [Pre-installation steps for Cortex XDR agents](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/onboard-cortex-xdr/deployment-steps/pre-installation-steps-for-cortex-xdr-agents.md): Complete system and network prerequisites before installing Cortex XDR agents. - [Install Cortex XDR agents](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/onboard-cortex-xdr/deployment-steps/install-cortex-xdr-agents.md): Learn about the initial steps required to deploy Cortex XDR agent software to endpoints. - [Plan your agent deployment](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/onboard-cortex-xdr/deployment-steps/install-cortex-xdr-agents/plan-your-agent-deployment.md): Plan a Cortex XDR agent rollout for your endpoints and environment. - [Guidelines for keeping Cortex XDR agents and content updated](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/onboard-cortex-xdr/deployment-steps/install-cortex-xdr-agents/guidelines-for-keeping-cortex-xdr-agents-and-content-updated.md): Keep Cortex XDR agents and security content current and supported. - [Create an installation package](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/onboard-cortex-xdr/deployment-steps/install-cortex-xdr-agents/create-an-installation-package.md): Create an installation package for deploying Cortex XDR agents. - [Deploy agent installation packages](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/onboard-cortex-xdr/deployment-steps/install-cortex-xdr-agents/deploy-agent-installation-packages.md): Deploy Cortex XDR agent installation packages across your endpoints. - [Configure XDR Analytics](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/onboard-cortex-xdr/deployment-steps/configure-xdr-analytics.md): Configure XDR Analytics to analyze data and detect threats. - [Set up Cloud Identity Engine](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/onboard-cortex-xdr/deployment-steps/set-up-cloud-identity-engine.md): Set up Cloud Identity Engine to enrich Cortex XDR identity data. - [Manage API keys](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/onboard-cortex-xdr/deployment-steps/manage-api-keys.md): Create, manage, and revoke API keys for Cortex XDR integrations. - [Post-deployment steps](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/onboard-cortex-xdr/post-deployment-steps.md): Configure and manage Cortex XDR after completing the initial deployment. - [Set up your environment](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/onboard-cortex-xdr/post-deployment-steps/set-up-your-environment.md): Learn more about setting up the Cortex XDR environment based on your preferences. - [Configure server settings](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/onboard-cortex-xdr/post-deployment-steps/set-up-your-environment/configure-server-settings.md): Configure tenant-wide and user-specific Cortex XDR server settings. - [Configure security settings](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/onboard-cortex-xdr/post-deployment-steps/set-up-your-environment/configure-security-settings.md): Configure login sessions, access restrictions, and user expiration settings. - [Data and log forwarding](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/onboard-cortex-xdr/post-deployment-steps/set-up-your-environment/data-and-log-forwarding.md): Configure forwarding of Cortex XDR data, logs, and notifications. - [Forward logs and data from Cortex XDR to external services](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/onboard-cortex-xdr/post-deployment-steps/set-up-your-environment/data-and-log-forwarding/forward-logs-and-data-from-cortex-xdr-to-external-services.md): Send Cortex XDR logs, cases, and issues to external services. - [Configure external applications for forwarding](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/onboard-cortex-xdr/post-deployment-steps/set-up-your-environment/data-and-log-forwarding/forward-logs-and-data-from-cortex-xdr-to-external-services/configure-external-applications-for-forwarding.md): Configure external applications before forwarding Cortex XDR notifications. - [Forward notifications to Amazon SQS](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/onboard-cortex-xdr/post-deployment-steps/set-up-your-environment/data-and-log-forwarding/forward-logs-and-data-from-cortex-xdr-to-external-services/configure-external-applications-for-forwarding/forward-notifications-to-amazon-sqs.md): Configure Amazon SQS to receive Cortex XDR issue and case notifications. - [Forward notifications to Amazon S3](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/onboard-cortex-xdr/post-deployment-steps/set-up-your-environment/data-and-log-forwarding/forward-logs-and-data-from-cortex-xdr-to-external-services/configure-external-applications-for-forwarding/forward-notifications-to-amazon-s3.md): Configure Amazon S3 to receive Cortex XDR issue and case notifications. - [Forward notifications to Splunk](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/onboard-cortex-xdr/post-deployment-steps/set-up-your-environment/data-and-log-forwarding/forward-logs-and-data-from-cortex-xdr-to-external-services/configure-external-applications-for-forwarding/forward-notifications-to-splunk.md): Configure Splunk to receive Cortex XDR issue and case notifications. - [Forward notifications to webhook](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/onboard-cortex-xdr/post-deployment-steps/set-up-your-environment/data-and-log-forwarding/forward-logs-and-data-from-cortex-xdr-to-external-services/configure-external-applications-for-forwarding/forward-notifications-to-webhook.md): Configure a webhook to receive Cortex XDR issue and case notifications. - [Integrate a syslog receiver](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/onboard-cortex-xdr/post-deployment-steps/set-up-your-environment/data-and-log-forwarding/forward-logs-and-data-from-cortex-xdr-to-external-services/configure-external-applications-for-forwarding/integrate-a-syslog-receiver.md): Configure a syslog receiver for Cortex XDR log and notification forwarding. - [Integrate Slack for outbound notifications](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/onboard-cortex-xdr/post-deployment-steps/set-up-your-environment/data-and-log-forwarding/forward-logs-and-data-from-cortex-xdr-to-external-services/configure-external-applications-for-forwarding/integrate-slack-for-outbound-notifications.md): Connect Slack to receive Cortex XDR issue and report notifications. - [Configure notification forwarding](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/onboard-cortex-xdr/post-deployment-steps/set-up-your-environment/data-and-log-forwarding/forward-logs-and-data-from-cortex-xdr-to-external-services/configure-notification-forwarding.md): Select Cortex XDR notifications and configure where to forward them. - [Set up email notifications for tenant updates](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/onboard-cortex-xdr/post-deployment-steps/set-up-your-environment/data-and-log-forwarding/forward-logs-and-data-from-cortex-xdr-to-external-services/set-up-email-notifications-for-tenant-updates.md): Receive email notifications when Cortex XDR tenant updates are scheduled or complete. - [Monitor administrative activity](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/onboard-cortex-xdr/post-deployment-steps/set-up-your-environment/data-and-log-forwarding/forward-logs-and-data-from-cortex-xdr-to-external-services/monitor-administrative-activity.md): Review and forward audit logs for Cortex XDR administrative activity. - [Data and log notification formats](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/onboard-cortex-xdr/post-deployment-steps/set-up-your-environment/data-and-log-forwarding/data-and-log-notification-formats.md): Review formats for forwarded Cortex XDR cases, issues, and logs. - [Management audit log messages](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/onboard-cortex-xdr/post-deployment-steps/set-up-your-environment/data-and-log-forwarding/data-and-log-notification-formats/management-audit-log-messages.md): Review management audit log types and messages generated by Cortex XDR. - [Issue notification format](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/onboard-cortex-xdr/post-deployment-steps/set-up-your-environment/data-and-log-forwarding/data-and-log-notification-formats/issue-notification-format.md): Review issue notification formats for email and external forwarding destinations. - [Agent Audit log notification format](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/onboard-cortex-xdr/post-deployment-steps/set-up-your-environment/data-and-log-forwarding/data-and-log-notification-formats/agent-audit-log-notification-format.md): Review the email and syslog formats for agent audit log notifications. - [Management Audit log notification format](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/onboard-cortex-xdr/post-deployment-steps/set-up-your-environment/data-and-log-forwarding/data-and-log-notification-formats/management-audit-log-notification-format.md): Review the email and syslog formats for management audit log notifications. - [Log format for IOC and BIOC issues](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/onboard-cortex-xdr/post-deployment-steps/set-up-your-environment/data-and-log-forwarding/data-and-log-notification-formats/log-format-for-ioc-and-bioc-issues.md): Review legacy log formats for IOC and BIOC issues. - [Analytics log format](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/onboard-cortex-xdr/post-deployment-steps/set-up-your-environment/data-and-log-forwarding/data-and-log-notification-formats/analytics-log-format.md): Review legacy log formats and fields for Cortex XDR Analytics issues. - [Manage user roles and access management](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/onboard-cortex-xdr/post-deployment-steps/manage-user-roles-and-access-management.md): Learn how to manage access for users, user roles, user groups, and Single Sign-On (SSO) for users on a specific Cortex XDR tenant. - [Manage user roles](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/onboard-cortex-xdr/post-deployment-steps/manage-user-roles-and-access-management/manage-user-roles.md): Create, edit, and assign roles that control Cortex XDR permissions. - [Manage user acces](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/onboard-cortex-xdr/post-deployment-steps/manage-user-roles-and-access-management/manage-user-access.md): Manage users and their access to the Cortex XDR tenant. - [Manage user scope](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/onboard-cortex-xdr/post-deployment-steps/manage-user-roles-and-access-management/manage-user-scope.md): Configure Scope-Based Access Control (SBAC) to limit access to Cortex XDR data and content. - [Manage access to objects](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/onboard-cortex-xdr/post-deployment-steps/manage-user-roles-and-access-management/manage-access-to-objects.md): Control user access to Cortex XDR objects and saved content. - [Manage access to custom dashboards](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/onboard-cortex-xdr/post-deployment-steps/manage-user-roles-and-access-management/manage-access-to-objects/manage-access-to-custom-dashboards.md): Control which users can view and manage custom dashboards. - [Manage access to report templates](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/onboard-cortex-xdr/post-deployment-steps/manage-user-roles-and-access-management/manage-access-to-objects/manage-access-to-report-templates.md): Control which users can view and manage report templates. - [Manage access to playbooks and scripts](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/onboard-cortex-xdr/post-deployment-steps/manage-user-roles-and-access-management/manage-access-to-objects/manage-access-to-playbooks-and-scripts.md): Control which users can view and manage playbooks and scripts. - [Manage access to saved queries](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/onboard-cortex-xdr/post-deployment-steps/manage-user-roles-and-access-management/manage-access-to-objects/manage-access-to-saved-queries.md): Control which users can view and manage saved queries. - [Configure the Cortex Agentic Assistant](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/onboard-cortex-xdr/post-deployment-steps/configure-the-cortex-agentic-assistant.md): Create and manage agents and actions in the Agents Hub and configure access to the Cortex Agentic Assistant. - [Agents Hub](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/onboard-cortex-xdr/post-deployment-steps/configure-the-cortex-agentic-assistant/agents-hub.md): Manage Cortex Agentic Assistant agents, actions, and integrations. - [Manage actions](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/onboard-cortex-xdr/post-deployment-steps/configure-the-cortex-agentic-assistant/agents-hub/manage-actions.md): Create and manage actions that agents can perform. - [Register actions](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/onboard-cortex-xdr/post-deployment-steps/configure-the-cortex-agentic-assistant/agents-hub/register-actions.md): Register actions for use by Cortex Agentic Assistant agents. - [Manage agents](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/onboard-cortex-xdr/post-deployment-steps/configure-the-cortex-agentic-assistant/agents-hub/manage-agents.md): View, configure, and manage Cortex Agentic Assistant agents. - [Build agents](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/onboard-cortex-xdr/post-deployment-steps/configure-the-cortex-agentic-assistant/agents-hub/build-agents.md): Build Cortex Agentic Assistant agents for your security workflows. - [Expand agent capabilities with MCP integrations](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/onboard-cortex-xdr/post-deployment-steps/configure-the-cortex-agentic-assistant/agents-hub/expand-agent-capabilities-with-mcp-integrations.md): Extend agent capabilities by configuring Model Context Protocol integrations. - [Agentic Assistant role based access control](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/onboard-cortex-xdr/post-deployment-steps/configure-the-cortex-agentic-assistant/agentic-assistant-role-based-access-control.md): Configure role-based access to the Cortex Agentic Assistant and Agents Hub. - [Dashboards and reports](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/onboard-cortex-xdr/post-deployment-steps/dashboards-and-reports.md): Create dashboards and reports to monitor your Cortex XDR environment. - [Multi-Tenant](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/onboard-cortex-xdr/multi-tenant.md): Manage licensing, onboarding, and operations across Cortex XDR tenants. - [What is Cortex XDR multi-tenant?](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/onboard-cortex-xdr/multi-tenant/what-is-cortex-xdr-multi-tenant.md): Learn about Cortex multi-tenant deployments that provide data segregation while enabling you to manage multiple tenants from a single console. - [Multi-tenant central licensing management](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/onboard-cortex-xdr/multi-tenant/multi-tenant-central-licensing-management.md) - [Onboard Cortex multi-tenant](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/onboard-cortex-xdr/multi-tenant/onboard-cortex-multi-tenant.md): Learn how to activate and manage tenants. - [Dynamic license allocation](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/onboard-cortex-xdr/multi-tenant/dynamic-license-allocation.md): In a multi-tenant central licensing management environment, you can dynamically edit child tenant allocations, add child tenants, and delete child tenants with the license pool automatically updated. - [Child tenant management](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/onboard-cortex-xdr/multi-tenant/child-tenant-management.md): Track, manage, and investigate child tenant data from the parent tenant. - [Track your tenant management](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/onboard-cortex-xdr/multi-tenant/child-tenant-management/track-your-tenant-management.md): Monitor tenant management activity across your multi-tenant environment. - [Investigate child tenant data](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/onboard-cortex-xdr/multi-tenant/child-tenant-management/investigate-child-tenant-data.md): Investigate security data from child tenants in Cortex XDR. - [Create and allocate configurations](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/onboard-cortex-xdr/multi-tenant/child-tenant-management/create-and-allocate-configurations.md): Create configurations and allocate them to child tenants. - [Create a security managed action](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/onboard-cortex-xdr/multi-tenant/child-tenant-management/create-a-security-managed-action.md): Create managed actions to apply security changes across child tenants. - [About managed threat hunting](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/onboard-cortex-xdr/multi-tenant/about-managed-threat-hunting.md): Understand how Managed Threat Hunting can help your organization. - [Configure and deploy Cortex XDR](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/configure-cortex-xdr/configure-and-deploy-cortex-xdr.md): Configure Cortex XDR capabilities, network settings, analytics, and integrations. - [Cortex XDR - Analytics](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/configure-cortex-xdr/configure-and-deploy-cortex-xdr/cortex-xdr-analytics.md): Learn how to enable Cortex XDR - Analytics, which allows Cortex XDR to analyze data from a variety of sensors and develop a baseline to raise analytics alerts. - [Configure Cortex XDR network parameters](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/configure-cortex-xdr/configure-and-deploy-cortex-xdr/configure-cortex-xdr-network-parameters.md): Define the IP address ranges and domain names used by Cortex XDR to identify your network assets. - [Enable the Analytics Engine and Identity Analytics](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/configure-cortex-xdr/configure-and-deploy-cortex-xdr/enable-the-analytics-engine-and-identity-analytics.md): Learn how to enable the Analytics Engine and Identity Analytics. - [Set up Cloud Identity Engine](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/configure-cortex-xdr/configure-and-deploy-cortex-xdr/set-up-cloud-identity-engine.md): Learn how to set up Cloud Identity Engine to use with Cortex XDR. - [Configure the Cortex Agentic Assistant](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/configure-cortex-xdr/configure-and-deploy-cortex-xdr/configure-the-cortex-agentic-assistant.md): Configure Cortex Agentic Assistant agents, actions, and access. - [Agentic Assistant components and concepts](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/configure-cortex-xdr/configure-and-deploy-cortex-xdr/configure-the-cortex-agentic-assistant/agentic-assistant-components-and-concepts.md): Learn about the key components and concepts, such as agents and actions in the Cortex Agentic Assistant - [Agentic Assistant Hub](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/configure-cortex-xdr/configure-and-deploy-cortex-xdr/configure-the-cortex-agentic-assistant/agents-hub.md): Learn about personal and system agents in in the Agentic Assistant Hub - [Manage actions](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/configure-cortex-xdr/configure-and-deploy-cortex-xdr/configure-the-cortex-agentic-assistant/agents-hub/manage-actions.md): Create and manage actions for Cortex Agentic Assistant agents. - [Register actions](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/configure-cortex-xdr/configure-and-deploy-cortex-xdr/configure-the-cortex-agentic-assistant/agents-hub/register-actions.md): Register actions for use by Cortex Agentic Assistant agents. - [Manage agents](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/configure-cortex-xdr/configure-and-deploy-cortex-xdr/configure-the-cortex-agentic-assistant/agents-hub/manage-agents.md): View, configure, and manage Cortex Agentic Assistant agents. - [Build agents](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/configure-cortex-xdr/configure-and-deploy-cortex-xdr/configure-the-cortex-agentic-assistant/agents-hub/build-agents.md): Build Cortex Agentic Assistant agents for security workflows. - [Manage knowledge sources (preview)](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/configure-cortex-xdr/configure-and-deploy-cortex-xdr/configure-the-cortex-agentic-assistant/agents-hub/manage-knowledge-sources-preview.md): Enhance AI agent capabilities by leveraging the Knowledge Center (preview) to provide agents with your business-specific source of truth and built-in Cortex (system) knowledge. - [Expand agent capabilities with MCP integrations](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/configure-cortex-xdr/configure-and-deploy-cortex-xdr/configure-the-cortex-agentic-assistant/agents-hub/expand-agent-capabilities-with-mcp-integrations.md): Extend agent capabilities with Model Context Protocol integrations. - [Agentic Assistant role-based access control](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/configure-cortex-xdr/configure-and-deploy-cortex-xdr/configure-the-cortex-agentic-assistant/agentic-assistant-role-based-access-control.md): Configure permissions to access Cortex Agentic Assistant features. - [About the Cortex MCP server](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/configure-cortex-xdr/configure-and-deploy-cortex-xdr/cortex-mcp-server.md): Install, configure, use, and extend the Cortex MCP server. - [Install the Cortex MCP sever](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/configure-cortex-xdr/configure-and-deploy-cortex-xdr/cortex-mcp-server/install-the-cortex-mcp-sever.md): Install the Cortex MCP server for supported MCP clients. - [Confgure the MCP client](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/configure-cortex-xdr/configure-and-deploy-cortex-xdr/cortex-mcp-server/confgure-the-mcp-client.md): Configure an MCP client to connect to the Cortex MCP server. - [Use the Cortex MCP server](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/configure-cortex-xdr/configure-and-deploy-cortex-xdr/cortex-mcp-server/use-the-cortex-mcp-server.md): Investigate Cortex data with built-in MCP tools. - [Create custom Cortex MCP server tools](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/configure-cortex-xdr/configure-and-deploy-cortex-xdr/cortex-mcp-server/create-custom-cortex-mcp-server-tools.md): Extend the Cortex MCP server with OpenAPI or Python tools. - [Data management](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/configure-cortex-xdr/data-management.md): Manage data collection, storage, parsing, and usage in Cortex XDR. - [Broker VM](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/configure-cortex-xdr/data-management/broker-vm.md): Deploy and manage Broker VM data collectors for Cortex XDR. - [What is the Broker VM?](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/configure-cortex-xdr/data-management/broker-vm/what-is-the-broker-vm.md): Learn how Broker VM collects and forwards data to Cortex XDR. - [Set up and configure Broker VM](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/configure-cortex-xdr/data-management/broker-vm/set-up-and-configure-broker-vm.md): Set up and configure Broker VM for Cortex XDR data collection. - [Broker VM image installations](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/configure-cortex-xdr/data-management/broker-vm/set-up-and-configure-broker-vm/broker-vm-image-installations.md): Install Broker VM on a supported cloud or virtualization platform. - [Set up Broker VM on Alibaba Cloud](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/configure-cortex-xdr/data-management/broker-vm/set-up-and-configure-broker-vm/broker-vm-image-installations/set-up-broker-vm-on-alibaba-cloud.md): Deploy Broker VM on Alibaba Cloud for Cortex XDR data collection. - [Set up Broker VM on Amazon Web Services](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/configure-cortex-xdr/data-management/broker-vm/set-up-and-configure-broker-vm/broker-vm-image-installations/set-up-broker-vm-on-amazon-web-services.md): Deploy Broker VM on Amazon Web Services for Cortex XDR data collection. - [Set up Broker VM on Google Cloud Platform (GCP)](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/configure-cortex-xdr/data-management/broker-vm/set-up-and-configure-broker-vm/broker-vm-image-installations/set-up-broker-vm-on-google-cloud-platform-gcp.md): Deploy Broker VM on Google Cloud Platform for Cortex XDR data collection. - [Set up Broker VM on KVM using Ubuntu](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/configure-cortex-xdr/data-management/broker-vm/set-up-and-configure-broker-vm/broker-vm-image-installations/set-up-broker-vm-on-kvm-using-ubuntu.md): Deploy Broker VM on KVM with Ubuntu for Cortex XDR data collection. - [Set up Broker VM on Microsoft Azure](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/configure-cortex-xdr/data-management/broker-vm/set-up-and-configure-broker-vm/broker-vm-image-installations/set-up-broker-vm-on-microsoft-azure.md): Deploy Broker VM on Microsoft Azure for Cortex XDR data collection. - [Set up Broker VM on Microsoft Hyper-V](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/configure-cortex-xdr/data-management/broker-vm/set-up-and-configure-broker-vm/broker-vm-image-installations/set-up-broker-vm-on-microsoft-hyper-v.md): Deploy Broker VM on Microsoft Hyper-V for Cortex XDR data collection. - [Set up Broker VM on Nutanix Hypervisor](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/configure-cortex-xdr/data-management/broker-vm/set-up-and-configure-broker-vm/broker-vm-image-installations/set-up-broker-vm-on-nutanix-hypervisor.md): Deploy Broker VM on Nutanix Hypervisor for Cortex XDR data collection. - [Set up Broker VM on VMware ESXi using vSphere Client](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/configure-cortex-xdr/data-management/broker-vm/set-up-and-configure-broker-vm/broker-vm-image-installations/set-up-broker-vm-on-vmware-esxi-using-vsphere-client.md): Deploy Broker VM on VMware ESXi for Cortex XDR data collection. - [Broker VM data collector applets](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/configure-cortex-xdr/data-management/broker-vm/set-up-and-configure-broker-vm/broker-vm-data-collector-applets.md): Configure Broker VM data collector applets for supported data sources. - [Manage Broker VM](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/configure-cortex-xdr/data-management/broker-vm/manage-broker-vm.md): Manage Broker VM configuration, monitoring, upgrades, and clustering. - [Edit Broker VM Configuration](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/configure-cortex-xdr/data-management/broker-vm/manage-broker-vm/edit-broker-vm-configuration.md): Update the configuration of an existing Broker VM. - [Increase Broker VM storage allocated for data caching](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/configure-cortex-xdr/data-management/broker-vm/manage-broker-vm/increase-broker-vm-storage-allocated-for-data-caching.md): Increase Broker VM storage for cached data. - [Monitor Broker VM using Prometheus](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/configure-cortex-xdr/data-management/broker-vm/manage-broker-vm/monitor-broker-vm-using-prometheus.md): Monitor Broker VM metrics with Prometheus. - [Collect Broker VM Logs](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/configure-cortex-xdr/data-management/broker-vm/manage-broker-vm/collect-broker-vm-logs.md): Collect logs from Broker VM for troubleshooting. - [Upgrade Broker VM](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/configure-cortex-xdr/data-management/broker-vm/manage-broker-vm/upgrade-broker-vm.md): Upgrade Broker VM to a supported release. - [Update Broker VM applets independently](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/configure-cortex-xdr/data-management/broker-vm/manage-broker-vm/update-broker-vm-applets-independently.md): Update Broker VM data collector applets without upgrading the VM. - [Import Broker VM Configuration](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/configure-cortex-xdr/data-management/broker-vm/manage-broker-vm/import-broker-vm-configuration.md): Import a saved Broker VM configuration. - [Open Live Terminal](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/configure-cortex-xdr/data-management/broker-vm/manage-broker-vm/open-live-terminal.md): Open a live terminal session on Broker VM. - [Add Broker VM to cluster](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/configure-cortex-xdr/data-management/broker-vm/manage-broker-vm/add-broker-vm-to-cluster.md): Add a Broker VM node to a high availability cluster. - [Switchover Primary Node in Cluster](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/configure-cortex-xdr/data-management/broker-vm/manage-broker-vm/switchover-primary-node-in-cluster.md): Switch the primary node in a Broker VM cluster. - [Remove from Cluster](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/configure-cortex-xdr/data-management/broker-vm/manage-broker-vm/remove-from-cluster.md): Remove a Broker VM node from its cluster. - [Manage Broker VM data collector applets](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/configure-cortex-xdr/data-management/broker-vm/manage-broker-vm-data-collector-applets.md): Manage applets installed on Broker VM. - [Broker VM High Availability Cluster](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/configure-cortex-xdr/data-management/broker-vm/broker-vm-high-availability-cluster.md): Configure Broker VM clusters for high availability. - [Configure High Availability Cluster](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/configure-cortex-xdr/data-management/broker-vm/broker-vm-high-availability-cluster/configure-high-availability-cluster.md): Configure a high availability cluster for Broker VM. - [Manage Broker VM clusters](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/configure-cortex-xdr/data-management/broker-vm/broker-vm-high-availability-cluster/manage-broker-vm-clusters.md): View and manage Broker VM high availability clusters. - [View cluster details](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/configure-cortex-xdr/data-management/broker-vm/broker-vm-high-availability-cluster/manage-broker-vm-clusters/view-cluster-details.md): View configuration and status details for a Broker VM cluster. - [Edit cluster](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/configure-cortex-xdr/data-management/broker-vm/broker-vm-high-availability-cluster/manage-broker-vm-clusters/edit-cluster.md): Update the configuration of a Broker VM cluster. - [Add applet to cluster](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/configure-cortex-xdr/data-management/broker-vm/broker-vm-high-availability-cluster/manage-broker-vm-clusters/add-applet-to-cluster.md): Add a data collector applet to a Broker VM cluster. - [Add Broker VM to cluster](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/configure-cortex-xdr/data-management/broker-vm/broker-vm-high-availability-cluster/manage-broker-vm-clusters/add-broker-vm-to-cluster.md): Add a Broker VM node to an existing cluster. - [Remove cluster](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/configure-cortex-xdr/data-management/broker-vm/broker-vm-high-availability-cluster/manage-broker-vm-clusters/remove-cluster.md): Remove a Broker VM high availability cluster. - [Broker VM notifications](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/configure-cortex-xdr/data-management/broker-vm/broker-vm-notifications.md): Configure and manage Broker VM notifications. - [Monitor Broker VM activity](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/configure-cortex-xdr/data-management/broker-vm/monitor-broker-vm-activity.md): Monitor Broker VM activity and operational status. - [Troubleshoot Broker VM applet errors](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/configure-cortex-xdr/data-management/broker-vm/troubleshoot-broker-vm-applet-errors.md): Diagnose and resolve Broker VM data collector applet errors. - [Dataset management](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/configure-cortex-xdr/data-management/dataset-management.md): Learn more about managing your datasets and understanding your overall data storage, period-based retention. - [What are datasets?](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/configure-cortex-xdr/data-management/dataset-management/what-are-datasets.md): Learn how Cortex XDR datasets store and organize your data. - [Lookup datasets](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/configure-cortex-xdr/data-management/dataset-management/lookup-datasets.md): Create and manage lookup datasets for Cortex XDR queries. - [Import a lookup dataset](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/configure-cortex-xdr/data-management/dataset-management/lookup-datasets/import-a-lookup-dataset.md): Import a lookup dataset into Cortex XDR. - [Download JSON file of lookup dataset](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/configure-cortex-xdr/data-management/dataset-management/lookup-datasets/download-json-file-of-lookup-dataset.md): Download a lookup dataset as a JSON file. - [Set time to live for lookup datasets](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/configure-cortex-xdr/data-management/dataset-management/lookup-datasets/set-time-to-live-for-lookup-datasets.md): Set retention periods for lookup datasets. - [Monitor datasets and dataset views activity](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/configure-cortex-xdr/data-management/dataset-management/monitor-datasets-and-dataset-views-activity.md): Monitor activity for datasets and dataset views. - [Parsing Rules](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/configure-cortex-xdr/data-management/parsing-rules.md): Learn more about Cortex XDR Parsing Rules. - [Parsing Rules file structure and syntax](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/configure-cortex-xdr/data-management/parsing-rules/parsing-rules-file-structure-and-syntax.md): Understand Parsing Rules file structure, syntax, and commands. - [INGEST](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/configure-cortex-xdr/data-management/parsing-rules/parsing-rules-file-structure-and-syntax/ingest.md): Use the INGEST command to parse and normalize ingested data. - [fields](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/configure-cortex-xdr/data-management/parsing-rules/parsing-rules-file-structure-and-syntax/ingest/fields.md): Use 'fields' in Cortex XDR Parsing Rules. - [parse\_cef](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/configure-cortex-xdr/data-management/parsing-rules/parsing-rules-file-structure-and-syntax/ingest/parse_cef.md): Use the parse\_cef function in Cortex XDR Parsing Rules. - [parse\_cisco](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/configure-cortex-xdr/data-management/parsing-rules/parsing-rules-file-structure-and-syntax/ingest/parse_cisco.md): Use the parse\_cisco function in Cortex XDR Parsing Rules. - [parse\_json](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/configure-cortex-xdr/data-management/parsing-rules/parsing-rules-file-structure-and-syntax/ingest/parse_json.md): Use the parse\_json function in Cortex XDR Parsing Rules. - [COLLECT](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/configure-cortex-xdr/data-management/parsing-rules/parsing-rules-file-structure-and-syntax/collect.md): Use the COLLECT command to collect parsed data. - [CONST](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/configure-cortex-xdr/data-management/parsing-rules/parsing-rules-file-structure-and-syntax/const.md): Use the CONST command to define constant values. - [RULE](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/configure-cortex-xdr/data-management/parsing-rules/parsing-rules-file-structure-and-syntax/rule.md): Use the RULE command to define Parsing Rules. - [Create Parsing Rules](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/configure-cortex-xdr/data-management/parsing-rules/create-parsing-rules.md): Create Parsing Rules to normalize ingested data. - [Troubleshooting Parsing rules errors](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/configure-cortex-xdr/data-management/parsing-rules/troubleshooting-parsing-rules-errors.md): Troubleshoot errors when creating and running Parsing Rules. - [Parsing Rules Raw Dataset](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/configure-cortex-xdr/data-management/parsing-rules/parsing-rules-raw-dataset.md): Understand the raw dataset used by Parsing Rules. - [Manage Event Forwarding](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/configure-cortex-xdr/data-management/manage-event-forwarding.md): Save your ingested, parsed data in an external location by exporting your event logs to a temporary GCP storage bucket. - [Manage compute units](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/configure-cortex-xdr/data-management/manage-compute-units.md): Learn more about managing and tracking your compute units usage for API and Cold Storage XQL queries. - [Compute units usage](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/configure-cortex-xdr/data-management/manage-compute-units/compute-units-usage.md): Monitor compute unit usage for data management tasks. - [Cortex XDR Data Sources and Connectors](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/configure-cortex-xdr/cortex-xdr-data-sources.md): Connect Cortex XDR to cloud, SaaS, network, and endpoint data sources. - [What are Cortex XDR data sources and connectors?](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/configure-cortex-xdr/cortex-xdr-data-sources/what-are-cortex-xdr-data-sources.md): Learn more about Cortex XDR data sources and connectors with a unified approach to integrations. - [What is the data source and connector catalog?](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/configure-cortex-xdr/cortex-xdr-data-sources/complete-data-source-catalog.md): Learn more about the complete data source and connector catalog available in Cortex XDR. - [Vendor-specific data sources and connectors](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/configure-cortex-xdr/cortex-xdr-data-sources/vendor-specific-data-sources.md): Configure data sources and connectors for supported technology vendors. - [AbuseIPDB](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/configure-cortex-xdr/cortex-xdr-data-sources/vendor-specific-data-sources/abuseipdb.md): Configure the AbuseIPDB connector for Cortex XDR. - [AbuseIPDB](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/configure-cortex-xdr/cortex-xdr-data-sources/vendor-specific-data-sources/abuseipdb/abuseipdb.md): Use AbuseIPDB data with Cortex XDR. - [AIOps](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/configure-cortex-xdr/cortex-xdr-data-sources/vendor-specific-data-sources/aiops.md): Configure the AIOps connector for Cortex XDR. - [AIOps](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/configure-cortex-xdr/cortex-xdr-data-sources/vendor-specific-data-sources/aiops/aiops.md): Use AIOps data with Cortex XDR. - [Amazon](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/configure-cortex-xdr/cortex-xdr-data-sources/vendor-specific-data-sources/amazon.md): Configure Amazon data sources and connectors for Cortex XDR. - [Amazon S3](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/configure-cortex-xdr/cortex-xdr-data-sources/vendor-specific-data-sources/amazon/amazon-s3.md): Use Amazon S3 data in Cortex XDR. - [Ingest audit logs from AWS CloudTrail](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/configure-cortex-xdr/cortex-xdr-data-sources/vendor-specific-data-sources/amazon/amazon-s3/ingest-audit-logs-from-aws-cloudtrail.md): Collect audit logs from AWS CloudTrail in Cortex XDR. - [Ingest network flow logs from Amazon S3](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/configure-cortex-xdr/cortex-xdr-data-sources/vendor-specific-data-sources/amazon/amazon-s3/ingest-network-flow-logs-from-amazon-s3.md): Collect network flow logs from Amazon S3 in Cortex XDR. - [Ingest network Route 53 logs from Amazon S3](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/configure-cortex-xdr/cortex-xdr-data-sources/vendor-specific-data-sources/amazon/amazon-s3/ingest-network-route-53-logs-from-amazon-s3.md): Collect network Route 53 logs from Amazon S3 in Cortex XDR. - [Create an assumed role](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/configure-cortex-xdr/cortex-xdr-data-sources/vendor-specific-data-sources/amazon/amazon-s3/create-an-assumed-role.md): Create an assumed AWS role for Cortex XDR data collection. - [Create a Workload Federated Identity role](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/configure-cortex-xdr/cortex-xdr-data-sources/vendor-specific-data-sources/amazon/amazon-s3/create-a-workload-federated-identity-role.md): Learn more about creating a Workload Federated Identity role in Cortex XDR. - [Configure data collection from Amazon S3 manually](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/configure-cortex-xdr/cortex-xdr-data-sources/vendor-specific-data-sources/amazon/amazon-s3/configure-data-collection-from-amazon-s3-manually.md): Collect data from Amazon S3 manually in Cortex XDR. - [Amazon Web Services](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/configure-cortex-xdr/cortex-xdr-data-sources/vendor-specific-data-sources/amazon/amazon-web-services.md): Use Amazon Web Services data with Cortex XDR. - [AWS Automation and Collection](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/configure-cortex-xdr/cortex-xdr-data-sources/vendor-specific-data-sources/amazon/aws-automation-and-collection.md): Configure AWS automation and collection for Cortex XDR. - [Anomali](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/configure-cortex-xdr/cortex-xdr-data-sources/vendor-specific-data-sources/anomali.md): Configure the Anomali connector for Cortex XDR. - [Anomali](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/configure-cortex-xdr/cortex-xdr-data-sources/vendor-specific-data-sources/anomali/anomali.md): Use Anomali data with Cortex XDR. - [API Security](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/configure-cortex-xdr/cortex-xdr-data-sources/vendor-specific-data-sources/api-security.md): Use API data in Cortex XDR. - [Ingest data for API security](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/configure-cortex-xdr/cortex-xdr-data-sources/vendor-specific-data-sources/api-security/ingest-data-for-api-security.md): Collect API Security data with Cortex XDR. - [Ingest AWS API Gateway](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/configure-cortex-xdr/cortex-xdr-data-sources/vendor-specific-data-sources/api-security/ingest-data-for-api-security/ingest-aws-api-gateway.md): Ingest AWS API Gateway logs for Cortex XDR API security analysis. - [Ingest Azure APIM](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/configure-cortex-xdr/cortex-xdr-data-sources/vendor-specific-data-sources/api-security/ingest-data-for-api-security/ingest-azure-apim.md): Ingest Azure API Management traffic for Cortex XDR API security analysis. - [Ingest Apigee Proxy](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/configure-cortex-xdr/cortex-xdr-data-sources/vendor-specific-data-sources/api-security/ingest-data-for-api-security/ingest-apigee-proxy.md): Ingest Apigee Proxy traffic for Cortex XDR API security analysis. - [Ingest Kong](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/configure-cortex-xdr/cortex-xdr-data-sources/vendor-specific-data-sources/api-security/ingest-data-for-api-security/ingest-kong.md): Ingest Kong traffic for Cortex XDR API security analysis. - [Ingest F5](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/configure-cortex-xdr/cortex-xdr-data-sources/vendor-specific-data-sources/api-security/ingest-data-for-api-security/ingest-f5.md): Ingest F5 traffic for Cortex XDR API security analysis. - [Atlassian](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/configure-cortex-xdr/cortex-xdr-data-sources/vendor-specific-data-sources/atlassian.md): Configure Atlassian connectors for Cortex XDR. - [Atlassian Automation and Collection](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/configure-cortex-xdr/cortex-xdr-data-sources/vendor-specific-data-sources/atlassian/atlassian-automation-and-collection.md): Configure Atlassian automation and collection for Cortex XDR. - [BeyondTrust Privilege Management Cloud](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/configure-cortex-xdr/cortex-xdr-data-sources/vendor-specific-data-sources/beyondtrust-privilege-management-cloud.md): Configure BeyondTrust Privilege Management Cloud for Cortex XDR. - [Ingest logs from BeyondTrust Privilege Management Cloud](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/configure-cortex-xdr/cortex-xdr-data-sources/vendor-specific-data-sources/beyondtrust-privilege-management-cloud/ingest-logs-from-beyondtrust-privilege-management-cloud.md): Collect BeyondTrust Privilege Management Cloud data with Cortex XDR. - [Box](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/configure-cortex-xdr/cortex-xdr-data-sources/vendor-specific-data-sources/box.md): Configure Box data sources and connectors for Cortex XDR. - [Ingest logs and data from Box](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/configure-cortex-xdr/cortex-xdr-data-sources/vendor-specific-data-sources/box/ingest-logs-and-data-from-box.md): Ingest Box logs and data into Cortex XDR. - [Check Point](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/configure-cortex-xdr/cortex-xdr-data-sources/vendor-specific-data-sources/check-point.md): Configure Check Point data sources and connectors for Cortex XDR. - [Check Point FW1/VPN1](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/configure-cortex-xdr/cortex-xdr-data-sources/vendor-specific-data-sources/check-point/check-point-fw1-vpn1.md): Use Check Point FW1/VPN1 data with Cortex XDR. - [Cisco](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/configure-cortex-xdr/cortex-xdr-data-sources/vendor-specific-data-sources/cisco.md): Configure Cisco data sources and connectors for Cortex XDR. - [Cisco ASA firewalls and AnyConnect](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/configure-cortex-xdr/cortex-xdr-data-sources/vendor-specific-data-sources/cisco/cisco-asa-firewalls-and-anyconnect.md): Use Cisco ASA firewall and AnyConnect data with Cortex XDR. - [Corelight](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/configure-cortex-xdr/cortex-xdr-data-sources/vendor-specific-data-sources/corelight.md): Configure the Corelight data source for Cortex XDR. - [Corelight Zeek](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/configure-cortex-xdr/cortex-xdr-data-sources/vendor-specific-data-sources/corelight/corelight-zeek.md): Use Corelight Zeek data with Cortex XDR. - [Cribl](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/configure-cortex-xdr/cortex-xdr-data-sources/vendor-specific-data-sources/cribl.md): Configure the Cribl data source and connector for Cortex XDR. - [Cribl connector](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/configure-cortex-xdr/cortex-xdr-data-sources/vendor-specific-data-sources/cribl/cribl-connector.md): Use Cribl connector data with Cortex XDR. - [CyberArk](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/configure-cortex-xdr/cortex-xdr-data-sources/vendor-specific-data-sources/cyberark.md): Configure the CyberArk connector for Cortex XDR. - [CyberArk](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/configure-cortex-xdr/cortex-xdr-data-sources/vendor-specific-data-sources/cyberark/cyberark.md): Use CyberArk data with Cortex XDR. - [Dropbox](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/configure-cortex-xdr/cortex-xdr-data-sources/vendor-specific-data-sources/dropbox.md): Configure the Dropbox data source and connector for Cortex XDR. - [Ingest logs and data from Dropbox](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/configure-cortex-xdr/cortex-xdr-data-sources/vendor-specific-data-sources/dropbox/ingest-logs-and-data-from-dropbox.md): Ingest Dropbox logs and data into Cortex XDR. - [Elastic](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/configure-cortex-xdr/cortex-xdr-data-sources/vendor-specific-data-sources/elastic.md): Configure Elastic data sources and connectors for Cortex XDR. - [Elasticsearch Filebeat](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/configure-cortex-xdr/cortex-xdr-data-sources/vendor-specific-data-sources/elastic/elasticsearch-filebeat.md): Configure Elasticsearch Filebeat log collection for Cortex XDR. - [Ingest logs from Elasticsearch Filebeat](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/configure-cortex-xdr/cortex-xdr-data-sources/vendor-specific-data-sources/elastic/elasticsearch-filebeat/ingest-logs-from-elasticsearch-filebeat.md): Ingest Elasticsearch Filebeat logs into Cortex XDR. - [Windows DHCP via Elasticsearch Filebeat](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/configure-cortex-xdr/cortex-xdr-data-sources/vendor-specific-data-sources/elastic/windows-dhcp-via-elasticsearch-filebeat.md): Configure Windows DHCP ingestion through Elasticsearch Filebeat for Cortex XDR. - [Ingest logs from Windows DHCP using Elasticsearch Filebeat](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/configure-cortex-xdr/cortex-xdr-data-sources/vendor-specific-data-sources/elastic/windows-dhcp-via-elasticsearch-filebeat/ingest-logs-from-windows-dhcp-using-elasticsearch-filebeat.md): Ingest Windows DHCP logs through Elasticsearch Filebeat into Cortex XDR. - [ElasticSearch](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/configure-cortex-xdr/cortex-xdr-data-sources/vendor-specific-data-sources/elastic/elasticsearch.md): Use Elasticsearch data with Cortex XDR. - [Envoy](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/configure-cortex-xdr/cortex-xdr-data-sources/vendor-specific-data-sources/envoy.md): Configure the Envoy connector for Cortex XDR. - [Envoy](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/configure-cortex-xdr/cortex-xdr-data-sources/vendor-specific-data-sources/envoy/envoy.md): Use Envoy data with Cortex XDR. - [Forcepoint](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/configure-cortex-xdr/cortex-xdr-data-sources/vendor-specific-data-sources/forcepoint.md): Configure the Forcepoint data source and connector for Cortex XDR. - [Forcepoint DLP](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/configure-cortex-xdr/cortex-xdr-data-sources/vendor-specific-data-sources/forcepoint/forcepoint-dlp.md): Use Forcepoint DLP data with Cortex XDR. - [Fortinet](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/configure-cortex-xdr/cortex-xdr-data-sources/vendor-specific-data-sources/fortinet.md): Configure Fortinet data sources and connectors for Cortex XDR. - [Fortinet Fortigate](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/configure-cortex-xdr/cortex-xdr-data-sources/vendor-specific-data-sources/fortinet/fortinet-fortigate.md): Use Fortinet FortiGate data with Cortex XDR. - [Freshworks](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/configure-cortex-xdr/cortex-xdr-data-sources/vendor-specific-data-sources/freshworks.md): Configure the Freshworks connector for Cortex XDR. - [Freshworks](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/configure-cortex-xdr/cortex-xdr-data-sources/vendor-specific-data-sources/freshworks/freshworks.md): Use Freshworks data with Cortex XDR. - [Generic](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/configure-cortex-xdr/cortex-xdr-data-sources/vendor-specific-data-sources/generic.md): Configure Generic connectors for Cortex XDR. - [Generic MCP](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/configure-cortex-xdr/cortex-xdr-data-sources/vendor-specific-data-sources/generic/generic-mcp.md): Configure generic MCP connections in Cortex XDR. - [Generic SQL](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/configure-cortex-xdr/cortex-xdr-data-sources/vendor-specific-data-sources/generic/generic-sql.md): Configure generic SQL connections in Cortex XDR. - [GitHub](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/configure-cortex-xdr/cortex-xdr-data-sources/vendor-specific-data-sources/github.md): Configure the GitHub connector for Cortex XDR. - [GitHub](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/configure-cortex-xdr/cortex-xdr-data-sources/vendor-specific-data-sources/github/github.md): Use GitHub data with Cortex XDR. - [Google](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/configure-cortex-xdr/cortex-xdr-data-sources/vendor-specific-data-sources/google.md): Configure Google data sources and connectors for Cortex XDR. - [Google Cloud Platform](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/configure-cortex-xdr/cortex-xdr-data-sources/vendor-specific-data-sources/google/google-cloud-platform.md): Use Google Cloud Platform data with Cortex XDR. - [Ingest logs and data from a GCP Pub/Sub](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/configure-cortex-xdr/cortex-xdr-data-sources/vendor-specific-data-sources/google/google-cloud-platform/ingest-logs-and-data-from-a-gcp-pub-sub.md): Ingest logs and data from Google Cloud Pub/Sub into Cortex XDR. - [Google Kubernetes Engine](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/configure-cortex-xdr/cortex-xdr-data-sources/vendor-specific-data-sources/google/google-kubernetes-engine.md): Use Google Kubernetes Engine data with Cortex XDR. - [Ingest logs from Google Kubernetes Engine](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/configure-cortex-xdr/cortex-xdr-data-sources/vendor-specific-data-sources/google/google-kubernetes-engine/ingest-logs-from-google-kubernetes-engine.md): Ingest logs from Google Kubernetes Engine into Cortex XDR. - [Google Workspace](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/configure-cortex-xdr/cortex-xdr-data-sources/vendor-specific-data-sources/google/google-workspace.md): Use Google Workspace data with Cortex XDR. - [Ingest logs and data from Google Workspace](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/configure-cortex-xdr/cortex-xdr-data-sources/vendor-specific-data-sources/google/google-workspace/ingest-logs-and-data-from-google-workspace.md): Ingest logs and data from Google Workspace into Cortex XDR. - [Google Workspace Automation and Collection](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/configure-cortex-xdr/cortex-xdr-data-sources/vendor-specific-data-sources/google/google-workspace/google-workspace-automation-and-collection.md): Configure Google Workspace automation and collection for Cortex XDR. - [HTTP log collector](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/configure-cortex-xdr/cortex-xdr-data-sources/vendor-specific-data-sources/http-log-collector.md): Configure the HTTP log collector data source for Cortex XDR. - [Set up an HTTP log collector to receive logs](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/configure-cortex-xdr/cortex-xdr-data-sources/vendor-specific-data-sources/http-log-collector/set-up-an-http-log-collector-to-receive-logs.md): Set up an HTTP log collector to receive logs in Cortex XDR. - [IBM](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/configure-cortex-xdr/cortex-xdr-data-sources/vendor-specific-data-sources/ibm.md): Configure IBM connectors for Cortex XDR. - [IBM QRadar](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/configure-cortex-xdr/cortex-xdr-data-sources/vendor-specific-data-sources/ibm/ibm-qradar.md): Use IBM QRadar data with Cortex XDR. - [Intellum](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/configure-cortex-xdr/cortex-xdr-data-sources/vendor-specific-data-sources/intellum.md): Configure the Intellum connector for Cortex XDR. - [Intellum](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/configure-cortex-xdr/cortex-xdr-data-sources/vendor-specific-data-sources/intellum/intellum.md): Use Intellum data with Cortex XDR. - [iZOOlogic](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/configure-cortex-xdr/cortex-xdr-data-sources/vendor-specific-data-sources/izoologic.md): Configure the iZOOlogic connector for Cortex XDR. - [iZOOlogic](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/configure-cortex-xdr/cortex-xdr-data-sources/vendor-specific-data-sources/izoologic/izoologic.md): Use iZOOlogic data with Cortex XDR. - [Koi](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/configure-cortex-xdr/cortex-xdr-data-sources/vendor-specific-data-sources/koi.md): Configure the Koi connector for Cortex XDR. - [Koi](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/configure-cortex-xdr/cortex-xdr-data-sources/vendor-specific-data-sources/koi/koi.md): Use Koi data with Cortex XDR. - [Kubernetes](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/configure-cortex-xdr/cortex-xdr-data-sources/vendor-specific-data-sources/kubernetes.md): Configure the Kubernetes data source for Cortex XDR. - [LOLBAS](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/configure-cortex-xdr/cortex-xdr-data-sources/vendor-specific-data-sources/lolbas.md): Configure the LOLBAS connector for Cortex XDR. - [LOLBAS](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/configure-cortex-xdr/cortex-xdr-data-sources/vendor-specific-data-sources/lolbas/lolbas.md): Use LOLBAS data with Cortex XDR. - [Mail Utilities](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/configure-cortex-xdr/cortex-xdr-data-sources/vendor-specific-data-sources/mail-utilities.md): Configure the Mail Utilities connector for Cortex XDR. - [Mail Utilities](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/configure-cortex-xdr/cortex-xdr-data-sources/vendor-specific-data-sources/mail-utilities/mail-utilities.md): Use Mail Utilities data with Cortex XDR. - [Microsoft](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/configure-cortex-xdr/cortex-xdr-data-sources/vendor-specific-data-sources/microsoft.md): Configure Microsoft data sources and connectors for Cortex XDR. - [Azure Event Hub](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/configure-cortex-xdr/cortex-xdr-data-sources/vendor-specific-data-sources/microsoft/azure-event-hub.md): Configure Azure Event Hub log collection for Cortex XDR. - [Ingest logs from Microsoft Azure Event Hub](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/configure-cortex-xdr/cortex-xdr-data-sources/vendor-specific-data-sources/microsoft/azure-event-hub/ingest-logs-from-microsoft-azure-event-hub.md): Ingest logs from Microsoft Azure Event Hub into Cortex XDR. - [Azure Network Watcher](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/configure-cortex-xdr/cortex-xdr-data-sources/vendor-specific-data-sources/microsoft/azure-network-watcher.md): Configure Azure Network Watcher flow-log collection for Cortex XDR. - [Ingest network flow logs from Microsoft Azure Network Watcher](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/configure-cortex-xdr/cortex-xdr-data-sources/vendor-specific-data-sources/microsoft/azure-network-watcher/ingest-network-flow-logs-from-microsoft-azure-network-watcher.md): Ingest network flow logs from Azure Network Watcher into Cortex XDR. - [Microsoft Azure](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/configure-cortex-xdr/cortex-xdr-data-sources/vendor-specific-data-sources/microsoft/microsoft-azure.md): Use Microsoft Azure data with Cortex XDR. - [Microsoft 365](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/configure-cortex-xdr/cortex-xdr-data-sources/vendor-specific-data-sources/microsoft/microsoft-365.md): Use Microsoft 365 data with Cortex XDR. - [Microsoft Office 365](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/configure-cortex-xdr/cortex-xdr-data-sources/vendor-specific-data-sources/microsoft/microsoft-office-365.md): Configure Microsoft Office 365 log collection for Cortex XDR. - [Ingest logs from Microsoft Office 365](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/configure-cortex-xdr/cortex-xdr-data-sources/vendor-specific-data-sources/microsoft/microsoft-office-365/ingest-logs-from-microsoft-office-365.md): Ingest Microsoft Office 365 logs into Cortex XDR. - [Microsoft Office 365 (email)](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/configure-cortex-xdr/cortex-xdr-data-sources/vendor-specific-data-sources/microsoft/microsoft-office-365-email.md): Configure Microsoft 365 email data collection for Cortex XDR. - [Ingest logs and data from Microsoft 365](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/configure-cortex-xdr/cortex-xdr-data-sources/vendor-specific-data-sources/microsoft/microsoft-office-365-email/ingest-logs-and-data-from-microsoft-365.md): Ingest Microsoft 365 email logs and data into Cortex XDR. - [Microsoft Active Directory](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/configure-cortex-xdr/cortex-xdr-data-sources/vendor-specific-data-sources/microsoft/microsoft-active-directory.md): Use Microsoft Active Directory data with Cortex XDR. - [Microsoft Graph](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/configure-cortex-xdr/cortex-xdr-data-sources/vendor-specific-data-sources/microsoft/microsoft-graph.md): Use Microsoft Graph data with Cortex XDR. - [Microsoft Identity](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/configure-cortex-xdr/cortex-xdr-data-sources/vendor-specific-data-sources/microsoft/microsoft-identity.md): Use Microsoft Identity data with Cortex XDR. - [Microsoft Security Automation and Collection](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/configure-cortex-xdr/cortex-xdr-data-sources/vendor-specific-data-sources/microsoft/microsoft-security-automation-and-collection.md): Configure Microsoft Security automation and collection for Cortex XDR. - [M365 Automation and Collection](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/configure-cortex-xdr/cortex-xdr-data-sources/vendor-specific-data-sources/microsoft/m365-automation-and-collection.md): Configure Microsoft 365 automation and collection for Cortex XDR. - [Okta](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/configure-cortex-xdr/cortex-xdr-data-sources/vendor-specific-data-sources/okta.md): Configure Okta data sources and connectors for Cortex XDR. - [Ingest logs and data from Okta](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/configure-cortex-xdr/cortex-xdr-data-sources/vendor-specific-data-sources/okta/ingest-logs-and-data-from-okta.md): Ingest Okta logs and data into Cortex XDR. - [Okta Automation and Collection](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/configure-cortex-xdr/cortex-xdr-data-sources/vendor-specific-data-sources/okta/okta-automation-and-collection.md): Configure Okta automation and collection for Cortex XDR. - [OneLogin](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/configure-cortex-xdr/cortex-xdr-data-sources/vendor-specific-data-sources/onelogin.md): Configure the OneLogin connector for Cortex XDR. - [Ingest logs and data from OneLogin](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/configure-cortex-xdr/cortex-xdr-data-sources/vendor-specific-data-sources/onelogin/ingest-logs-and-data-from-onelogin.md): Ingest OneLogin logs and data into Cortex XDR. - [Oracle](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/configure-cortex-xdr/cortex-xdr-data-sources/vendor-specific-data-sources/oracle.md): Configure Oracle data sources and connectors for Cortex XDR. - [Oracle Cloud Infrastructure](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/configure-cortex-xdr/cortex-xdr-data-sources/vendor-specific-data-sources/oracle/oracle-cloud-infrastructure.md): Use Oracle Cloud Infrastructure data with Cortex XDR. - [PagerDuty](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/configure-cortex-xdr/cortex-xdr-data-sources/vendor-specific-data-sources/pagerduty.md): Configure the PagerDuty connector for Cortex XDR. - [PagerDuty Automation and Collection](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/configure-cortex-xdr/cortex-xdr-data-sources/vendor-specific-data-sources/pagerduty/pagerduty-automation-and-collection.md): Configure PagerDuty automation and collection for Cortex XDR. - [Ping Identity](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/configure-cortex-xdr/cortex-xdr-data-sources/vendor-specific-data-sources/ping-identity.md): Configure Ping Identity data sources and connectors for Cortex XDR. - [PingFederate](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/configure-cortex-xdr/cortex-xdr-data-sources/vendor-specific-data-sources/ping-identity/pingfederate.md): Use PingFederate data with Cortex XDR. - [PingOne](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/configure-cortex-xdr/cortex-xdr-data-sources/vendor-specific-data-sources/ping-identity/pingone.md): Use PingOne data with Cortex XDR. - [Ingest authentication logs and data from PingOne](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/configure-cortex-xdr/cortex-xdr-data-sources/vendor-specific-data-sources/ping-identity/pingone/ingest-authentication-logs-and-data-from-pingone.md): Ingest PingOne authentication logs and data into Cortex XDR. - [Salesforce](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/configure-cortex-xdr/cortex-xdr-data-sources/vendor-specific-data-sources/salesforce.md): Configure Salesforce data sources for Cortex XDR. - [Ingest logs and data from Salesforce](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/configure-cortex-xdr/cortex-xdr-data-sources/vendor-specific-data-sources/salesforce/ingest-logs-and-data-from-salesforce.md): Ingest Salesforce logs and data into Cortex XDR. - [Salesforce connector](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/configure-cortex-xdr/cortex-xdr-data-sources/vendor-specific-data-sources/salesforce/ingest-and-run-salesforce-automation-and-remediation.md): Use Salesforce connector data with Cortex XDR. - [Automation and remediation commands](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/configure-cortex-xdr/cortex-xdr-data-sources/vendor-specific-data-sources/salesforce/ingest-and-run-salesforce-automation-and-remediation/automation-and-remediation-commands.md): Salesforce Automation and Remediation commands for playbooks and the War Room for Cortex XDR. - [ServiceNow](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/configure-cortex-xdr/cortex-xdr-data-sources/vendor-specific-data-sources/servicenow.md): Configure ServiceNow data sources for Cortex XDR. - [ServiceNow Automation and Collection](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/configure-cortex-xdr/cortex-xdr-data-sources/vendor-specific-data-sources/servicenow/servicenow-automation-and-collection.md): Configure ServiceNow automation and collection for Cortex XDR. - [Slack](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/configure-cortex-xdr/cortex-xdr-data-sources/vendor-specific-data-sources/slack.md): Configure Slack data sources for Cortex XDR. - [Slack Automation and Collection](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/configure-cortex-xdr/cortex-xdr-data-sources/vendor-specific-data-sources/slack/slack-automation-and-collection.md): Configure Slack automation, notifications, and log collection for Cortex XDR. - [SMB](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/configure-cortex-xdr/cortex-xdr-data-sources/vendor-specific-data-sources/smb.md): Configure the SMB connector for Cortex XDR. - [SMB](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/configure-cortex-xdr/cortex-xdr-data-sources/vendor-specific-data-sources/smb/smb.md): Use SMB data for file and directory management in Cortex XDR. - [Workday](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/configure-cortex-xdr/cortex-xdr-data-sources/vendor-specific-data-sources/workday.md): Configure Workday data sources for Cortex XDR. - [Ingest report data from Workday](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/configure-cortex-xdr/cortex-xdr-data-sources/vendor-specific-data-sources/workday/ingest-report-data-from-workday.md): Ingest Workday report data into Cortex XDR. - [Zendesk](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/configure-cortex-xdr/cortex-xdr-data-sources/vendor-specific-data-sources/zendesk.md): Configure the Zendesk connector for Cortex XDR. - [Zendesk](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/configure-cortex-xdr/cortex-xdr-data-sources/vendor-specific-data-sources/zendesk/zendesk.md): Use Zendesk data with Cortex XDR. - [Zoom](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/configure-cortex-xdr/cortex-xdr-data-sources/vendor-specific-data-sources/zoom.md): Configure the Zoom connector for Cortex XDR. - [Zoom](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/configure-cortex-xdr/cortex-xdr-data-sources/vendor-specific-data-sources/zoom/zoom.md): Use Zoom users, meetings, logs, and feeds with Cortex XDR. - [Zscaler](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/configure-cortex-xdr/cortex-xdr-data-sources/vendor-specific-data-sources/zscaler.md): Configure Zscaler data sources for Cortex XDR. - [Zscaler Internet Access](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/configure-cortex-xdr/cortex-xdr-data-sources/vendor-specific-data-sources/zscaler/zscaler-internet-access.md): Configure Zscaler Internet Access log collection for Cortex XDR. - [Zscaler Private Access](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/configure-cortex-xdr/cortex-xdr-data-sources/vendor-specific-data-sources/zscaler/zscaler-private-access.md): Configure Zscaler Private Access log collection for Cortex XDR. - [Zscaler](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/configure-cortex-xdr/cortex-xdr-data-sources/vendor-specific-data-sources/zscaler/zscaler.md): Use Zscaler data for log collection and security management in Cortex XDR. - [Connectors](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/configure-cortex-xdr/cortex-xdr-data-sources/connectors.md): Browse supported connectors for Cortex XDR data ingestion. - [Standard data sources](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/configure-cortex-xdr/cortex-xdr-data-sources/standard-data-sources.md): Browse supported standard data sources for Cortex XDR. - [Cloud service provider (CSP) onboarding](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/configure-cortex-xdr/cortex-xdr-data-sources/cloud-service-provider-csp-onboarding.md): Learn about onboarding your cloud service provider to Cortex XDR. - [Amazon Web Services cloud onboarding](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/configure-cortex-xdr/cortex-xdr-data-sources/cloud-service-provider-csp-onboarding/amazon-web-services-cloud-onboarding.md): Follow the AWS onboarding wizard, and Cortex XDR creates a custom authentication template to be deployed in AWS. - [AWS security capabilities and deployment planning](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/configure-cortex-xdr/cortex-xdr-data-sources/cloud-service-provider-csp-onboarding/amazon-web-services-cloud-onboarding/aws-security-capabilities-and-deployment-planning.md): Configure cloud service provider onboarding for Cortex XDR. - [AWS resource inventory](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/configure-cortex-xdr/cortex-xdr-data-sources/cloud-service-provider-csp-onboarding/amazon-web-services-cloud-onboarding/aws-resource-inventory.md): Configure cloud service provider onboarding for Cortex XDR. - [AWS security model and authentication](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/configure-cortex-xdr/cortex-xdr-data-sources/cloud-service-provider-csp-onboarding/amazon-web-services-cloud-onboarding/aws-security-model-and-authentication.md): Configure cloud service provider onboarding for Cortex XDR. - [Cortex XDR and AWS audit log collection architecture](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/configure-cortex-xdr/cortex-xdr-data-sources/cloud-service-provider-csp-onboarding/amazon-web-services-cloud-onboarding/cortex-cloud-and-aws-audit-log-collection-architecture.md): Configure cloud service provider onboarding for Cortex XDR. - [Onboard Amazon Web Services](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/configure-cortex-xdr/cortex-xdr-data-sources/cloud-service-provider-csp-onboarding/amazon-web-services-cloud-onboarding/onboard-amazon-web-services.md): Follow the AWS onboarding wizard, and Cortex XDR creates a custom authentication template to be executed in AWS. - [Prerequisites for onboarding AWS](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/configure-cortex-xdr/cortex-xdr-data-sources/cloud-service-provider-csp-onboarding/amazon-web-services-cloud-onboarding/prerequisites-for-onboarding-aws.md): Before you begin onboarding AWS, you must review the following prerequisites. - [How to onboard Amazon Web Services](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/configure-cortex-xdr/cortex-xdr-data-sources/cloud-service-provider-csp-onboarding/amazon-web-services-cloud-onboarding/how-to-onboard-amazon-web-services.md): Follow the AWS onboarding wizard and Cortex XDR creates a custom authentication template to be deployed in AWS CloudFormation. - [Deploy the authentication template in AWS](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/configure-cortex-xdr/cortex-xdr-data-sources/cloud-service-provider-csp-onboarding/amazon-web-services-cloud-onboarding/deploy-the-authentication-template-in-aws.md): Learn how to deploy the Terraform or CloudFormation authentication template in Amazon Web Services. - [Post-deployment: Custom (BYOB) and Control Tower audit log collection](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/configure-cortex-xdr/cortex-xdr-data-sources/cloud-service-provider-csp-onboarding/amazon-web-services-cloud-onboarding/post-deployment-custom-byob-audit-log-collection.md): Configure cloud service provider onboarding for Cortex XDR. - [Grant cross-account KMS key access for Control Tower BYOB log collection](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/configure-cortex-xdr/cortex-xdr-data-sources/cloud-service-provider-csp-onboarding/amazon-web-services-cloud-onboarding/grant-cross-account-kms-key-access-for-control-tower-byob-log-collection.md): Learn how to configure cross-account AWS KMS key permissions for Cortex Control Tower BYOB log collection. Step-by-step guide to updating KMS key policies. - [AWS post-deployment verification](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/configure-cortex-xdr/cortex-xdr-data-sources/cloud-service-provider-csp-onboarding/amazon-web-services-cloud-onboarding/aws-post-deployment-verification.md): After you have completed the AWS onboarding wizard and you have deployed the authentication template in AWS (using CloudFormation or Terraform), verify that the deployment succeeded. - [Amazon Web Services (AWS) provider permissions](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/configure-cortex-xdr/cortex-xdr-data-sources/cloud-service-provider-csp-onboarding/amazon-web-services-cloud-onboarding/amazon-web-services-aws-provider-permissions.md): List of Amazon Web Services (AWS) permissions for use during Cortex XDR onboarding to enable continuous monitoring in your cloud environment. - [Microsoft Azure cloud onboarding](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/configure-cortex-xdr/cortex-xdr-data-sources/cloud-service-provider-csp-onboarding/microsoft-azure-cloud-onboarding.md): Configure cloud service provider onboarding for Cortex XDR. - [Onboard Microsoft Azure](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/configure-cortex-xdr/cortex-xdr-data-sources/cloud-service-provider-csp-onboarding/microsoft-azure-cloud-onboarding/onboard-microsoft-azure.md): Follow the Azure onboarding wizard, and Cortex XDR creates a custom authentication template to be executed in Azure. - [Prerequisites for onboarding Azure](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/configure-cortex-xdr/cortex-xdr-data-sources/cloud-service-provider-csp-onboarding/microsoft-azure-cloud-onboarding/prerequisites-for-onboarding-azure.md): Before you begin onboarding Microsoft Azure, you must review the following prerequisites. - [How to onboard Microsoft Azure](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/configure-cortex-xdr/cortex-xdr-data-sources/cloud-service-provider-csp-onboarding/microsoft-azure-cloud-onboarding/how-to-onboard-microsoft-azure.md): Follow the Azure onboarding wizard, and Cortex creates a custom authentication template to be executed in Azure. - [Finalize Microsoft Azure onboarding by executing the authentication template](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/configure-cortex-xdr/cortex-xdr-data-sources/cloud-service-provider-csp-onboarding/microsoft-azure-cloud-onboarding/finalize-microsoft-azure-onboarding-by-executing-the-authentication-template.md): Learn how to execute the authentication template file in Microsoft Azure for subscriptions, tenants, and management groups. We provide instructions both for applying the Terraform template's configura - [Microsoft Azure offboarding overview](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/configure-cortex-xdr/cortex-xdr-data-sources/cloud-service-provider-csp-onboarding/microsoft-azure-cloud-onboarding/microsoft-azure-offboarding-overview.md): This section contains the technical procedures required to safely decommission and offboard your Cortex XDR resources in Microsoft Azure. - [Offboard Terraform-based Azure deployments (all scopes)](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/configure-cortex-xdr/cortex-xdr-data-sources/cloud-service-provider-csp-onboarding/microsoft-azure-cloud-onboarding/microsoft-azure-offboarding-overview/offboard-terraform-based-azure-deployments-all-scopes.md): How to offboard all Terraform-based Microsoft Azure scopes from Cortex XDR: A step-by-step technical guide to safely running Terraform destroy and cleaning up policy-deployed resources. - [Offboard Azure subscription (ARM)](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/configure-cortex-xdr/cortex-xdr-data-sources/cloud-service-provider-csp-onboarding/microsoft-azure-cloud-onboarding/microsoft-azure-offboarding-overview/offboard-azure-subscription-arm.md): How to offboard a Microsoft Azure subscription scope that was onboarded using ARM: A step-by-step technical guide to safely running the interactive offboarding script and cleaning up all resources. - [Offboard Azure management group or tenant scope (ARM)](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/configure-cortex-xdr/cortex-xdr-data-sources/cloud-service-provider-csp-onboarding/microsoft-azure-cloud-onboarding/microsoft-azure-offboarding-overview/offboard-azure-management-group-or-tenant-scope-arm.md): How to offboard Microsoft Azure management group or tenant scopes from Cortex XDR: A step-by-step technical guide to safely removing all Azure resources deployed by Cortex onboarding templates. - [Offboard Azure tenant with Entra ID only](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/configure-cortex-xdr/cortex-xdr-data-sources/cloud-service-provider-csp-onboarding/microsoft-azure-cloud-onboarding/microsoft-azure-offboarding-overview/offboard-azure-tenant-with-entra-id-only.md): How to offboard a Microsoft Azure tenant onboarded with the Entra ID only option from Cortex XDR: A step-by-step technical guide to safely removing deployed resources. - [Microsoft Azure provider permissions](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/configure-cortex-xdr/cortex-xdr-data-sources/cloud-service-provider-csp-onboarding/microsoft-azure-cloud-onboarding/microsoft-azure-provider-permissions.md): List of Microsoft Azure provider permissions for Cortex XDR. - [Google Cloud Platform cloud onboarding](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/configure-cortex-xdr/cortex-xdr-data-sources/cloud-service-provider-csp-onboarding/google-cloud-platform-cloud-onboarding.md): Configure cloud service provider onboarding for Cortex XDR. - [Onboard Google Cloud Platform](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/configure-cortex-xdr/cortex-xdr-data-sources/cloud-service-provider-csp-onboarding/google-cloud-platform-cloud-onboarding/onboard-google-cloud-platform.md): Follow the GCP onboarding wizard, and Cortex XDR creates a custom authentication template to be executed in GCP. - [Prerequisites for onboarding GCP](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/configure-cortex-xdr/cortex-xdr-data-sources/cloud-service-provider-csp-onboarding/google-cloud-platform-cloud-onboarding/prerequisites-for-onboarding-gcp.md): Before you begin onboarding GCP, you must review the following prerequisites. - [Required APIs](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/configure-cortex-xdr/cortex-xdr-data-sources/cloud-service-provider-csp-onboarding/google-cloud-platform-cloud-onboarding/prerequisites-for-onboarding-gcp/required-apis.md) - [How to onboard Google Cloud Platform](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/configure-cortex-xdr/cortex-xdr-data-sources/cloud-service-provider-csp-onboarding/google-cloud-platform-cloud-onboarding/how-to-onboard-google-cloud-platform.md): Follow the GCP onboarding wizard, and Cortex XDR creates a custom authentication template to be applied in GCP. - [Deploy the Terraform authentication template in GCP](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/configure-cortex-xdr/cortex-xdr-data-sources/cloud-service-provider-csp-onboarding/google-cloud-platform-cloud-onboarding/deploy-the-terraform-authentication-template-in-gcp.md): Learn how to deploy the Terraform authentication template in Google Cloud Console. - [Connect Google Workspace with your GCP cloud instance](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/configure-cortex-xdr/cortex-xdr-data-sources/cloud-service-provider-csp-onboarding/google-cloud-platform-cloud-onboarding/connect-google-workspace-with-your-gcp-cloud-instance.md): Configure cloud service provider onboarding for Cortex XDR. - [Monitor GCP resources inside service perimeters](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/configure-cortex-xdr/cortex-xdr-data-sources/cloud-service-provider-csp-onboarding/google-cloud-platform-cloud-onboarding/monitor-gcp-resources-inside-service-perimeters.md): Learn how to grant authorization to Cortex XDR to scan within your GCP service perimeter. - [Google Cloud Platform (GCP) provider permissions](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/configure-cortex-xdr/cortex-xdr-data-sources/cloud-service-provider-csp-onboarding/google-cloud-platform-cloud-onboarding/google-cloud-platform-gcp-provider-permissions.md): List of Google Cloud Platform (GCP) permissions for use during Cortex XDR onboarding to enable continuous monitoring in your cloud environment. - [Oracle Cloud Infrastructure cloud onboarding](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/configure-cortex-xdr/cortex-xdr-data-sources/cloud-service-provider-csp-onboarding/oracle-cloud-infrastructure-cloud-onboarding.md): Follow the Oracle Cloud Infrastructure onboarding wizard and Cortex XDR creates a custom Terraform authentication template to be deployed in Oracle Cloud Infrastructure. - [Onboard Oracle Cloud Infrastructure](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/configure-cortex-xdr/cortex-xdr-data-sources/cloud-service-provider-csp-onboarding/oracle-cloud-infrastructure-cloud-onboarding/onboard-oracle-cloud-infrastructure.md): Follow the OCI onboarding wizard, and Cortex XDR creates a custom authentication template to be executed in OCI. - [Prerequisites for onboarding OCI](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/configure-cortex-xdr/cortex-xdr-data-sources/cloud-service-provider-csp-onboarding/oracle-cloud-infrastructure-cloud-onboarding/prerequisites-for-onboarding-oci.md): Before you begin onboarding Oracle Cloud Infrastructure, you must review the following prerequisites. - [How to onboard Oracle Cloud Infrastructure](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/configure-cortex-xdr/cortex-xdr-data-sources/cloud-service-provider-csp-onboarding/oracle-cloud-infrastructure-cloud-onboarding/how-to-onboard-oracle-cloud-infrastructure.md): Follow the OCI onboarding wizard and Cortex XDR creates a custom authentication template to be applied in OCI. - [Deploy the Terraform authentication template in OCI](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/configure-cortex-xdr/cortex-xdr-data-sources/cloud-service-provider-csp-onboarding/oracle-cloud-infrastructure-cloud-onboarding/deploy-the-terraform-authentication-template-in-oci.md): Learn how to deploy the Terraform authentication template in Oracle Cloud Infrastructure. - [Oracle Cloud Infrastructure (OCI) provider permissions](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/configure-cortex-xdr/cortex-xdr-data-sources/cloud-service-provider-csp-onboarding/oracle-cloud-infrastructure-cloud-onboarding/oracle-cloud-infrastructure-oci-provider-permissions.md): List of Oracle Cloud Infrastructure provider permissions for Cortex XDR. - [Alibaba Cloud cloud onboarding](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/configure-cortex-xdr/cortex-xdr-data-sources/cloud-service-provider-csp-onboarding/alibaba-cloud-cloud-onboarding.md): Follow the Alibaba Cloud onboarding wizard and Cortex XDR creates a custom Terraform authentication template to be deployed in Alibaba Cloud. - [Alibaba security capabilities and deployment planning](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/configure-cortex-xdr/cortex-xdr-data-sources/cloud-service-provider-csp-onboarding/alibaba-cloud-cloud-onboarding/alibaba-security-capabilities-and-deployment-planning.md): Configure cloud service provider onboarding for Cortex XDR. - [Alibaba Cloud resource inventory](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/configure-cortex-xdr/cortex-xdr-data-sources/cloud-service-provider-csp-onboarding/alibaba-cloud-cloud-onboarding/alibaba-cloud-resource-inventory.md): Configure cloud service provider onboarding for Cortex XDR. - [Alibaba Cloud security model and authentication](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/configure-cortex-xdr/cortex-xdr-data-sources/cloud-service-provider-csp-onboarding/alibaba-cloud-cloud-onboarding/alibaba-cloud-security-model-and-authentication.md): Configure cloud service provider onboarding for Cortex XDR. - [Onboard Alibaba Cloud](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/configure-cortex-xdr/cortex-xdr-data-sources/cloud-service-provider-csp-onboarding/alibaba-cloud-cloud-onboarding/onboard-alibaba-cloud.md): Follow the Alibaba Cloud onboarding wizard and Cortex XDR creates a custom CloudFormation authentication template to be deployed in Alibaba Cloud. - [Prerequisites for onboarding Alibaba Cloud](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/configure-cortex-xdr/cortex-xdr-data-sources/cloud-service-provider-csp-onboarding/alibaba-cloud-cloud-onboarding/prerequisites-for-onboarding-alibaba-cloud.md): Before you begin onboarding Alibaba Cloud, you must review the following prerequisites. - [How to onboard Alibaba Cloud](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/configure-cortex-xdr/cortex-xdr-data-sources/cloud-service-provider-csp-onboarding/alibaba-cloud-cloud-onboarding/how-to-onboard-alibaba-cloud.md): Configure cloud service provider onboarding for Cortex XDR. - [Alibaba Cloud post-deployment verification](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/configure-cortex-xdr/cortex-xdr-data-sources/cloud-service-provider-csp-onboarding/alibaba-cloud-cloud-onboarding/alibaba-cloud-post-deployment-verification.md): After you have completed the Alibaba Cloud onboarding wizard and you have deployed the authentication template in Alibaba Cloud, verify that the deployment succeeded. - [Alibaba Cloud provider permissions](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/configure-cortex-xdr/cortex-xdr-data-sources/cloud-service-provider-csp-onboarding/alibaba-cloud-cloud-onboarding/alibaba-cloud-provider-permissions.md): List of Alibaba Cloud permissions for use during Cortex XDR onboarding to enable continuous monitoring in your cloud environment. - [Outpost onboarding](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/configure-cortex-xdr/cortex-xdr-data-sources/cloud-service-provider-csp-onboarding/outpost-onboarding.md): Learn about outposts, which are a dedicated set of infrastructure resources that extends the reach of Cortex XDR into your environment. - [Outpost fundamentals and planning](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/configure-cortex-xdr/cortex-xdr-data-sources/cloud-service-provider-csp-onboarding/outpost-onboarding/outpost-fundamentals-and-planning.md): An outpost enables you to have security scans performed on infrastructure in a cloud account owned by you. Learn about outpost fundamentals and what to consider when planning your outpost. - [Outpost creation workflow](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/configure-cortex-xdr/cortex-xdr-data-sources/cloud-service-provider-csp-onboarding/outpost-onboarding/outpost-creation-workflow.md): Learn about the creation process for an outposts, which facilitate security scanning performed on infrastructure in a cloud account owned by you. - [Working with standard outposts](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/configure-cortex-xdr/cortex-xdr-data-sources/cloud-service-provider-csp-onboarding/outpost-onboarding/working-with-standard-outposts.md): Standard outposts are the recommended way to create dedicated set of infrastructure resources that extends the reach of Cortex XDR into your environment. - [Create a standard outpost](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/configure-cortex-xdr/cortex-xdr-data-sources/cloud-service-provider-csp-onboarding/outpost-onboarding/working-with-standard-outposts/create-a-standard-outpost.md): Instructions for creating a standard outpost while onboarding your CSP. - [Working with Bringing your own Azure app (BYOA) outposts](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/configure-cortex-xdr/cortex-xdr-data-sources/cloud-service-provider-csp-onboarding/outpost-onboarding/working-with-bringing-your-own-azure-app-byoa-outposts.md): Using advanced settings while creating your outpost, you can deploy a Cortex XDR Azure outpost using your own pre-created Entra ID app registration. - [Task 1: Meet the prerequisites for Azure BYOA outposts](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/configure-cortex-xdr/cortex-xdr-data-sources/cloud-service-provider-csp-onboarding/outpost-onboarding/working-with-bringing-your-own-azure-app-byoa-outposts/task-1-meet-the-prerequisites-for-azure-byoa-outposts.md): You can customize your own Azure outpost by bringing your own app (BYOA). This page lists the prerequisites that must be met before customizing your outpost in this way. - [Task 2: Create the app registration for the Azure BYOA outpost](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/configure-cortex-xdr/cortex-xdr-data-sources/cloud-service-provider-csp-onboarding/outpost-onboarding/working-with-bringing-your-own-azure-app-byoa-outposts/task-2-create-the-app-registration-for-the-azure-byoa-outpost.md): You can customize your own outpost for Azure by bringing your own app (BYOA). This page describes the steps for creating the app registration. - [Task 3: Deploy the Azure BYOA outpost](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/configure-cortex-xdr/cortex-xdr-data-sources/cloud-service-provider-csp-onboarding/outpost-onboarding/working-with-bringing-your-own-azure-app-byoa-outposts/task-3-deploy-the-azure-byoa-outpost.md): You can customize your own outpost by bringing your own app (BYOA). This page describes the steps for deploying the Azure BYOA outpost. - [Task 4: Verify the BYOA outpost deployment](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/configure-cortex-xdr/cortex-xdr-data-sources/cloud-service-provider-csp-onboarding/outpost-onboarding/working-with-bringing-your-own-azure-app-byoa-outposts/task-4-verify-the-byoa-outpost-deployment.md): You can customize your own Azure outpost by bringing your own app (BYOA). This page describes the steps for verifying your BYOA outpost deployment. - [The shell script for Azure app registration](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/configure-cortex-xdr/cortex-xdr-data-sources/cloud-service-provider-csp-onboarding/outpost-onboarding/working-with-bringing-your-own-azure-app-byoa-outposts/the-shell-script-for-azure-app-registration.md): You can run this helper shell script to set up your resources and retrieve their IDs for use while creating your Azure BYOA outpost. This page provides technical, "read-me style" details about the scr - [Outpost troubleshooting](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/configure-cortex-xdr/cortex-xdr-data-sources/cloud-service-provider-csp-onboarding/outpost-onboarding/outpost-troubleshooting.md): Check here for solutions to issues that might occur while configuring, deploying, and operating outposts. - [Outpost Cloud Service Provider (CSP) permissions](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/configure-cortex-xdr/cortex-xdr-data-sources/cloud-service-provider-csp-onboarding/outpost-onboarding/outpost-cloud-service-provider-csp-permissions.md): This page lists and explains the various roles and permissions needed for working with resources for outposts by CSP. - [Amazon Web Services (AWS) outpost permissions](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/configure-cortex-xdr/cortex-xdr-data-sources/cloud-service-provider-csp-onboarding/outpost-onboarding/outpost-cloud-service-provider-csp-permissions/amazon-web-services-aws-outpost-permissions.md): List of Amazon Web Services (AWS) permissions for use during Cortex XDR outpost onboarding to enable continuous monitoring in your cloud environment. - [Microsoft Azure outpost permissions](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/configure-cortex-xdr/cortex-xdr-data-sources/cloud-service-provider-csp-onboarding/outpost-onboarding/outpost-cloud-service-provider-csp-permissions/microsoft-azure-outpost-permissions.md): List of Microsoft Azure provider outpost permissions for Cortex XDR. - [Google Cloud Platform (GCP) outpost permissions](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/configure-cortex-xdr/cortex-xdr-data-sources/cloud-service-provider-csp-onboarding/outpost-onboarding/outpost-cloud-service-provider-csp-permissions/google-cloud-platform-gcp-outpost-permissions.md): List of Google Cloud Platform (GCP) permissions for use during Cortex XDR onboarding outposts to enable continuous monitoring in your cloud environment. - [Introduction to Terraform for Cloud service provider (CSP) onboarding](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/configure-cortex-xdr/cortex-xdr-data-sources/cloud-service-provider-csp-onboarding/introduction-to-terraform-for-cloud-service-provider-csp-onboarding.md): Learn how to onboard Cloud Service Providers (CSPs) using Terraform. Discover step-by-step workflows for initial provisioning, updates, and Cloud Shell deployment. - [Manually connect a cloud instance](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/configure-cortex-xdr/cortex-xdr-data-sources/cloud-service-provider-csp-onboarding/manually-connect-a-cloud-instance.md): Configure cloud service provider onboarding for Cortex XDR. - [Manage cloud instances](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/configure-cortex-xdr/cortex-xdr-data-sources/cloud-service-provider-csp-onboarding/manage-cloud-instances.md): Learn how to manage, edit, and troubleshoot cloud instances in Cortex XDR. Monitor connector health, view security capabilities, and investigate errors. - [Pending cloud instances](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/configure-cortex-xdr/cortex-xdr-data-sources/cloud-service-provider-csp-onboarding/pending-cloud-instances.md): Configure cloud service provider onboarding for Cortex XDR. - [Edit your onboarded CSP configuration](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/configure-cortex-xdr/cortex-xdr-data-sources/cloud-service-provider-csp-onboarding/edit-your-onboarded-csp-configuration.md): Configure cloud service provider onboarding for Cortex XDR. - [Update cloud permissions after Cortex XDR release updates](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/configure-cortex-xdr/cortex-xdr-data-sources/cloud-service-provider-csp-onboarding/update-cloud-permissions-after-cortex-release-updates.md): Manage permission updates for your cloud instances following new feature releases or bug fixes. - [Troubleshoot errors on cloud instances](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/configure-cortex-xdr/cortex-xdr-data-sources/cloud-service-provider-csp-onboarding/troubleshoot-errors-on-cloud-instances.md): You can troubleshoot errors on cloud instances by drilling down on an instance from the Data Sources & Integrations page. - [Cloud service provider permissions](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/configure-cortex-xdr/cortex-xdr-data-sources/cloud-service-provider-csp-onboarding/cloud-service-provider-permissions.md): Grant the correct cloud service provider permissions for Cortex XDR. - [Generic on-premise data collectors](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/configure-cortex-xdr/cortex-xdr-data-sources/generic-on-premise-data-collectors.md): Configure on-premises data collection for Cortex XDR. - [Broker VM data collector applets](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/configure-cortex-xdr/cortex-xdr-data-sources/generic-on-premise-data-collectors/broker-vm-data-collector-applets.md): Configure on-premises data collection for Cortex XDR. - [Activate Apache Kafka Collector](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/configure-cortex-xdr/cortex-xdr-data-sources/generic-on-premise-data-collectors/broker-vm-data-collector-applets/activate-apache-kafka-collector.md): Configure on-premises data collection for Cortex XDR. - [Activate Cortex Network Scanner](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/configure-cortex-xdr/cortex-xdr-data-sources/generic-on-premise-data-collectors/broker-vm-data-collector-applets/activate-cortex-network-scanner.md): Configure on-premises data collection for Cortex XDR. - [Activate CSV Collector](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/configure-cortex-xdr/cortex-xdr-data-sources/generic-on-premise-data-collectors/broker-vm-data-collector-applets/activate-csv-collector.md): Configure on-premises data collection for Cortex XDR. - [Activate Database Collector](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/configure-cortex-xdr/cortex-xdr-data-sources/generic-on-premise-data-collectors/broker-vm-data-collector-applets/activate-database-collector.md): Configure on-premises data collection for Cortex XDR. - [Activate Files and Folders Collector](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/configure-cortex-xdr/cortex-xdr-data-sources/generic-on-premise-data-collectors/broker-vm-data-collector-applets/activate-files-and-folders-collector.md): Configure on-premises data collection for Cortex XDR. - [Activate FTP Collector](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/configure-cortex-xdr/cortex-xdr-data-sources/generic-on-premise-data-collectors/broker-vm-data-collector-applets/activate-ftp-collector.md): Configure on-premises data collection for Cortex XDR. - [Activate Local Agent Settings](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/configure-cortex-xdr/cortex-xdr-data-sources/generic-on-premise-data-collectors/broker-vm-data-collector-applets/activate-local-agent-settings.md): Configure on-premises data collection for Cortex XDR. - [Activate NetFlow Collector](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/configure-cortex-xdr/cortex-xdr-data-sources/generic-on-premise-data-collectors/broker-vm-data-collector-applets/activate-netflow-collector.md): Configure on-premises data collection for Cortex XDR. - [Activate Network Mapper](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/configure-cortex-xdr/cortex-xdr-data-sources/generic-on-premise-data-collectors/broker-vm-data-collector-applets/activate-network-mapper.md): Configure on-premises data collection for Cortex XDR. - [Syslog Collector applet](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/configure-cortex-xdr/cortex-xdr-data-sources/generic-on-premise-data-collectors/broker-vm-data-collector-applets/syslog-collector-applet.md): Configure on-premises data collection for Cortex XDR. - [Activate Syslog Collector](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/configure-cortex-xdr/cortex-xdr-data-sources/generic-on-premise-data-collectors/broker-vm-data-collector-applets/syslog-collector-applet/activate-syslog-collector.md): Configure on-premises data collection for Cortex XDR. - [Ingest logs from a Syslog receiver](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/configure-cortex-xdr/cortex-xdr-data-sources/generic-on-premise-data-collectors/broker-vm-data-collector-applets/syslog-collector-applet/ingest-logs-from-a-syslog-receiver.md): To extend visibility, Cortex XDR can receive Syslog from additional vendors that use CEF or LEEF formatted over Syslog (TLS not supported). - [Check Point FW1 VPN1](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/configure-cortex-xdr/cortex-xdr-data-sources/generic-on-premise-data-collectors/broker-vm-data-collector-applets/syslog-collector-applet/check-point-fw1-vpn1.md): Configure on-premises data collection for Cortex XDR. - [Ingest logs from Check Point firewalls](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/configure-cortex-xdr/cortex-xdr-data-sources/generic-on-premise-data-collectors/broker-vm-data-collector-applets/syslog-collector-applet/check-point-fw1-vpn1/ingest-logs-from-check-point-firewalls.md): Configure on-premises data collection for Cortex XDR. - [Cisco ASA firewalls and AnyConnect](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/configure-cortex-xdr/cortex-xdr-data-sources/generic-on-premise-data-collectors/broker-vm-data-collector-applets/syslog-collector-applet/cisco-asa-firewalls-and-anyconnect.md): Configure on-premises data collection for Cortex XDR. - [Ingest logs from Cisco ASA firewalls and AnyConnect](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/configure-cortex-xdr/cortex-xdr-data-sources/generic-on-premise-data-collectors/broker-vm-data-collector-applets/syslog-collector-applet/cisco-asa-firewalls-and-anyconnect/ingest-logs-from-cisco-asa-firewalls-and-anyconnect.md): Configure on-premises data collection for Cortex XDR. - [Corelight Zeek](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/configure-cortex-xdr/cortex-xdr-data-sources/generic-on-premise-data-collectors/broker-vm-data-collector-applets/syslog-collector-applet/corelight-zeek.md): Configure on-premises data collection for Cortex XDR. - [Ingest logs from Corelight Zeek](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/configure-cortex-xdr/cortex-xdr-data-sources/generic-on-premise-data-collectors/broker-vm-data-collector-applets/syslog-collector-applet/corelight-zeek/ingest-logs-from-corelight-zeek.md): Configure on-premises data collection for Cortex XDR. - [Forcepoint DLP](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/configure-cortex-xdr/cortex-xdr-data-sources/generic-on-premise-data-collectors/broker-vm-data-collector-applets/syslog-collector-applet/forcepoint-dlp.md): Configure on-premises data collection for Cortex XDR. - [Ingest logs from Forcepoint DLP](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/configure-cortex-xdr/cortex-xdr-data-sources/generic-on-premise-data-collectors/broker-vm-data-collector-applets/syslog-collector-applet/forcepoint-dlp/ingest-logs-from-forcepoint-dlp.md): Configure on-premises data collection for Cortex XDR. - [Fortinet Fortigate](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/configure-cortex-xdr/cortex-xdr-data-sources/generic-on-premise-data-collectors/broker-vm-data-collector-applets/syslog-collector-applet/fortinet-fortigate.md): Configure on-premises data collection for Cortex XDR. - [Ingest logs from Fortinet Fortigate firewalls](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/configure-cortex-xdr/cortex-xdr-data-sources/generic-on-premise-data-collectors/broker-vm-data-collector-applets/syslog-collector-applet/fortinet-fortigate/ingest-logs-from-fortinet-fortigate-firewalls.md): Configure on-premises data collection for Cortex XDR. - [Next Generation Firewall](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/configure-cortex-xdr/cortex-xdr-data-sources/generic-on-premise-data-collectors/broker-vm-data-collector-applets/syslog-collector-applet/next-generation-firewall.md): Configure on-premises data collection for Cortex XDR. - [Ingest Next-Generation Firewall logs using the Syslog Collector](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/configure-cortex-xdr/cortex-xdr-data-sources/generic-on-premise-data-collectors/broker-vm-data-collector-applets/syslog-collector-applet/next-generation-firewall/ingest-next-generation-firewall-logs-using-the-syslog-collector.md): Configure on-premises data collection for Cortex XDR. - [PingFederate](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/configure-cortex-xdr/cortex-xdr-data-sources/generic-on-premise-data-collectors/broker-vm-data-collector-applets/syslog-collector-applet/pingfederate.md): Configure on-premises data collection for Cortex XDR. - [Ingest authentication logs from PingFederate](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/configure-cortex-xdr/cortex-xdr-data-sources/generic-on-premise-data-collectors/broker-vm-data-collector-applets/syslog-collector-applet/pingfederate/ingest-authentication-logs-from-pingfederate.md): Configure on-premises data collection for Cortex XDR. - [Zscaler Internet Access](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/configure-cortex-xdr/cortex-xdr-data-sources/generic-on-premise-data-collectors/broker-vm-data-collector-applets/syslog-collector-applet/zscaler-internet-access.md): Configure on-premises data collection for Cortex XDR. - [Ingest logs from Zscaler Internet Access](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/configure-cortex-xdr/cortex-xdr-data-sources/generic-on-premise-data-collectors/broker-vm-data-collector-applets/syslog-collector-applet/zscaler-internet-access/ingest-logs-from-zscaler-internet-access.md): Configure on-premises data collection for Cortex XDR. - [Zscaler Private Access](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/configure-cortex-xdr/cortex-xdr-data-sources/generic-on-premise-data-collectors/broker-vm-data-collector-applets/syslog-collector-applet/zscaler-private-access.md): Configure on-premises data collection for Cortex XDR. - [Ingest logs from Zscaler Private Access](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/configure-cortex-xdr/cortex-xdr-data-sources/generic-on-premise-data-collectors/broker-vm-data-collector-applets/syslog-collector-applet/zscaler-private-access/ingest-logs-from-zscaler-private-access.md): Configure on-premises data collection for Cortex XDR. - [Activate Windows Event Collector](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/configure-cortex-xdr/cortex-xdr-data-sources/generic-on-premise-data-collectors/broker-vm-data-collector-applets/activate-windows-event-collector.md): Configure on-premises data collection for Cortex XDR. - [Activate Windows Event Collector on Windows Core](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/configure-cortex-xdr/cortex-xdr-data-sources/generic-on-premise-data-collectors/broker-vm-data-collector-applets/activate-windows-event-collector/activate-windows-event-collector-on-windows-core.md): Configure on-premises data collection for Cortex XDR. - [Renew WEC certificates](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/configure-cortex-xdr/cortex-xdr-data-sources/generic-on-premise-data-collectors/broker-vm-data-collector-applets/activate-windows-event-collector/renew-wec-certificates.md): Configure on-premises data collection for Cortex XDR. - [XDR Collectors](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/configure-cortex-xdr/cortex-xdr-data-sources/generic-on-premise-data-collectors/xdr-collectors.md): Configure on-premises data collection for Cortex XDR. - [XDR Collector audit logs](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/configure-cortex-xdr/cortex-xdr-data-sources/generic-on-premise-data-collectors/xdr-collectors/xdr-collector-audit-logs.md): Configure on-premises data collection for Cortex XDR. - [XDR Collector machine requirements and supported operating systems](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/configure-cortex-xdr/cortex-xdr-data-sources/generic-on-premise-data-collectors/xdr-collectors/xdr-collector-machine-requirements-and-supported-operating-systems.md): Configure on-premises data collection for Cortex XDR. - [Resources required to enable access to XDR collectors](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/configure-cortex-xdr/cortex-xdr-data-sources/generic-on-premise-data-collectors/xdr-collectors/resources-required-to-enable-access-to-xdr-collectors.md): Configure on-premises data collection for Cortex XDR. - [Manage XDR Collectors](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/configure-cortex-xdr/cortex-xdr-data-sources/generic-on-premise-data-collectors/xdr-collectors/manage-xdr-collectors.md): Configure on-premises data collection for Cortex XDR. - [XDR Collectors installation resource for Windows and Linux](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/configure-cortex-xdr/cortex-xdr-data-sources/generic-on-premise-data-collectors/xdr-collectors/manage-xdr-collectors/xdr-collectors-installation-resource-for-windows-and-linux.md): Configure on-premises data collection for Cortex XDR. - [Create an XDR Collector installation package](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/configure-cortex-xdr/cortex-xdr-data-sources/generic-on-premise-data-collectors/xdr-collectors/manage-xdr-collectors/create-an-xdr-collector-installation-package.md): Configure on-premises data collection for Cortex XDR. - [Install the XDR Collector installation package for Windows](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/configure-cortex-xdr/cortex-xdr-data-sources/generic-on-premise-data-collectors/xdr-collectors/manage-xdr-collectors/install-the-xdr-collector-installation-package-for-windows.md): Configure on-premises data collection for Cortex XDR. - [Install the XDR collector on Windows using the MSI](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/configure-cortex-xdr/cortex-xdr-data-sources/generic-on-premise-data-collectors/xdr-collectors/manage-xdr-collectors/install-the-xdr-collector-installation-package-for-windows/install-the-xdr-collector-on-windows-using-the-msi.md): Configure on-premises data collection for Cortex XDR. - [Install the XDR Collector on Windows using Msiexec](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/configure-cortex-xdr/cortex-xdr-data-sources/generic-on-premise-data-collectors/xdr-collectors/manage-xdr-collectors/install-the-xdr-collector-installation-package-for-windows/install-the-xdr-collector-on-windows-using-msiexec.md): Configure on-premises data collection for Cortex XDR. - [Install the XDR Collector installation package for Linux](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/configure-cortex-xdr/cortex-xdr-data-sources/generic-on-premise-data-collectors/xdr-collectors/manage-xdr-collectors/install-the-xdr-collector-installation-package-for-linux.md): Configure on-premises data collection for Cortex XDR. - [Configure XDR Collector upgrade scheduler](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/configure-cortex-xdr/cortex-xdr-data-sources/generic-on-premise-data-collectors/xdr-collectors/manage-xdr-collectors/configure-xdr-collector-upgrade-scheduler.md): Configure on-premises data collection for Cortex XDR. - [Set an application proxy for XDR Collectors](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/configure-cortex-xdr/cortex-xdr-data-sources/generic-on-premise-data-collectors/xdr-collectors/manage-xdr-collectors/set-an-application-proxy-for-xdr-collectors.md): Configure on-premises data collection for Cortex XDR. - [Set an alias for an XDR Collector machine](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/configure-cortex-xdr/cortex-xdr-data-sources/generic-on-premise-data-collectors/xdr-collectors/manage-xdr-collectors/set-an-alias-for-an-xdr-collector-machine.md): Configure on-premises data collection for Cortex XDR. - [Upgrade XDR Collectors](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/configure-cortex-xdr/cortex-xdr-data-sources/generic-on-premise-data-collectors/xdr-collectors/manage-xdr-collectors/upgrade-xdr-collectors.md): Configure on-premises data collection for Cortex XDR. - [Uninstall the XDR Collector](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/configure-cortex-xdr/cortex-xdr-data-sources/generic-on-premise-data-collectors/xdr-collectors/manage-xdr-collectors/uninstall-the-xdr-collector.md): Configure on-premises data collection for Cortex XDR. - [Define XDR Collector machine groups](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/configure-cortex-xdr/cortex-xdr-data-sources/generic-on-premise-data-collectors/xdr-collectors/manage-xdr-collectors/define-xdr-collector-machine-groups.md): Configure on-premises data collection for Cortex XDR. - [About Cortex XDR Collector content updates](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/configure-cortex-xdr/cortex-xdr-data-sources/generic-on-premise-data-collectors/xdr-collectors/manage-xdr-collectors/about-cortex-xdr-collector-content-updates.md): Configure on-premises data collection for Cortex XDR. - [XDR Collector profiles](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/configure-cortex-xdr/cortex-xdr-data-sources/generic-on-premise-data-collectors/xdr-collectors/xdr-collector-profiles.md): Configure on-premises data collection for Cortex XDR. - [Add an XDR Collector profile for Windows](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/configure-cortex-xdr/cortex-xdr-data-sources/generic-on-premise-data-collectors/xdr-collectors/xdr-collector-profiles/add-an-xdr-collector-profile-for-windows.md): Configure on-premises data collection for Cortex XDR. - [How to configure XDR Collector profiles](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/configure-cortex-xdr/cortex-xdr-data-sources/generic-on-premise-data-collectors/xdr-collectors/xdr-collector-profiles/add-an-xdr-collector-profile-for-windows/how-to-configure-xdr-collector-profiles.md): Configure on-premises data collection for Cortex XDR. - [Additional XDR Collector profile management options](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/configure-cortex-xdr/cortex-xdr-data-sources/generic-on-premise-data-collectors/xdr-collectors/xdr-collector-profiles/add-an-xdr-collector-profile-for-windows/additional-xdr-collector-profile-management-options.md): Configure on-premises data collection for Cortex XDR. - [Query Windows Event Log records](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/configure-cortex-xdr/cortex-xdr-data-sources/generic-on-premise-data-collectors/xdr-collectors/xdr-collector-profiles/add-an-xdr-collector-profile-for-windows/query-windows-event-log-records.md): Configure on-premises data collection for Cortex XDR. - [Ingest logs from Windows DHCP using Elasticsearch Filebeat](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/configure-cortex-xdr/cortex-xdr-data-sources/generic-on-premise-data-collectors/xdr-collectors/xdr-collector-profiles/ingest-logs-from-windows-dhcp-using-elasticsearch-filebeat.md): Configure on-premises data collection for Cortex XDR. - [Ingest Windows DNS debug logs using Elasticsearch Filebeat](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/configure-cortex-xdr/cortex-xdr-data-sources/generic-on-premise-data-collectors/xdr-collectors/xdr-collector-profiles/ingest-windows-dns-debug-logs-using-elasticsearch-filebeat.md): Configure on-premises data collection for Cortex XDR. - [Add an XDR Collector profile for Linux](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/configure-cortex-xdr/cortex-xdr-data-sources/generic-on-premise-data-collectors/xdr-collectors/xdr-collector-profiles/add-an-xdr-collector-profile-for-linux.md): Configure on-premises data collection for Cortex XDR. - [Apply profiles to collection machine policies](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/configure-cortex-xdr/cortex-xdr-data-sources/generic-on-premise-data-collectors/xdr-collectors/apply-profiles-to-collection-machine-policies.md): Configure on-premises data collection for Cortex XDR. - [XDR Collector datasets](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/configure-cortex-xdr/cortex-xdr-data-sources/generic-on-premise-data-collectors/xdr-collectors/xdr-collector-datasets.md): Configure on-premises data collection for Cortex XDR. - [Palo Alto Networks integrations](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/configure-cortex-xdr/cortex-xdr-data-sources/palo-alto-networks-integrations.md): Configure Palo Alto Networks data integration for Cortex XDR. - [Cloud Next-Generation Firewall](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/configure-cortex-xdr/cortex-xdr-data-sources/palo-alto-networks-integrations/cloud-next-generation-firewall.md): Configure Palo Alto Networks data integration for Cortex XDR. - [Ingest data from Cloud Next-Generation Firewall](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/configure-cortex-xdr/cortex-xdr-data-sources/palo-alto-networks-integrations/cloud-next-generation-firewall/ingest-data-from-cloud-next-generation-firewall.md): Configure Palo Alto Networks data integration for Cortex XDR. - [Next-Generation Firewall](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/configure-cortex-xdr/cortex-xdr-data-sources/palo-alto-networks-integrations/next-generation-firewall.md): Configure Palo Alto Networks data integration for Cortex XDR. - [Ingest data from Next-Generation Firewall](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/configure-cortex-xdr/cortex-xdr-data-sources/palo-alto-networks-integrations/next-generation-firewall/ingest-data-from-next-generation-firewall.md): Configure Palo Alto Networks data integration for Cortex XDR. - [Ingest Next-Generation Firewall logs using the Syslog collector](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/configure-cortex-xdr/cortex-xdr-data-sources/palo-alto-networks-integrations/next-generation-firewall/ingest-next-generation-firewall-logs-using-the-syslog-collector.md): Configure Palo Alto Networks data integration for Cortex XDR. - [Panorama](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/configure-cortex-xdr/cortex-xdr-data-sources/palo-alto-networks-integrations/next-generation-firewall/panorama.md): Configure Palo Alto Networks data integration for Cortex XDR. - [Prisma Access](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/configure-cortex-xdr/cortex-xdr-data-sources/palo-alto-networks-integrations/prisma-access.md): Configure Palo Alto Networks data integration for Cortex XDR. - [Ingest data from Prisma Access](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/configure-cortex-xdr/cortex-xdr-data-sources/palo-alto-networks-integrations/prisma-access/ingest-data-from-prisma-access.md): Configure Palo Alto Networks data integration for Cortex XDR. - [Palo Alto Networks Prisma](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/configure-cortex-xdr/cortex-xdr-data-sources/palo-alto-networks-integrations/prisma-access/palo-alto-networks-prisma.md): Configure Palo Alto Networks data integration for Cortex XDR. - [Prisma Access Browser](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/configure-cortex-xdr/cortex-xdr-data-sources/palo-alto-networks-integrations/prisma-access-browser.md): Configure Palo Alto Networks data integration for Cortex XDR. - [Ingest logs from Prisma Access Browser](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/configure-cortex-xdr/cortex-xdr-data-sources/palo-alto-networks-integrations/prisma-access-browser/ingest-logs-from-prisma-access-browser.md): Configure Palo Alto Networks data integration for Cortex XDR. - [Prisma Browser Integration](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/configure-cortex-xdr/cortex-xdr-data-sources/palo-alto-networks-integrations/prisma-browser-integration.md): Configure Palo Alto Networks data integration for Cortex XDR. - [Ingest detection data from Strata Logging Service](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/configure-cortex-xdr/cortex-xdr-data-sources/palo-alto-networks-integrations/ingest-detection-data-from-strata-logging-service.md): Configure Palo Alto Networks data integration for Cortex XDR. - [IoT Security](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/configure-cortex-xdr/cortex-xdr-data-sources/palo-alto-networks-integrations/iot-security.md): Configure Palo Alto Networks data integration for Cortex XDR. - [Ingest alerts and assets from IoT Security (Deprecated)](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/configure-cortex-xdr/cortex-xdr-data-sources/palo-alto-networks-integrations/iot-security/ingest-alerts-and-assets-from-iot-security.md): Configure Palo Alto Networks data integration for Cortex XDR. - [Ingest alerts and assets from Device Security](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/configure-cortex-xdr/cortex-xdr-data-sources/palo-alto-networks-integrations/iot-security/ingest-alerts-and-assets-from-device-security.md): Configure Palo Alto Networks data integration for Cortex XDR. - [Cortex Internals](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/configure-cortex-xdr/cortex-xdr-data-sources/palo-alto-networks-integrations/cortex-internals.md): Configure Palo Alto Networks data integration for Cortex XDR. - [Enterprise DLP](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/configure-cortex-xdr/cortex-xdr-data-sources/palo-alto-networks-integrations/enterprise-dlp.md): Configure Palo Alto Networks data integration for Cortex XDR. - [Palo Alto Networks Cortex](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/configure-cortex-xdr/cortex-xdr-data-sources/palo-alto-networks-integrations/palo-alto-networks-cortex.md): Configure Palo Alto Networks data integration for Cortex XDR. - [SaaS Security (Aperture)](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/configure-cortex-xdr/cortex-xdr-data-sources/palo-alto-networks-integrations/saas-security-aperture.md): Configure Palo Alto Networks data integration for Cortex XDR. - [WildFire Cloud](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/configure-cortex-xdr/cortex-xdr-data-sources/palo-alto-networks-integrations/wildfire-cloud.md): Configure Palo Alto Networks data integration for Cortex XDR. - [Log type filtering](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/configure-cortex-xdr/cortex-xdr-data-sources/palo-alto-networks-integrations/log-type-filtering.md): Configure Palo Alto Networks data integration for Cortex XDR. - [Collecting URL and File log types](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/configure-cortex-xdr/cortex-xdr-data-sources/palo-alto-networks-integrations/collecting-url-and-file-log-types.md): Configure Palo Alto Networks data integration for Cortex XDR. - [Detectors connected to URL and File log types](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/configure-cortex-xdr/cortex-xdr-data-sources/palo-alto-networks-integrations/collecting-url-and-file-log-types/detectors-connected-to-url-and-file-log-types.md): Configure Palo Alto Networks data integration for Cortex XDR. - [Administration and troubleshooting](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/configure-cortex-xdr/cortex-xdr-data-sources/administration-and-troubleshooting.md): Learn more about the administration and troubleshooting of the different data collector integrations in Cortex XDR. - [Manage instances](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/configure-cortex-xdr/cortex-xdr-data-sources/administration-and-troubleshooting/manage-instances.md): Manage and troubleshoot Cortex XDR data integrations. - [Add a new data source or instance](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/configure-cortex-xdr/cortex-xdr-data-sources/administration-and-troubleshooting/manage-instances/add-a-new-data-source-or-instance.md): Manage and troubleshoot Cortex XDR data integrations. - [How to configure the scanning settings for supported services](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/configure-cortex-xdr/cortex-xdr-data-sources/administration-and-troubleshooting/manage-instances/how-to-configure-the-scanning-settings-for-supported-services.md): Manage and troubleshoot Cortex XDR data integrations. - [Manage cloud instances](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/configure-cortex-xdr/cortex-xdr-data-sources/administration-and-troubleshooting/manage-instances/manage-cloud-instances.md): Manage and troubleshoot Cortex XDR data integrations. - [Update cloud permissions after Cortex XDR release updates](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/configure-cortex-xdr/cortex-xdr-data-sources/administration-and-troubleshooting/manage-instances/update-cloud-permissions-after-cortex-release-updates.md): Manage and troubleshoot Cortex XDR data integrations. - [Pending cloud instances](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/configure-cortex-xdr/cortex-xdr-data-sources/administration-and-troubleshooting/manage-instances/pending-cloud-instances.md): Manage and troubleshoot Cortex XDR data integrations. - [Troubleshoot errors on cloud instances](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/configure-cortex-xdr/cortex-xdr-data-sources/administration-and-troubleshooting/manage-instances/troubleshoot-errors-on-cloud-instances.md): Manage and troubleshoot Cortex XDR data integrations. - [Manage Kubernetes Connector instances](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/configure-cortex-xdr/cortex-xdr-data-sources/administration-and-troubleshooting/manage-instances/manage-kubernetes-connector-instances.md): Manage and troubleshoot Cortex XDR data integrations. - [Integrations](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/configure-cortex-xdr/cortex-xdr-data-sources/administration-and-troubleshooting/integrations.md): Manage and troubleshoot Cortex XDR data integrations. - [Integrations in Cortex XDR](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/configure-cortex-xdr/cortex-xdr-data-sources/administration-and-troubleshooting/integrations/integrations-in-cortex-xdr.md): Manage and troubleshoot Cortex XDR data integrations. - [Add an integration instance](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/configure-cortex-xdr/cortex-xdr-data-sources/administration-and-troubleshooting/integrations/add-an-integration-instance.md): Manage and troubleshoot Cortex XDR data integrations. - [Use integration commands in the CLI](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/configure-cortex-xdr/cortex-xdr-data-sources/administration-and-troubleshooting/integrations/use-integration-commands-in-the-cli.md): Manage and troubleshoot Cortex XDR data integrations. - [Configure integration permissions](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/configure-cortex-xdr/cortex-xdr-data-sources/administration-and-troubleshooting/integrations/configure-integration-permissions.md): Manage and troubleshoot Cortex XDR data integrations. - [Troubleshoot Integrations](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/configure-cortex-xdr/cortex-xdr-data-sources/administration-and-troubleshooting/integrations/troubleshoot-integrations.md): Manage and troubleshoot Cortex XDR data integrations. - [Manage credentials](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/configure-cortex-xdr/cortex-xdr-data-sources/administration-and-troubleshooting/integrations/manage-credentials.md): Manage and troubleshoot Cortex XDR data integrations. - [Verify collector connectivity](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/configure-cortex-xdr/cortex-xdr-data-sources/administration-and-troubleshooting/verify-collector-connectivity.md): Manage and troubleshoot Cortex XDR data integrations. - [Overview of data ingestion metrics](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/configure-cortex-xdr/cortex-xdr-data-sources/administration-and-troubleshooting/overview-of-data-ingestion-metrics.md): Manage and troubleshoot Cortex XDR data integrations. - [Creating correlation rules to monitor data ingestion health](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/configure-cortex-xdr/cortex-xdr-data-sources/administration-and-troubleshooting/overview-of-data-ingestion-metrics/creating-correlation-rules-to-monitor-data-ingestion-health.md): Manage and troubleshoot Cortex XDR data integrations. - [Measuring data freshness](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/configure-cortex-xdr/cortex-xdr-data-sources/administration-and-troubleshooting/overview-of-data-ingestion-metrics/measuring-data-freshness.md): Manage and troubleshoot Cortex XDR data integrations. - [About health issues](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/configure-cortex-xdr/cortex-xdr-data-sources/administration-and-troubleshooting/about-health-issues.md): Manage and troubleshoot Cortex XDR data integrations. - [Investigate and resolve health issues](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/configure-cortex-xdr/cortex-xdr-data-sources/administration-and-troubleshooting/about-health-issues/investigate-and-resolve-health-issues.md): Manage and troubleshoot Cortex XDR data integrations. - [Monitor data ingestion health (BETA)](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/configure-cortex-xdr/cortex-xdr-data-sources/administration-and-troubleshooting/about-health-issues/monitor-data-ingestion-health.md): Manage and troubleshoot Cortex XDR data integrations. - [Monitor Correlation rules](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/configure-cortex-xdr/cortex-xdr-data-sources/administration-and-troubleshooting/about-health-issues/monitor-correlation-rules.md): Manage and troubleshoot Cortex XDR data integrations. - [Marketplace](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/configure-cortex-xdr/marketplace.md): Use the Marketplace, a centralized content portal, to manage content packs in Cortex XDR. - [Cortex Marketplace](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/configure-cortex-xdr/marketplace/cortex-marketplace.md): Search the Cortex Marketplace and find content. Search by use cases, integrations, and categories. - [Content Pack Support Types](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/configure-cortex-xdr/marketplace/content-pack-support-types.md): Types of content packs support - Cortex supported, Partner-Supported, Developer-Supported, Community-Supported. - [Cortex XDR content](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/configure-cortex-xdr/marketplace/cortex-xdr-content.md): The type of content in Cortex XDR - [Manage content packs](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/configure-cortex-xdr/marketplace/manage-content-packs.md): Install, delete, update, and revert content packs. - [Marketplace FAQs](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/configure-cortex-xdr/marketplace/marketplace-faqs.md): Frequently Asked Questions about Cortex XDR Marketplace Content - [Content changes when upgrading Cortex XDR versions](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/configure-cortex-xdr/marketplace/content-changes-when-upgrading-cortex-xdr-versions.md): Content updates when upgrading Cortex XDR versions. - [Manage API keys](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/configure-cortex-xdr/manage-api-keys.md): Create and manage API keys for Cortex XDR integrations. - [XQL query management](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/configure-cortex-xdr/xql-query-management.md): Administrators can set controls on running XQL queries. - [Customize cases and issues](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/configure-cortex-xdr/customize-cases-and-issues.md): Customize case and issue behavior for your workflows. - [External integrations](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/configure-cortex-xdr/customize-cases-and-issues/external-integrations.md): Integrate external threat intelligence and case management services with Cortex XDR. - [Set up case scoring](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/configure-cortex-xdr/customize-cases-and-issues/set-up-case-scoring.md): Enable SmartScore and configure scoring rules for cases and issues. - [Create a starring configuration](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/configure-cortex-xdr/customize-cases-and-issues/create-a-starring-configuration.md): Create rules that automatically star matching issues and their linked cases. - [Create SLAs for case and issue resolution](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/configure-cortex-xdr/customize-cases-and-issues/create-slas-for-issue-resolution.md): Create SLA rules to set and track issue-resolution timers and time goals. - [Create additional case timers and SLAs](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/configure-cortex-xdr/customize-cases-and-issues/create-slas-for-issue-resolution/create-case-timers-and-slas.md): Create case timers and service level agreements. - [Update case timer and SLA fields](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/configure-cortex-xdr/customize-cases-and-issues/create-slas-for-issue-resolution/create-case-timers-and-slas/update-case-timer-and-sla-fields.md): Update case timer and SLA fields. - [Create issue exceptions](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/configure-cortex-xdr/customize-cases-and-issues/create-issue-exceptions.md): Create time-bound exceptions that pause issue SLA timers during approved remediation delays. - [Configure the issue exception approval workflow](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/configure-cortex-xdr/customize-cases-and-issues/create-issue-exceptions/configure-the-issue-exception-approval-workflow.md): Manage approvers and approval requirements for issue exception rules. - [Create issue exception rules](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/configure-cortex-xdr/customize-cases-and-issues/create-issue-exceptions/create-issue-exception-rules.md): Create approval-based rules that temporarily pause SLA timers for selected issues. - [Create an exception rule from an issue](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/configure-cortex-xdr/customize-cases-and-issues/create-issue-exceptions/create-an-exception-rule-from-an-issue.md): Create an issue exception rule from an issue. - [View issue exception rules](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/configure-cortex-xdr/customize-cases-and-issues/create-issue-exceptions/view-issue-exception-rules.md): View configured issue exception rules. - [Disable issue exception rules](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/configure-cortex-xdr/customize-cases-and-issues/create-issue-exceptions/disable-issue-exception-rules.md): Disable issue exception rules that no longer apply. - [View excepted issues](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/configure-cortex-xdr/customize-cases-and-issues/create-issue-exceptions/view-excepted-issues.md): View issues excluded by exception rules. - [Optimize case grouping in correlations](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/configure-cortex-xdr/customize-cases-and-issues/optimize-case-grouping-in-correlations.md): Optimize case grouping for correlation alerts. - [Managed Services configuration](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/configure-cortex-xdr/managed-services-configuration.md): Configure Cortex XDR for managed security services. - [Configure report forwarding](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/configure-cortex-xdr/managed-services-configuration/configure-report-forwarding.md): Configure managed security services in Cortex XDR. - [Configure actions permissions](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/configure-cortex-xdr/managed-services-configuration/configure-actions-permissions.md): Configure managed security services in Cortex XDR. - [Manage escalation contacts](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/configure-cortex-xdr/managed-services-configuration/manage-escalation-contacts.md): Configure managed security services in Cortex XDR. - [Endpoint protection](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/protect-your-endpoints/endpoint-protection.md): Learn how Cortex XDR protects endpoints from malware, exploits, and unknown threats. - [Malware protection](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/protect-your-endpoints/endpoint-protection/malware-protection.md): Learn how Cortex XDR detects and prevents malware on endpoints. - [Exploit protection](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/protect-your-endpoints/endpoint-protection/exploit-protection.md): Learn how Cortex XDR protects endpoints from exploits and malicious techniques. - [File analysis and protection flow](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/protect-your-endpoints/endpoint-protection/file-analysis-and-protection-flow.md): Understand how Cortex XDR analyzes files and applies protection verdicts. - [Endpoint protection capabilities](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/protect-your-endpoints/endpoint-protection/endpoint-protection-capabilities.md): Review endpoint protection capabilities and security modules supported by each operating system. - [Processes protected by exploit security policy](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/protect-your-endpoints/endpoint-protection/processes-protected-by-exploit-security-policy.md): Review processes protected by the exploit security policy. - [File Integrity Monitoring (FIM)](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/protect-your-endpoints/endpoint-protection/file-integrity-monitoring-fim.md): Monitor critical files and directories for unauthorized changes on protected endpoints. - [CaaS Workloads](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/protect-your-endpoints/endpoint-protection/caas-workloads.md): Protect container-as-a-service workloads with Cortex XDR endpoint security. - [WildFire analysis concepts](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/protect-your-endpoints/endpoint-protection/wildfire-analysis-concepts.md): Learn how WildFire analyzes files and returns verdicts to Cortex XDR. - [Guidelines for keeping Cortex XDR agents and content updated](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/protect-your-endpoints/endpoint-protection/guidelines-for-keeping-cortex-xdr-agents-and-content-updated.md): Keep Cortex XDR agents and security content current and supported. - [About content updates](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/protect-your-endpoints/endpoint-protection/about-content-updates.md): Understand Cortex XDR security content updates and their endpoint protection coverage. - [Endpoint data collection](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/protect-your-endpoints/endpoint-protection/endpoint-data-collection.md): Configure endpoint data collection for Cortex XDR visibility and threat detection. - [Endpoint data collection](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/protect-your-endpoints/endpoint-protection/endpoint-data-collection/endpoint-data-collection-1.md): Understand the endpoint data collected by Cortex XDR agents. - [Install and manage endpoints](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/protect-your-endpoints/install-and-manage-endpoints.md): Learn how to set up profiles, policies and other settings for endpoint protection, how to install Cortex XDR agent on endpoints, and how to manage them after installation. - [Set up endpoint protection](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/protect-your-endpoints/install-and-manage-endpoints/set-up-endpoint-protection.md): Configure profiles, policies, and settings to protect your endpoints. - [Set up endpoint profiles and exception rules](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/protect-your-endpoints/install-and-manage-endpoints/set-up-endpoint-protection/set-up-endpoint-profiles-and-exception-rules.md): Configure endpoint security profiles and exception rules for your environment. - [Set up malware prevention profiles](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/protect-your-endpoints/install-and-manage-endpoints/set-up-endpoint-protection/set-up-endpoint-profiles-and-exception-rules/set-up-malware-prevention-profiles.md): Configure malware prevention profiles for supported endpoint platforms. - [Set up exploit prevention profiles](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/protect-your-endpoints/install-and-manage-endpoints/set-up-endpoint-protection/set-up-endpoint-profiles-and-exception-rules/set-up-exploit-prevention-profiles.md): Configure exploit prevention profiles to block exploit techniques on endpoints. - [Set up agent settings profiles](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/protect-your-endpoints/install-and-manage-endpoints/set-up-endpoint-protection/set-up-endpoint-profiles-and-exception-rules/set-up-agent-settings-profiles.md): Configure agent settings profiles for Cortex XDR endpoints. - [Set up restrictions prevention profiles](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/protect-your-endpoints/install-and-manage-endpoints/set-up-endpoint-protection/set-up-endpoint-profiles-and-exception-rules/set-up-restrictions-prevention-profiles.md): Configure restrictions profiles to limit risky endpoint activity. - [Set up exception profiles and rules](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/protect-your-endpoints/install-and-manage-endpoints/set-up-endpoint-protection/set-up-endpoint-profiles-and-exception-rules/set-up-exception-profiles-and-rules.md): Configure exception profiles and rules for trusted endpoint activity. - [Exception configuration](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/protect-your-endpoints/install-and-manage-endpoints/set-up-endpoint-protection/set-up-endpoint-profiles-and-exception-rules/set-up-exception-profiles-and-rules/exception-configuration.md): Configure global and profile-based exceptions for endpoint protection. - [Issue exclusions](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/protect-your-endpoints/install-and-manage-endpoints/set-up-endpoint-protection/set-up-endpoint-profiles-and-exception-rules/set-up-exception-profiles-and-rules/issue-exclusions.md): Exclude matching endpoint issues from investigation and case creation. - [Add an issue exclusion rule](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/protect-your-endpoints/install-and-manage-endpoints/set-up-endpoint-protection/set-up-endpoint-profiles-and-exception-rules/set-up-exception-profiles-and-rules/issue-exclusions/add-an-issue-exclusion-rule.md): Create a rule that excludes matching endpoint issues. - [Add an IOC or BIOC rule exception](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/protect-your-endpoints/install-and-manage-endpoints/set-up-endpoint-protection/set-up-endpoint-profiles-and-exception-rules/set-up-exception-profiles-and-rules/add-an-ioc-or-bioc-rule-exception.md): Create exceptions for IOC and BIOC rules on selected endpoints. - [Add a disable prevention rule for endpoints](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/protect-your-endpoints/install-and-manage-endpoints/set-up-endpoint-protection/set-up-endpoint-profiles-and-exception-rules/set-up-exception-profiles-and-rules/add-a-disable-prevention-rule-for-endpoints.md): Create an exception that disables prevention for selected endpoints. - [Add a disable injection and prevention rule](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/protect-your-endpoints/install-and-manage-endpoints/set-up-endpoint-protection/set-up-endpoint-profiles-and-exception-rules/set-up-exception-profiles-and-rules/add-a-disable-injection-and-prevention-rule.md): Create an exception that disables injection and prevention for selected endpoints. - [Add a support exception rule for endpoints](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/protect-your-endpoints/install-and-manage-endpoints/set-up-endpoint-protection/set-up-endpoint-profiles-and-exception-rules/set-up-exception-profiles-and-rules/add-a-support-exception-rule-for-endpoints.md): Create a support exception rule for troubleshooting selected endpoints. - [Add a legacy exception rule for endpoints](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/protect-your-endpoints/install-and-manage-endpoints/set-up-endpoint-protection/set-up-endpoint-profiles-and-exception-rules/set-up-exception-profiles-and-rules/add-a-legacy-exception-rule-for-endpoints.md): Create legacy exception rules for endpoint protection policies. - [Add a new exceptions security profile](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/protect-your-endpoints/install-and-manage-endpoints/set-up-endpoint-protection/set-up-endpoint-profiles-and-exception-rules/set-up-exception-profiles-and-rules/add-a-legacy-exception-rule-for-endpoints/add-a-new-exceptions-security-profile.md): Create an exceptions security profile for endpoint policies. - [Add a global endpoint policy exception](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/protect-your-endpoints/install-and-manage-endpoints/set-up-endpoint-protection/set-up-endpoint-profiles-and-exception-rules/set-up-exception-profiles-and-rules/add-a-legacy-exception-rule-for-endpoints/add-a-global-endpoint-policy-exception.md): Create a global exception for endpoint protection policies. - [Set up Identity profiles](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/protect-your-endpoints/install-and-manage-endpoints/set-up-endpoint-protection/set-up-endpoint-profiles-and-exception-rules/set-up-identity-profiles.md): Configure the Identity Profile to unify AD-SPM, Conditional Access, and LDAP Protection controls in one centralized hub. - [Define endpoint groups](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/protect-your-endpoints/install-and-manage-endpoints/set-up-endpoint-protection/define-endpoint-groups.md): Create and manage endpoint groups for targeted policy assignment. - [Configure global agent settings](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/protect-your-endpoints/install-and-manage-endpoints/set-up-endpoint-protection/configure-global-agent-settings.md): Configure global Cortex XDR agent settings for your endpoints. - [Apply profiles to endpoints](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/protect-your-endpoints/install-and-manage-endpoints/set-up-endpoint-protection/apply-profiles-to-endpoints.md): Assign endpoint security profiles and policies to endpoint groups. - [Create an agent installation package](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/protect-your-endpoints/install-and-manage-endpoints/set-up-endpoint-protection/create-an-agent-installation-package.md): Create a Cortex XDR agent installation package for endpoint deployment. - [Manage an agent installation package](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/protect-your-endpoints/install-and-manage-endpoints/set-up-endpoint-protection/manage-an-agent-installation-package.md): View and manage Cortex XDR agent installation packages. - [Harden endpoint security](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/protect-your-endpoints/install-and-manage-endpoints/harden-endpoint-security.md): Configure endpoint security features that harden devices against threats. - [Device control](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/protect-your-endpoints/install-and-manage-endpoints/harden-endpoint-security/device-control.md): Control removable devices and peripheral access on managed endpoints. - [Host firewall](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/protect-your-endpoints/install-and-manage-endpoints/harden-endpoint-security/host-firewall.md): Configure host firewall policies to control endpoint network traffic. - [Host firewall for Windows](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/protect-your-endpoints/install-and-manage-endpoints/harden-endpoint-security/host-firewall/host-firewall-for-windows.md): Configure Windows host firewall rules and settings for managed endpoints. - [Host firewall for macos](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/protect-your-endpoints/install-and-manage-endpoints/harden-endpoint-security/host-firewall/host-firewall-for-macos.md): Configure macOS host firewall rules and settings for managed endpoints. - [Disk encryption](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/protect-your-endpoints/install-and-manage-endpoints/harden-endpoint-security/disk-encryption.md): Manage disk encryption settings for supported endpoints. - [Host Inventory](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/protect-your-endpoints/install-and-manage-endpoints/harden-endpoint-security/host-inventory.md): View hardware, software, and system details for managed endpoints. - [Vulnerability Assessment](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/protect-your-endpoints/install-and-manage-endpoints/harden-endpoint-security/vulnerability-assessment.md): Assess endpoint vulnerabilities and prioritize remediation across your environment. - [Set a Cortex XDR agent Critical Environment version](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/protect-your-endpoints/install-and-manage-endpoints/harden-endpoint-security/set-a-cortex-dr-agent-critical-environment-version.md): Set a critical environment agent version for sensitive endpoint deployments. - [Manage endpoint protection](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/protect-your-endpoints/install-and-manage-endpoints/manage-endpoint-protection.md) - [Move agents between managing servers](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/protect-your-endpoints/install-and-manage-endpoints/manage-endpoint-protection/move-agents-between-managing-servers.md) - [Manage endpoint tags](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/protect-your-endpoints/install-and-manage-endpoints/manage-endpoint-protection/manage-endpoint-tags.md) - [Create an endpoint tag](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/protect-your-endpoints/install-and-manage-endpoints/manage-endpoint-protection/manage-endpoint-tags/create-an-endpoint-tag.md) - [Remove an endpoint tag](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/protect-your-endpoints/install-and-manage-endpoints/manage-endpoint-protection/manage-endpoint-tags/remove-an-endpoint-tag.md) - [Track your endpoint tags](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/protect-your-endpoints/install-and-manage-endpoints/manage-endpoint-protection/manage-endpoint-tags/track-your-endpoint-tags.md) - [Permanently remove Endpoint tags from the system](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/protect-your-endpoints/install-and-manage-endpoints/manage-endpoint-protection/manage-endpoint-tags/permanently-remove-endpoint-tags-from-the-system.md) - [Set an alias for an endpoint](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/protect-your-endpoints/install-and-manage-endpoints/manage-endpoint-protection/manage-endpoint-tags/set-an-alias-for-an-endpoint.md) - [Manage endpoint prevention profiles](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/protect-your-endpoints/install-and-manage-endpoints/manage-endpoint-protection/manage-endpoint-prevention-profiles.md) - [Create a new prevention policy rule for serverless function](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/protect-your-endpoints/install-and-manage-endpoints/manage-endpoint-protection/create-a-new-prevention-policy-rule-for-serverless-function.md) - [View information about your endpoint prevention profiles](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/protect-your-endpoints/install-and-manage-endpoints/manage-endpoint-protection/view-information-about-your-endpoint-prevention-profiles.md) - [Upgrade Cortex XDR agents](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/protect-your-endpoints/install-and-manage-endpoints/manage-endpoint-protection/upgrade-cortex-xdr-agents.md) - [Restart agent](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/protect-your-endpoints/install-and-manage-endpoints/manage-endpoint-protection/restart-agent.md) - [Uninstall the Cortex XDR agent](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/protect-your-endpoints/install-and-manage-endpoints/manage-endpoint-protection/uninstall-the-cortex-xdr-agent.md) - [Clear agent database](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/protect-your-endpoints/install-and-manage-endpoints/manage-endpoint-protection/clear-agent-database.md) - [Delete Cortex XDR agents](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/protect-your-endpoints/install-and-manage-endpoints/manage-endpoint-protection/delete-cortex-xdr-agents.md) - [Manage agent tokens](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/protect-your-endpoints/install-and-manage-endpoints/manage-endpoint-protection/manage-agent-tokens.md) - [Retrieve support file password](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/protect-your-endpoints/install-and-manage-endpoints/manage-endpoint-protection/retrieve-support-file-password.md): Learn how to retrieve the password to access files from the Tech Support File (TSF), which is generated in a zip format protected by an encrypted password. - [Send push notifications to iOS](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/protect-your-endpoints/install-and-manage-endpoints/manage-endpoint-protection/send-push-notifications-to-ios.md) - [Monitor agent operational status](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/protect-your-endpoints/install-and-manage-endpoints/manage-endpoint-protection/monitor-agent-operational-status.md) - [Monitor agent activity](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/protect-your-endpoints/install-and-manage-endpoints/manage-endpoint-protection/monitor-agent-activity.md) - [Monitor agent upgrade status](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/protect-your-endpoints/install-and-manage-endpoints/manage-endpoint-protection/monitor-agent-upgrade-status.md) - [Web and API Security (WAAS)](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/protect-your-endpoints/web-and-api-security-waas.md): Discover, assess, monitor, and protect APIs and web workloads with Cortex XDR WAAS. - [Overview](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/protect-your-endpoints/web-and-api-security-waas/overview.md): Explore Cortex XDR Web and API Security capabilities for APIs and Linux workloads. - [Personas workflow](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/protect-your-endpoints/web-and-api-security-waas/personas-workflow.md): Cortex API security distributes responsibilities across SOC analysts, security practitioners, and workload owners. - [Secure your API landscape](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/protect-your-endpoints/web-and-api-security-waas/secure-your-api-landscape.md): Discover, assess, monitor, and protect API traffic, endpoints, and specifications in Cortex XDR. - [Endpoint DLP](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/protect-your-endpoints/endpoint-dlp.md): Protect sensitive endpoint data and prevent exfiltration with Cortex XDR Endpoint DLP. - [Cortex Data Loss Prevention (DLP) module overview](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/protect-your-endpoints/endpoint-dlp/cortex-data-loss-prevention-dlp-module-overview.md): Learn about Cortex Data Loss Prevention (DLP) module, which provides a solution to prevent sensitive data exfiltration. - [Archive file classification](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/protect-your-endpoints/endpoint-dlp/cortex-data-loss-prevention-dlp-module-overview/archive-file-classification.md): Learn how Cortex XDR classifies archive files for Endpoint DLP. - [True-file type detection](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/protect-your-endpoints/endpoint-dlp/cortex-data-loss-prevention-dlp-module-overview/true-file-type-detection.md): Learn how Endpoint DLP detects true file types in Cortex XDR. - [Personas workflow for DLP](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/protect-your-endpoints/endpoint-dlp/personas-workflow-for-dlp.md): The data security administrator and data security viewer are responsible for identifying DLP requirements for creating data-in-motion rules and investigating issues and cases. - [Best Practices](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/protect-your-endpoints/endpoint-dlp/best-practices.md): Apply Endpoint DLP best practices to design effective data-in-motion rules. - [Configure DLP end-to-end](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/protect-your-endpoints/endpoint-dlp/configure-dlp-end-to-end.md): Configure Cortex XDR Endpoint DLP from setup through policy enforcement. - [DLP status in all endpoints](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/protect-your-endpoints/endpoint-dlp/dlp-status-in-all-endpoints.md): View DLP and browser extension status for managed Cortex XDR endpoints. - [Cortex DLP threat detection and issues](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/protect-your-endpoints/endpoint-dlp/cortex-dlp-threat-detection-and-issues.md): Learn how Cortex XDR detects and investigates Endpoint DLP policy violations. - [Monitor dashboards and reports](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/detect-investigate-and-respond-to-threats/monitor-dashboards-and-reports.md): Monitor security data with Cortex XDR dashboards and reports. - [Overview of dashboards and reports](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/detect-investigate-and-respond-to-threats/monitor-dashboards-and-reports/overview-of-dashboards-and-reports.md): Learn about Cortex XDR dashboards, reports, widgets, and their workflows. - [Dashboard interface basics](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/detect-investigate-and-respond-to-threats/monitor-dashboards-and-reports/overview-of-dashboards-and-reports/dashboard-interface-basics.md): Explore the controls and layout of the Cortex XDR dashboard interface. - [Dashboard types](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/detect-investigate-and-respond-to-threats/monitor-dashboards-and-reports/overview-of-dashboards-and-reports/dashboard-types.md): Compare available dashboard types and their intended uses. - [Report basics](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/detect-investigate-and-respond-to-threats/monitor-dashboards-and-reports/overview-of-dashboards-and-reports/report-basics.md): Learn how reports organize and deliver dashboard data. - [Widget Library](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/detect-investigate-and-respond-to-threats/monitor-dashboards-and-reports/overview-of-dashboards-and-reports/widget-library.md): Browse available widgets for dashboards and reports. - [Access and visibility for dashboards and reports](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/detect-investigate-and-respond-to-threats/monitor-dashboards-and-reports/access-and-visibility-for-dashboards-and-reports.md): Control access, visibility, and sharing for dashboards and reports. - [Visibility settings](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/detect-investigate-and-respond-to-threats/monitor-dashboards-and-reports/access-and-visibility-for-dashboards-and-reports/visibility-settings.md): Configure who can view dashboards and reports. - [Access to widgets](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/detect-investigate-and-respond-to-threats/monitor-dashboards-and-reports/access-and-visibility-for-dashboards-and-reports/access-to-widgets.md): Manage user access to dashboard widgets. - [Sharing icons](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/detect-investigate-and-respond-to-threats/monitor-dashboards-and-reports/access-and-visibility-for-dashboards-and-reports/sharing-icons.md): Understand dashboard and report sharing status icons. - [Access and sharing cheat sheet](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/detect-investigate-and-respond-to-threats/monitor-dashboards-and-reports/access-and-visibility-for-dashboards-and-reports/access-and-sharing-cheat-sheet.md): Reference dashboard and report access and sharing permissions. - [Manage dashboards and reports](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/detect-investigate-and-respond-to-threats/monitor-dashboards-and-reports/manage-dashboards-and-reports.md): Manage dashboard and report ownership, sharing, imports, and deleted content. - [Dashboard Manager](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/detect-investigate-and-respond-to-threats/monitor-dashboards-and-reports/manage-dashboards-and-reports/dashboard-manager.md): Use Dashboard Manager to organize and maintain dashboards. - [Reports](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/detect-investigate-and-respond-to-threats/monitor-dashboards-and-reports/manage-dashboards-and-reports/reports.md): Manage and generate reports from Cortex XDR data. - [Duplicate dashboards and reports](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/detect-investigate-and-respond-to-threats/monitor-dashboards-and-reports/manage-dashboards-and-reports/duplicate-dashboards-and-reports.md): Create copies of existing dashboards and report templates. - [Share custom dashboards and report templates](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/detect-investigate-and-respond-to-threats/monitor-dashboards-and-reports/manage-dashboards-and-reports/share-custom-dashboards-and-report-templates.md): Share custom dashboards and report templates with other users. - [Change ownership to dashboards and report templates](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/detect-investigate-and-respond-to-threats/monitor-dashboards-and-reports/manage-dashboards-and-reports/change-ownership-to-dashboards-and-report-templates.md): Transfer ownership of dashboards and report templates. - [Import and export dashboards and report templates](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/detect-investigate-and-respond-to-threats/monitor-dashboards-and-reports/manage-dashboards-and-reports/import-and-export-dashboards-and-report-templates.md): Import and export dashboards and report templates. - [Configure the notification rule for a failed report](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/detect-investigate-and-respond-to-threats/monitor-dashboards-and-reports/manage-dashboards-and-reports/configure-the-notification-rule-for-a-failed-report.md): Get notified when a scheduled report fails. - [Deleted content](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/detect-investigate-and-respond-to-threats/monitor-dashboards-and-reports/manage-dashboards-and-reports/deleted-content.md): Restore or permanently remove deleted dashboards and reports. - [Create dashboards](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/detect-investigate-and-respond-to-threats/monitor-dashboards-and-reports/create-dashboards.md): Create dashboards that monitor the data most important to your team. - [Create a dashboard](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/detect-investigate-and-respond-to-threats/monitor-dashboards-and-reports/create-dashboards/create-a-dashboard.md): Build a dashboard with the widgets and filters you need. - [Create reports](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/detect-investigate-and-respond-to-threats/monitor-dashboards-and-reports/create-reports.md): Create reports that summarize Cortex XDR data. - [Create a report template from scratch](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/detect-investigate-and-respond-to-threats/monitor-dashboards-and-reports/create-reports/create-a-report-template-from-scratch.md): Build a report template from an empty layout. - [Advanced configuration](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/detect-investigate-and-respond-to-threats/monitor-dashboards-and-reports/advanced-configuration.md): Configure custom widgets, global filters, and drilldowns. - [Create custom widgets](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/detect-investigate-and-respond-to-threats/monitor-dashboards-and-reports/advanced-configuration/create-custom-widgets.md): Create custom widgets for dashboards and reports. - [Create widgets using AI](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/detect-investigate-and-respond-to-threats/monitor-dashboards-and-reports/advanced-configuration/create-custom-widgets/create-widgets-using-ai.md): Use AI to create custom dashboard widgets. - [Create XQL widgets](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/detect-investigate-and-respond-to-threats/monitor-dashboards-and-reports/advanced-configuration/create-custom-widgets/create-xql-widgets.md): Build custom widgets with XQL queries. - [Add parameters to a custom XQL widget](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/detect-investigate-and-respond-to-threats/monitor-dashboards-and-reports/advanced-configuration/create-custom-widgets/add-parameters-to-a-custom-xql-widget.md): Add reusable parameters to custom XQL widgets. - [Create script-based widgets](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/detect-investigate-and-respond-to-threats/monitor-dashboards-and-reports/advanced-configuration/create-custom-widgets/create-script-based-widgets.md): Create dashboard widgets that run scripts. - [Configure global filters](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/detect-investigate-and-respond-to-threats/monitor-dashboards-and-reports/advanced-configuration/configure-global-filters.md): Apply filters across dashboard widgets and reports. - [Configure drilldowns](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/detect-investigate-and-respond-to-threats/monitor-dashboards-and-reports/advanced-configuration/configure-drilldowns.md): Configure drilldowns from dashboard widgets to detailed data. - [Dashboard reference](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/detect-investigate-and-respond-to-threats/monitor-dashboards-and-reports/dashboard-reference.md): Reference system dashboards and Command Center dashboards. - [Command Center reference](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/detect-investigate-and-respond-to-threats/monitor-dashboards-and-reports/dashboard-reference/command-center-reference.md): Reference dashboards available in Command Center. - [Cloud Detection and Response (CDR) Command Center](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/detect-investigate-and-respond-to-threats/monitor-dashboards-and-reports/dashboard-reference/command-center-reference/cloud-detection-and-response-cdr-command-center.md): Explore the Cloud Detection and Response Command Center dashboard. - [Cortex Cloud Command Center](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/detect-investigate-and-respond-to-threats/monitor-dashboards-and-reports/dashboard-reference/command-center-reference/cortex-cloud-command-center.md): Explore the Cortex Cloud Command Center dashboard. - [System dashboards](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/detect-investigate-and-respond-to-threats/monitor-dashboards-and-reports/dashboard-reference/system-dashboards.md): Reference dashboards provided with Cortex XDR. - [Cloud Security Operations](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/detect-investigate-and-respond-to-threats/monitor-dashboards-and-reports/dashboard-reference/system-dashboards/cloud-security-operations.md): Monitor cloud security operations with system dashboards. - [Data Ingestion](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/detect-investigate-and-respond-to-threats/monitor-dashboards-and-reports/dashboard-reference/system-dashboards/data-ingestion.md): Use Cortex XDR Data Ingestion to monitor data collection health, volume, and coverage. - [Asset management](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/detect-investigate-and-respond-to-threats/asset-management.md): Discover, organize, and manage assets across your Cortex XDR environment. - [Asset inventory overview](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/detect-investigate-and-respond-to-threats/asset-management/asset-inventory-overview.md): Learn about the core concepts, features, and lifecycle of assets within the Asset Inventory. - [All assets](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/detect-investigate-and-respond-to-threats/asset-management/all-assets.md): Learn about the All Assets page, under Asset Inventory. - [All cloud assets](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/detect-investigate-and-respond-to-threats/asset-management/all-cloud-assets.md): Learn about the All Cloud Assets page to view and assess your cloud footprint. - [Discovery Engine](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/detect-investigate-and-respond-to-threats/asset-management/all-cloud-assets/discovery-engine.md): Learn how Discovery Engine identifies assets in your environment. - [Asset hierarchy](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/detect-investigate-and-respond-to-threats/asset-management/all-cloud-assets/asset-hierarchy.md): Understand how Cortex XDR organizes related assets. - [Asset classes](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/detect-investigate-and-respond-to-threats/asset-management/asset-classes.md): Accelerating remediation: Automated fix suggestions and manual remediation guidance enable developers to resolve code weaknesses directly in the source repository without context-switching to external - [AI assets](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/detect-investigate-and-respond-to-threats/asset-management/asset-classes/ai-assets.md): View and manage AI assets in your environment. - [API assets](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/detect-investigate-and-respond-to-threats/asset-management/asset-classes/api-assets.md): View and manage discovered API assets. - [Application assets](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/detect-investigate-and-respond-to-threats/asset-management/asset-classes/application-assets.md): View and manage application assets. - [Code and Supply Chain Security assets](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/detect-investigate-and-respond-to-threats/asset-management/asset-classes/code-and-ci-cd-assets.md): View code and supply chain security assets. - [Compute assets](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/detect-investigate-and-respond-to-threats/asset-management/asset-classes/compute-assets.md): View and manage compute assets. - [Container image assets](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/detect-investigate-and-respond-to-threats/asset-management/asset-classes/compute-assets/container-image-assets.md): View and manage container image assets. - [Serverless functions assets](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/detect-investigate-and-respond-to-threats/asset-management/asset-classes/compute-assets/serverless-functions-assets.md): View and manage serverless function assets. - [VM images assets](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/detect-investigate-and-respond-to-threats/asset-management/asset-classes/compute-assets/vm-images-assets.md): View and manage virtual machine image assets. - [Data assets](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/detect-investigate-and-respond-to-threats/asset-management/asset-classes/data-assets.md): View and manage data assets. - [Device assets](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/detect-investigate-and-respond-to-threats/asset-management/asset-classes/device-assets.md): View and manage device assets. - [External Surface assets](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/detect-investigate-and-respond-to-threats/asset-management/asset-classes/external-surface-assets.md): View assets discovered across your external attack surface. - [Identity assets](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/detect-investigate-and-respond-to-threats/asset-management/asset-classes/identity-assets.md): View and manage identity assets. - [Network assets](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/detect-investigate-and-respond-to-threats/asset-management/asset-classes/network-assets.md): View and manage network assets. - [Security services assets](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/detect-investigate-and-respond-to-threats/asset-management/asset-classes/security-services-assets.md): View and manage security service assets. - [Asset groups](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/detect-investigate-and-respond-to-threats/asset-management/asset-groups.md): Group assets based on shared attributes to address them collectively, simplify filtering, and enable strict access control boundaries. - [Manage Risk Scores](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/detect-investigate-and-respond-to-threats/asset-management/manage-asset-scores.md): View and investigate User Scores and Host Scores using the Risk Scores page to identify high-risk assets and detect compromised accounts or malicious activities. - [Asset configurations](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/detect-investigate-and-respond-to-threats/asset-management/asset-configurations.md): Configure criteria and roles used to manage assets. - [Network configurations](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/detect-investigate-and-respond-to-threats/asset-management/asset-configurations/network-configuration.md): Configure your internal network parameters, trusted networks, and external IP ranges to help Cortex XDR identify and map your network assets. - [Application criteria](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/detect-investigate-and-respond-to-threats/asset-management/asset-configurations/application-criteria.md): Define criteria used to identify application assets. - [Asset Roles](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/detect-investigate-and-respond-to-threats/asset-management/asset-configurations/asset-roles.md): View asset roles and the number of assets that are associated with each role. Learn how to manage asset roles for users and endpoints. - [Manage Asset Roles for Endpoints](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/detect-investigate-and-respond-to-threats/asset-management/asset-configurations/asset-roles/manage-asset-roles-for-endpoints.md): Assign and manage roles for endpoint assets. - [Manage Asset Roles for Users](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/detect-investigate-and-respond-to-threats/asset-management/asset-configurations/asset-roles/manage-asset-roles-for-users.md): Assign and manage roles for user assets. - [Honey user](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/detect-investigate-and-respond-to-threats/asset-management/asset-configurations/asset-roles/manage-asset-roles-for-users/honey-user.md): Configure honey users to detect suspicious identity activity. - [Vulnerability Assessment](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/detect-investigate-and-respond-to-threats/asset-management/vulnerability-assessment.md): Perform a vulnerability assessment of all endpoints in your network using Cortex XDR. This includes CVE, endpoint, and application analysis. - [Investigate and respond to cases](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/detect-investigate-and-respond-to-threats/investigate-and-respond-to-cases.md): Investigate, contain, and resolve cases and issues. - [Overview of cases](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/detect-investigate-and-respond-to-threats/investigate-and-respond-to-cases/overview-of-cases.md): Understand how cases work in Cortex XDR. - [What are cases?](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/detect-investigate-and-respond-to-threats/investigate-and-respond-to-cases/overview-of-cases/what-are-cases.md): Learn how Cortex XDR groups related security activity into cases. - [Resolving cases with AI](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/detect-investigate-and-respond-to-threats/investigate-and-respond-to-cases/overview-of-cases/resolving-cases-with-ai.md): Use AI capabilities to help resolve security cases. - [Case lifecycle](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/detect-investigate-and-respond-to-threats/investigate-and-respond-to-cases/overview-of-cases/case-lifecycle.md): Understand each stage of a case from creation through resolution. - [Case thresholds](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/detect-investigate-and-respond-to-threats/investigate-and-respond-to-cases/overview-of-cases/case-thresholds.md): Learn how thresholds determine case creation and updates. - [Case scope and impact](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/detect-investigate-and-respond-to-threats/investigate-and-respond-to-cases/overview-of-cases/case-scope-and-impact.md): Understand how Cortex XDR calculates case scope and impact. - [Case and issue domains](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/detect-investigate-and-respond-to-threats/investigate-and-respond-to-cases/overview-of-cases/case-and-issue-domains.md): Understand the domains associated with cases and issues. - [Overview of case teams and roles](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/detect-investigate-and-respond-to-threats/investigate-and-respond-to-cases/overview-of-cases/overview-of-case-teams-and-roles.md): Learn how case teams and roles control case access. - [Case concepts](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/detect-investigate-and-respond-to-threats/investigate-and-respond-to-cases/case-concepts.md): Learn the concepts that shape case analysis and resolution. - [Issues, findings, and events](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/detect-investigate-and-respond-to-threats/investigate-and-respond-to-cases/case-concepts/issues-findings-and-events.md): Understand the relationships among issues, findings, and events. - [Case grouping](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/detect-investigate-and-respond-to-threats/investigate-and-respond-to-cases/case-concepts/case-grouping.md): Learn how Cortex XDR groups related activity into cases. - [Case scoring](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/detect-investigate-and-respond-to-threats/investigate-and-respond-to-cases/case-concepts/case-scoring.md): Learn how Cortex XDR calculates case scores. - [Case starring](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/detect-investigate-and-respond-to-threats/investigate-and-respond-to-cases/case-concepts/case-starring.md): Star cases to prioritize them for investigation. - [What is Causality?](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/detect-investigate-and-respond-to-threats/investigate-and-respond-to-cases/case-concepts/what-is-causality.md): Learn how Causality connects related events and alerts. - [Analyze and resolve cases](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/detect-investigate-and-respond-to-threats/investigate-and-respond-to-cases/analyze-and-resolve-cases.md): Learn how to analyze and resolve cases. - [Review all cases](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/detect-investigate-and-respond-to-threats/investigate-and-respond-to-cases/analyze-and-resolve-cases/review-all-cases.md): Monitor and prioritize cases across your environment. - [Start case analysis](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/detect-investigate-and-respond-to-threats/investigate-and-respond-to-cases/analyze-and-resolve-cases/start-case-analysis.md): Open a case and begin an investigation. - [Establish Case context](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/detect-investigate-and-respond-to-threats/investigate-and-respond-to-cases/analyze-and-resolve-cases/establish-case-context.md): Establish the case context before deeper analysis. - [AI-generated case summaries](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/detect-investigate-and-respond-to-threats/investigate-and-respond-to-cases/analyze-and-resolve-cases/establish-case-context/ai-generated-case-summaries.md): Review AI-generated summaries of case activity and context. - [Assess case severity and score](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/detect-investigate-and-respond-to-threats/investigate-and-respond-to-cases/analyze-and-resolve-cases/establish-case-context/assess-case-severity-and-score.md): Assess and update a case severity and score. - [Update case attributes](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/detect-investigate-and-respond-to-threats/investigate-and-respond-to-cases/analyze-and-resolve-cases/establish-case-context/update-case-attributes.md): Update the attributes associated with a case. - [Analyze case details](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/detect-investigate-and-respond-to-threats/investigate-and-respond-to-cases/analyze-and-resolve-cases/analyze-case-details.md): Investigate case evidence, relationships, and activity. - [Grouping graph](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/detect-investigate-and-respond-to-threats/investigate-and-respond-to-cases/analyze-and-resolve-cases/analyze-case-details/grouping-graph.md): Use the grouping graph to examine related case activity. - [Evidence](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/detect-investigate-and-respond-to-threats/investigate-and-respond-to-cases/analyze-and-resolve-cases/analyze-case-details/evidence.md): Review evidence that supports case investigation. - [Issue feed](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/detect-investigate-and-respond-to-threats/investigate-and-respond-to-cases/analyze-and-resolve-cases/analyze-case-details/issue-feed.md): Review issues associated with a case. - [Associated assets and artifacts](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/detect-investigate-and-respond-to-threats/investigate-and-respond-to-cases/analyze-and-resolve-cases/analyze-case-details/associated-assets-and-artifacts.md): Review assets and artifacts associated with a case. - [MITRE ATT\&CK tactics and techniques](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/detect-investigate-and-respond-to-threats/investigate-and-respond-to-cases/analyze-and-resolve-cases/analyze-case-details/mitre-att-and-ck-tactics-and-techniques.md): Review mapped MITRE ATT\&CK tactics and techniques. - [Compliance standards and controls](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/detect-investigate-and-respond-to-threats/investigate-and-respond-to-cases/analyze-and-resolve-cases/analyze-case-details/compliance-standards-and-controls.md): Review compliance standards and controls linked to a case. - [Case timeline](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/detect-investigate-and-respond-to-threats/investigate-and-respond-to-cases/analyze-and-resolve-cases/analyze-case-details/case-timeline.md): Review a chronological timeline of case activity. - [Detailed View](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/detect-investigate-and-respond-to-threats/investigate-and-respond-to-cases/analyze-and-resolve-cases/analyze-case-details/detailed-view.md): Review detailed information about a case. - [Resolve the case](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/detect-investigate-and-respond-to-threats/investigate-and-respond-to-cases/analyze-and-resolve-cases/resolve-the-case.md): Remediate findings and close the case. - [Resolution Center](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/detect-investigate-and-respond-to-threats/investigate-and-respond-to-cases/analyze-and-resolve-cases/resolve-the-case/resolution-center.md): Use Resolution Center to complete case resolution tasks. - [Collaborative notes and comments](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/detect-investigate-and-respond-to-threats/investigate-and-respond-to-cases/analyze-and-resolve-cases/resolve-the-case/collaborative-notes-and-comments.md): Add notes and comments while resolving a case. - [How to resolve a case](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/detect-investigate-and-respond-to-threats/investigate-and-respond-to-cases/analyze-and-resolve-cases/resolve-the-case/resolve-a-case.md): Resolve a case and document its outcome. - [Resolution reasons for cases and issues](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/detect-investigate-and-respond-to-threats/investigate-and-respond-to-cases/analyze-and-resolve-cases/resolve-the-case/resolution-reasons-for-cases-and-issues.md): Select resolution reasons for cases and issues. - [Monitor and track resolution times](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/detect-investigate-and-respond-to-threats/investigate-and-respond-to-cases/analyze-and-resolve-cases/resolve-the-case/monitor-and-track-resolution-times.md): Monitor and track case and issue resolution times. - [Use Cortex Agentic Assistant chat in an investigation](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/detect-investigate-and-respond-to-threats/investigate-and-respond-to-cases/analyze-and-resolve-cases/use-cortex-agentic-assistant-chat-in-an-investigation.md): Use Agentic Assistant chat during an investigation. - [Additional case actions](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/detect-investigate-and-respond-to-threats/investigate-and-respond-to-cases/analyze-and-resolve-cases/additional-case-actions.md): Create, merge, assign, and manage cases. - [Create a case](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/detect-investigate-and-respond-to-threats/investigate-and-respond-to-cases/analyze-and-resolve-cases/additional-case-actions/create-a-case.md): Create a case to track a security investigation. - [Merge a case](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/detect-investigate-and-respond-to-threats/investigate-and-respond-to-cases/analyze-and-resolve-cases/additional-case-actions/merge-a-case.md): Merge related cases into a single investigation. - [Assign a case team and restrict access](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/detect-investigate-and-respond-to-threats/investigate-and-respond-to-cases/analyze-and-resolve-cases/additional-case-actions/assign-a-case-team-and-restrict-access.md): Assign a team and restrict access to sensitive cases. - [Playbook examples](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/detect-investigate-and-respond-to-threats/investigate-and-respond-to-cases/analyze-and-resolve-cases/additional-case-actions/assign-a-case-team-and-restrict-access/playbook-examples.md): Review playbook examples for case teams and access controls. - [Unified case view](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/detect-investigate-and-respond-to-threats/investigate-and-respond-to-cases/analyze-and-resolve-cases/additional-case-actions/unified-case-view.md): Use the unified case view to investigate related activity. - [Investigate issues](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/detect-investigate-and-respond-to-threats/investigate-and-respond-to-cases/investigate-issues.md): Cortex XDR generates issues to bring your attention to security risks in your framework. - [Overview of the Issues page](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/detect-investigate-and-respond-to-threats/investigate-and-respond-to-cases/investigate-issues/overview-of-the-issues-page.md): Learn how to review and manage issues. - [Issue card](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/detect-investigate-and-respond-to-threats/investigate-and-respond-to-cases/investigate-issues/issue-card.md): Understand the information shown on an issue card. - [Resolution actions](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/detect-investigate-and-respond-to-threats/investigate-and-respond-to-cases/investigate-issues/resolution-actions.md): Apply resolution actions to issues. - [Link or unlink issues from a case](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/detect-investigate-and-respond-to-threats/investigate-and-respond-to-cases/investigate-issues/link-or-unlink-issues-from-a-case.md): Link issues to cases or remove existing links. - [Run an automation on an issue](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/detect-investigate-and-respond-to-threats/investigate-and-respond-to-cases/investigate-issues/run-an-automation-on-an-issue.md): Run an automation directly from an issue. - [Use the War Room in an investigation](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/detect-investigate-and-respond-to-threats/investigate-and-respond-to-cases/investigate-issues/use-the-war-room-in-an-investigation.md): Use War Room to investigate, collaborate, and run response actions. - [Use the Work Plan in an investigation](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/detect-investigate-and-respond-to-threats/investigate-and-respond-to-cases/investigate-issues/use-the-work-plan-in-an-investigation.md): Use Work Plan to monitor and manage issue playbook tasks. - [Issue deduplication](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/detect-investigate-and-respond-to-threats/investigate-and-respond-to-cases/investigate-issues/issue-deduplication.md): Learn how Cortex XDR deduplicates related issues. - [Causality view](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/detect-investigate-and-respond-to-threats/investigate-and-respond-to-cases/investigate-issues/causality-view.md): Investigate issue activity through the Causality view. - [Network causality view](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/detect-investigate-and-respond-to-threats/investigate-and-respond-to-cases/investigate-issues/causality-view/network-causality-view.md): Investigate network activity in the Causality view. - [Cloud causality view](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/detect-investigate-and-respond-to-threats/investigate-and-respond-to-cases/investigate-issues/causality-view/cloud-causality-view.md): Investigate cloud activity in the Causality view. - [Cloud causality view for audit log issues](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/detect-investigate-and-respond-to-threats/investigate-and-respond-to-cases/investigate-issues/causality-view/cloud-causality-view-for-audit-log-issues.md): Investigate cloud attacks faster with entity context directly in the Cloud causality view. - [Saas causality view](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/detect-investigate-and-respond-to-threats/investigate-and-respond-to-cases/investigate-issues/causality-view/saas-causality-view.md): Investigate SaaS activity in the Causality view. - [Timeline](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/detect-investigate-and-respond-to-threats/investigate-and-respond-to-cases/investigate-issues/causality-view/timeline.md): Review a timeline of related issue activity. - [Causality icons key](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/detect-investigate-and-respond-to-threats/investigate-and-respond-to-cases/investigate-issues/causality-view/causality-icons-key.md): Reference icons used in the Causality view. - [Issue investigation actions](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/detect-investigate-and-respond-to-threats/investigate-and-respond-to-cases/investigate-issues/issue-investigation-actions.md): Use actions that support issue investigation and resolution. - [Copy issues](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/detect-investigate-and-respond-to-threats/investigate-and-respond-to-cases/investigate-issues/issue-investigation-actions/copy-issues.md): Copy issues for separate investigation or recordkeeping. - [Analyze an issue](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/detect-investigate-and-respond-to-threats/investigate-and-respond-to-cases/investigate-issues/issue-investigation-actions/analyze-an-issue.md): Analyze issue details and related security activity. - [Create profile exceptions](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/detect-investigate-and-respond-to-threats/investigate-and-respond-to-cases/investigate-issues/issue-investigation-actions/create-profile-exceptions.md): Create profile exceptions from an issue. - [Retrieve additional issue details](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/detect-investigate-and-respond-to-threats/investigate-and-respond-to-cases/investigate-issues/issue-investigation-actions/retrieve-additional-issue-details.md): Retrieve additional details for an issue investigation. - [Add a file path to a malware profile allow list](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/detect-investigate-and-respond-to-threats/investigate-and-respond-to-cases/investigate-issues/issue-investigation-actions/add-a-file-path-to-a-malware-profile-allow-list.md): Add file paths to the malware profile allow list. - [Investigate contributing events](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/detect-investigate-and-respond-to-threats/investigate-and-respond-to-cases/investigate-issues/issue-investigation-actions/investigate-contributing-events.md): Investigate events that contributed to an issue. - [Create a featured field](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/detect-investigate-and-respond-to-threats/investigate-and-respond-to-cases/investigate-issues/issue-investigation-actions/create-a-featured-field.md): Create a featured field for issue analysis. - [View generating BIOC or IOC rule](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/detect-investigate-and-respond-to-threats/investigate-and-respond-to-cases/investigate-issues/issue-investigation-actions/view-generating-bioc-or-ioc-rule.md): View the BIOC or IOC rule that generated an issue. - [Export issue details to a file](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/detect-investigate-and-respond-to-threats/investigate-and-respond-to-cases/investigate-issues/issue-investigation-actions/export-issue-details-to-a-file.md): Export issue details to a file for sharing or recordkeeping. - [Exclude an issue](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/detect-investigate-and-respond-to-threats/investigate-and-respond-to-cases/investigate-issues/issue-investigation-actions/exclude-an-issue.md): Exclude an issue from further detection processing. - [Query case and issue data](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/detect-investigate-and-respond-to-threats/investigate-and-respond-to-cases/investigate-issues/issue-investigation-actions/query-case-and-issue-data.md): Query data associated with cases and issues. - [Update issue fields](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/detect-investigate-and-respond-to-threats/investigate-and-respond-to-cases/investigate-issues/issue-investigation-actions/update-issue-fields.md): Update fields associated with an issue. - [Close an issue](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/detect-investigate-and-respond-to-threats/investigate-and-respond-to-cases/investigate-issues/issue-investigation-actions/close-an-issue.md): Close an issue after completing its investigation. - [Review findings](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/detect-investigate-and-respond-to-threats/investigate-and-respond-to-cases/review-findings.md): Review findings for an asset to gain insights into an asset’s posture status. - [Findings card](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/detect-investigate-and-respond-to-threats/investigate-and-respond-to-cases/review-findings/findings-card.md): Understand the information displayed on a findings card. - [Investigate artifacts and assets](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/detect-investigate-and-respond-to-threats/investigate-and-respond-to-cases/investigate-artifacts-and-assets.md): You can investigate specific artifacts and assets on dedicated views related to IP address, Network Assets, and File and Process Hash information. - [Investigate an IP address](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/detect-investigate-and-respond-to-threats/investigate-and-respond-to-cases/investigate-artifacts-and-assets/investigate-an-ip-address.md): Investigate an IP address from an issue or elsewhere in Cortex XDR. - [Investigate an asset](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/detect-investigate-and-respond-to-threats/investigate-and-respond-to-cases/investigate-artifacts-and-assets/investigate-an-asset.md): Investigate an asset and its related activity. - [Investigate a host](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/detect-investigate-and-respond-to-threats/investigate-and-respond-to-cases/investigate-artifacts-and-assets/investigate-a-host.md): Investigate host details, activity, and related security events. - [Investigate a file and process hash](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/detect-investigate-and-respond-to-threats/investigate-and-respond-to-cases/investigate-artifacts-and-assets/investigate-a-file-and-process-hash.md): Investigate a file or process hash and its related activity. - [Investigate a user](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/detect-investigate-and-respond-to-threats/investigate-and-respond-to-cases/investigate-artifacts-and-assets/investigate-a-user.md): Investigate a user and their related security activity. - [Investigate endpoints](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/detect-investigate-and-respond-to-threats/investigate-and-respond-to-cases/investigate-endpoints.md): You can investigate and take actions on your endpoints in the Action Center. - [Overview of the Action Center](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/detect-investigate-and-respond-to-threats/investigate-and-respond-to-cases/investigate-endpoints/overview-of-the-action-center.md): Use the Action Center to monitor and manage response actions. - [Initiate and monitor endpoint actions](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/detect-investigate-and-respond-to-threats/investigate-and-respond-to-cases/investigate-endpoints/overview-of-the-action-center/initiate-and-monitor-endpoint-actions.md): Initiate and monitor response actions on endpoints. - [Action Center reference information](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/detect-investigate-and-respond-to-threats/investigate-and-respond-to-cases/investigate-endpoints/overview-of-the-action-center/action-center-reference-information.md): Reference Action Center statuses, fields, and available actions. - [Manage endpoints](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/detect-investigate-and-respond-to-threats/investigate-and-respond-to-cases/investigate-endpoints/manage-endpoints.md): Manage endpoints during security investigations. - [Retrieve files from an endpoint](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/detect-investigate-and-respond-to-threats/investigate-and-respond-to-cases/investigate-endpoints/retrieve-files-from-an-endpoint.md): Retrieve a file from an endpoint for investigation. - [Retrieve support logs from an endpoint](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/detect-investigate-and-respond-to-threats/investigate-and-respond-to-cases/investigate-endpoints/retrieve-support-logs-from-an-endpoint.md): Retrieve endpoint support logs for troubleshooting and analysis. - [Retrieve support file password](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/detect-investigate-and-respond-to-threats/investigate-and-respond-to-cases/investigate-endpoints/retrieve-support-file-password.md): Retrieve the password for an endpoint support file. - [Scan an endpoint for malware](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/detect-investigate-and-respond-to-threats/investigate-and-respond-to-cases/investigate-endpoints/scan-an-endpoint-for-malware.md): Scan an endpoint for malware and review the results. - [Investigate files](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/detect-investigate-and-respond-to-threats/investigate-and-respond-to-cases/investigate-files.md): Investigate files and manage file-related response actions. - [Manage file execution](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/detect-investigate-and-respond-to-threats/investigate-and-respond-to-cases/investigate-files/manage-file-execution.md): Manage file execution during an investigation. - [Manage quarantined files](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/detect-investigate-and-respond-to-threats/investigate-and-respond-to-cases/investigate-files/manage-quarantined-files.md): Review and manage quarantined files. - [Review WildFire analysis details](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/detect-investigate-and-respond-to-threats/investigate-and-respond-to-cases/investigate-files/review-wildfire-analysis-details.md): Review WildFire analysis details for a submitted file. - [Import file hash exceptions](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/detect-investigate-and-respond-to-threats/investigate-and-respond-to-cases/investigate-files/import-file-hash-exceptions.md): Import file hash exceptions for endpoint protection. - [Automation](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/detect-investigate-and-respond-to-threats/investigate-and-respond-to-cases/automation.md): Automate investigation and response workflows in Cortex XDR. - [Quick Actions](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/detect-investigate-and-respond-to-threats/investigate-and-respond-to-cases/automation/quick-actions.md): Run common automation actions during an investigation. - [Automation Exclusion Center](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/detect-investigate-and-respond-to-threats/investigate-and-respond-to-cases/automation/automation-exclusion-center.md): Review automation exclusions that protect critical assets. - [Manage automation exclusion policies](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/detect-investigate-and-respond-to-threats/investigate-and-respond-to-cases/automation/manage-automation-exclusion-policies.md): Create and manage automation exclusion policies. - [Playbooks](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/detect-investigate-and-respond-to-threats/investigate-and-respond-to-cases/automation/playbooks.md): Build and manage playbooks for automated response workflows. - [Playbooks overview](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/detect-investigate-and-respond-to-threats/investigate-and-respond-to-cases/automation/playbooks/playbooks-overview.md): Learn how playbooks automate security investigation and response. - [Access to playbooks](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/detect-investigate-and-respond-to-threats/investigate-and-respond-to-cases/automation/playbooks/access-to-playbooks.md): Configure access permissions for playbooks. - [Playbook development checklist](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/detect-investigate-and-respond-to-threats/investigate-and-respond-to-cases/automation/playbooks/playbook-development-checklist.md): Use a checklist to plan and validate playbook development. - [Plan your playbook](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/detect-investigate-and-respond-to-threats/investigate-and-respond-to-cases/automation/playbooks/plan-your-playbook.md): Plan the logic, inputs, and outcomes for a playbook. - [Manage playbooks](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/detect-investigate-and-respond-to-threats/investigate-and-respond-to-cases/automation/playbooks/manage-playbooks.md): Manage existing playbooks and their versions. - [Build your playbook](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/detect-investigate-and-respond-to-threats/investigate-and-respond-to-cases/automation/playbooks/build-your-playbook.md): Build a playbook that automates your investigation workflow. - [Choose from existing playbooks or create your own](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/detect-investigate-and-respond-to-threats/investigate-and-respond-to-cases/automation/playbooks/build-your-playbook/choose-from-existing-playbooks-or-create-your-own.md): Choose an existing playbook or create one for your response workflow. - [Configure playbook settings](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/detect-investigate-and-respond-to-threats/investigate-and-respond-to-cases/automation/playbooks/build-your-playbook/configure-playbook-settings.md): Configure playbook settings, triggers, and inputs. - [Add objects from the Task Library](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/detect-investigate-and-respond-to-threats/investigate-and-respond-to-cases/automation/playbooks/build-your-playbook/add-objects-from-the-task-library.md): Add tasks and objects from the Task Library. - [Add commands and scripts](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/detect-investigate-and-respond-to-threats/investigate-and-respond-to-cases/automation/playbooks/build-your-playbook/add-objects-from-the-task-library/add-commands-and-scripts.md): Add commands and scripts to playbook tasks. - [Add sub-playbooks](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/detect-investigate-and-respond-to-threats/investigate-and-respond-to-cases/automation/playbooks/build-your-playbook/add-objects-from-the-task-library/add-sub-playbooks.md): Add sub-playbooks to reuse automation steps within a playbook. - [Add AI Prompt tasks](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/detect-investigate-and-respond-to-threats/investigate-and-respond-to-cases/automation/playbooks/build-your-playbook/add-objects-from-the-task-library/add-ai-prompt-tasks.md): Add AI Prompt tasks to a playbook. - [Add manual tasks and blank tasks](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/detect-investigate-and-respond-to-threats/investigate-and-respond-to-cases/automation/playbooks/build-your-playbook/add-objects-from-the-task-library/add-manual-tasks-and-blank-tasks.md): Add manual and blank tasks to a playbook. - [Create a standard task](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/detect-investigate-and-respond-to-threats/investigate-and-respond-to-cases/automation/playbooks/build-your-playbook/add-objects-from-the-task-library/add-manual-tasks-and-blank-tasks/create-a-standard-task.md): Define a Standard task in Cortex XDR. - [Create a conditional task](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/detect-investigate-and-respond-to-threats/investigate-and-respond-to-cases/automation/playbooks/build-your-playbook/add-objects-from-the-task-library/add-manual-tasks-and-blank-tasks/create-a-conditional-task.md): Create a Conditional task in a playbook. - [Create a communication task](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/detect-investigate-and-respond-to-threats/investigate-and-respond-to-cases/automation/playbooks/build-your-playbook/add-objects-from-the-task-library/add-manual-tasks-and-blank-tasks/create-a-communication-task.md): Communication tasks let you send surveys and collect issue data. - [Create a section header](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/detect-investigate-and-respond-to-threats/investigate-and-respond-to-cases/automation/playbooks/build-your-playbook/create-a-section-header.md): Organize playbook tasks with section headers. - [Configure script error handling in a playbook](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/detect-investigate-and-respond-to-threats/investigate-and-respond-to-cases/automation/playbooks/build-your-playbook/configure-script-error-handling-in-a-playbook.md): Configure how a playbook handles errors from script tasks. - [Customize your playbook](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/detect-investigate-and-respond-to-threats/investigate-and-respond-to-cases/automation/playbooks/build-your-playbook/customize-your-playbook.md): Customize playbook behavior, data, and task flow. - [Configure a sub-playbook loop](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/detect-investigate-and-respond-to-threats/investigate-and-respond-to-cases/automation/playbooks/build-your-playbook/customize-your-playbook/configure-a-sub-playbook-loop.md): Configure loops that run a sub-playbook for each input item. - [Filter and Transform data](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/detect-investigate-and-respond-to-threats/investigate-and-respond-to-cases/automation/playbooks/build-your-playbook/customize-your-playbook/filter-and-transform-data.md): Filter and transform data in playbook tasks. - [Create custom filter and transformers](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/detect-investigate-and-respond-to-threats/investigate-and-respond-to-cases/automation/playbooks/build-your-playbook/customize-your-playbook/create-custom-filter-and-transformers.md): Create custom filters and transformers for playbook data. - [Filter considerations, categories, and built-in filters](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/detect-investigate-and-respond-to-threats/investigate-and-respond-to-cases/automation/playbooks/build-your-playbook/customize-your-playbook/filter-considerations-categories-and-built-in-filters.md): Learn about filters and select the right built-in option. - [Transformer considerations, categories, and built-in transformers](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/detect-investigate-and-respond-to-threats/investigate-and-respond-to-cases/automation/playbooks/build-your-playbook/customize-your-playbook/transformer-considerations-categories-and-built-in-transformers.md): Learn about transformers and select the right built-in option. - [Extend context](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/detect-investigate-and-respond-to-threats/investigate-and-respond-to-cases/automation/playbooks/build-your-playbook/customize-your-playbook/extend-context.md): Add task output to the investigation context. - [Extract Indicators](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/detect-investigate-and-respond-to-threats/investigate-and-respond-to-cases/automation/playbooks/build-your-playbook/customize-your-playbook/extract-indicators.md): Extract indicators from playbook task output. - [Update issue fields with playbook tasks](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/detect-investigate-and-respond-to-threats/investigate-and-respond-to-cases/automation/playbooks/build-your-playbook/customize-your-playbook/update-issue-fields-with-playbook-tasks.md): Update issue fields with playbook task output. - [Test your playbook](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/detect-investigate-and-respond-to-threats/investigate-and-respond-to-cases/automation/playbooks/build-your-playbook/test-your-playbook.md): Set breakpoints, conditional breakpoints, skips, and input or output overrides in the playbook debugger. - [Troubleshoot playbook performance](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/detect-investigate-and-respond-to-threats/investigate-and-respond-to-cases/automation/playbooks/build-your-playbook/test-your-playbook/troubleshoot-playbook-performance.md): Diagnose and improve playbook performance. - [Manage playbook content](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/detect-investigate-and-respond-to-threats/investigate-and-respond-to-cases/automation/playbooks/build-your-playbook/manage-playbook-content.md): Manage tasks, inputs, outputs, and content in playbooks. - [Best practices for playbooks](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/detect-investigate-and-respond-to-threats/investigate-and-respond-to-cases/automation/playbooks/best-practices-for-playbooks.md): Follow recommended practices for creating and maintaining playbooks. - [Accelerate playbook development using the Agentic Playbook Builder (preview)](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/detect-investigate-and-respond-to-threats/investigate-and-respond-to-cases/automation/playbooks/accelerate-playbook-development-using-the-agentic-playbook-builder-preview.md): Use the Agentic Playbook Builder (preview) in Cortex XDR to create, optimize, and troubleshoot playbooks using natural language and security best practices. - [Agentic Playbook Builder prompt examples](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/detect-investigate-and-respond-to-threats/investigate-and-respond-to-cases/automation/playbooks/accelerate-playbook-development-using-the-agentic-playbook-builder-preview/agentic-playbook-builder-prompt-examples.md): Use Agentic Playbook Builder prompt examples to generate Cortex XDR security response playbooks for triage, enrichment, and remediation. - [AI Prompts](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/detect-investigate-and-respond-to-threats/investigate-and-respond-to-cases/automation/ai-prompts.md): Create and manage AI prompts for automation workflows. - [AI prompts role-based access control](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/detect-investigate-and-respond-to-threats/investigate-and-respond-to-cases/automation/ai-prompts/ai-prompts-role-based-access-control.md): Manage AI prompt permissions with role-based access control. - [Use existing prompts](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/detect-investigate-and-respond-to-threats/investigate-and-respond-to-cases/automation/ai-prompts/use-existing-prompts.md): Find, duplicate, and edit prompts from the Prompts Library. - [Create a prompt](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/detect-investigate-and-respond-to-threats/investigate-and-respond-to-cases/automation/ai-prompts/create-a-prompt.md): Create or edit prompts, configure settings, and use them in agents or playbooks. - [Write effective prompts](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/detect-investigate-and-respond-to-threats/investigate-and-respond-to-cases/automation/ai-prompts/write-effective-prompts.md): Tips for creating effective AI prompts. - [Create an automation rule](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/detect-investigate-and-respond-to-threats/investigate-and-respond-to-cases/automation/create-an-automation-rule.md): Learn how to create an automation rule for an issue. - [Scripts](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/detect-investigate-and-respond-to-threats/investigate-and-respond-to-cases/automation/scripts.md): Create and manage scripts for automated workflows. - [Use existing scripts](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/detect-investigate-and-respond-to-threats/investigate-and-respond-to-cases/automation/scripts/use-existing-scripts.md): Find and use existing scripts in automation workflows. - [Create a script](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/detect-investigate-and-respond-to-threats/investigate-and-respond-to-cases/automation/scripts/create-a-script.md): Create a script for use in automation workflows. - [Accelerate script development using the Automation Engineer agent](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/detect-investigate-and-respond-to-threats/investigate-and-respond-to-cases/automation/scripts/accelerate-script-development-using-the-automation-engineer-agent.md): Use the Automation Engineer agent to accelerate script development. - [Change the Docker image in a script](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/detect-investigate-and-respond-to-threats/investigate-and-respond-to-cases/automation/scripts/change-the-docker-image-in-a-script.md): Change the Docker image used when a script runs. - [Connect an engine to an image registry](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/detect-investigate-and-respond-to-threats/investigate-and-respond-to-cases/automation/scripts/change-the-docker-image-in-a-script/connect-an-engine-to-an-image-registry.md): Connect an engine to an image registry for script dependencies. - [Context data](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/detect-investigate-and-respond-to-threats/investigate-and-respond-to-cases/automation/context-data.md): Use context data to assist with the investigation and remediation process. - [Issue context data](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/detect-investigate-and-respond-to-threats/investigate-and-respond-to-cases/automation/context-data/issue-context-data.md): View and manage context data stored for an issue. - [Case context data](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/detect-investigate-and-respond-to-threats/investigate-and-respond-to-cases/automation/context-data/case-context-data.md): View and manage context data stored for a case. - [Search context data](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/detect-investigate-and-respond-to-threats/investigate-and-respond-to-cases/automation/context-data/search-context-data.md): Search context data to support issue investigation and automation. - [Add context data to an issue](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/detect-investigate-and-respond-to-threats/investigate-and-respond-to-cases/automation/context-data/add-context-data-to-an-issue.md): Add context data to an issue for investigation and automation. - [Add context data to a case](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/detect-investigate-and-respond-to-threats/investigate-and-respond-to-cases/automation/context-data/add-context-data-to-a-case.md): Add context data to a case for investigation and automation. - [Delete context data from a case](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/detect-investigate-and-respond-to-threats/investigate-and-respond-to-cases/automation/context-data/delete-context-data-from-a-case.md): Delete context data from a case when it is no longer needed. - [Use context data in a playbook](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/detect-investigate-and-respond-to-threats/investigate-and-respond-to-cases/automation/context-data/use-context-data-in-a-playbook.md): Use context data as inputs and outputs in playbooks. - [Lists](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/detect-investigate-and-respond-to-threats/investigate-and-respond-to-cases/automation/lists.md): Create and manage lists for use in playbooks and scripts. - [Create a list](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/detect-investigate-and-respond-to-threats/investigate-and-respond-to-cases/automation/lists/create-a-list.md): Create a list for playbooks, scripts, and automation. - [List commands](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/detect-investigate-and-respond-to-threats/investigate-and-respond-to-cases/automation/lists/list-commands.md): Use list commands to retrieve and update list data. - [Use cases: JSON lists](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/detect-investigate-and-respond-to-threats/investigate-and-respond-to-cases/automation/lists/use-cases-json-lists.md): Use JSON lists to store and process structured automation data. - [Transform a list into an array](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/detect-investigate-and-respond-to-threats/investigate-and-respond-to-cases/automation/lists/transform-a-list-into-an-array.md): Convert a list into an array for use in automation. - [Integrations](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/detect-investigate-and-respond-to-threats/investigate-and-respond-to-cases/automation/integrations.md): Configure integrations that connect Cortex XDR to external services. - [Add an integration instance](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/detect-investigate-and-respond-to-threats/investigate-and-respond-to-cases/automation/integrations/add-an-integration-instance.md): Add and configure an integration instance. - [Use integration commands in the CLI](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/detect-investigate-and-respond-to-threats/investigate-and-respond-to-cases/automation/integrations/use-integration-commands-in-the-cli.md): Run integration commands from the command-line interface. - [Troubleshoot integations](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/detect-investigate-and-respond-to-threats/investigate-and-respond-to-cases/automation/integrations/troubleshoot-integations.md): Diagnose and resolve integration configuration and connectivity issues. - [Manage credentials](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/detect-investigate-and-respond-to-threats/investigate-and-respond-to-cases/automation/integrations/manage-credentials.md): Create and manage credentials for integration authentication. - [Engines](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/detect-investigate-and-respond-to-threats/investigate-and-respond-to-cases/automation/engines.md): Install, manage, configure, and troubleshoot engines. - [What is an engine?](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/detect-investigate-and-respond-to-threats/investigate-and-respond-to-cases/automation/engines/what-is-an-engine.md): Learn how engines run integrations and automation tasks. - [Engine requirements](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/detect-investigate-and-respond-to-threats/investigate-and-respond-to-cases/automation/engines/engine-requirements.md): Hardware, OS, and required URLs for engines. - [Install an engine](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/detect-investigate-and-respond-to-threats/investigate-and-respond-to-cases/automation/engines/install-an-engine.md): Install, deploy and configure Cortex XDR engines. - [Docker](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/detect-investigate-and-respond-to-threats/investigate-and-respond-to-cases/automation/engines/install-an-engine/docker.md): Install, configure, secure, and troubleshoot Docker for Cortex XDR engines. - [Install Docker](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/detect-investigate-and-respond-to-threats/investigate-and-respond-to-cases/automation/engines/install-an-engine/docker/install-docker.md): Install Docker and verify engine user permissions. - [Install Docker distribution for Red Hat](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/detect-investigate-and-respond-to-threats/investigate-and-respond-to-cases/automation/engines/install-an-engine/docker/install-docker-distribution-for-red-hat.md): Configure Docker and SELinux on Red Hat engine servers. - [Docker image security](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/detect-investigate-and-respond-to-threats/investigate-and-respond-to-cases/automation/engines/install-an-engine/docker/docker-image-security.md): Secure, harden, and troubleshoot Docker images and containers. - [Docker FAQs](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/detect-investigate-and-respond-to-threats/investigate-and-respond-to-cases/automation/engines/install-an-engine/docker/docker-faqs.md): Find answers to common Docker questions for engines. - [Troubleshoot Docker Issues](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/detect-investigate-and-respond-to-threats/investigate-and-respond-to-cases/automation/engines/install-an-engine/docker/troubleshoot-docker-issues.md): Diagnose and resolve Docker issues on engines. - [Configure Docker pull rate limit](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/detect-investigate-and-respond-to-threats/investigate-and-respond-to-cases/automation/engines/install-an-engine/docker/configure-docker-pull-rate-limit.md): Configure Docker image pull rate limits for engines. - [Change the Docker Installation folder](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/detect-investigate-and-respond-to-threats/investigate-and-respond-to-cases/automation/engines/install-an-engine/docker/change-the-docker-installation-folder.md): Change the Docker installation directory on an engine. - [Docker hardening guide](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/detect-investigate-and-respond-to-threats/investigate-and-respond-to-cases/automation/engines/install-an-engine/docker/docker-hardening-guide.md): Harden Docker environments used by Cortex XDR engines. - [Docker network hardening](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/detect-investigate-and-respond-to-threats/investigate-and-respond-to-cases/automation/engines/install-an-engine/docker/docker-hardening-guide/docker-network-hardening.md): Configure Docker network settings to improve engine security. - [Configure Docker images](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/detect-investigate-and-respond-to-threats/investigate-and-respond-to-cases/automation/engines/install-an-engine/docker/docker-hardening-guide/configure-docker-images.md): Configure Docker images used by Cortex XDR engines. - [Run Docker with non-root internal users](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/detect-investigate-and-respond-to-threats/investigate-and-respond-to-cases/automation/engines/install-an-engine/docker/docker-hardening-guide/run-docker-with-non-root-internal-users.md): Run Docker containers with non-root internal users. - [Configure the memory limit support without swap capabilities](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/detect-investigate-and-respond-to-threats/investigate-and-respond-to-cases/automation/engines/install-an-engine/docker/docker-hardening-guide/configure-the-memory-limit-support-without-swap-capabilities.md): Configure memory limits when swap is unavailable. - [Configure the memory limitation](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/detect-investigate-and-respond-to-threats/investigate-and-respond-to-cases/automation/engines/install-an-engine/docker/docker-hardening-guide/configure-the-memory-limitation.md): Configure memory limits for Docker containers. - [Configure the CPU, PIDs, and open the file descriptors limit](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/detect-investigate-and-respond-to-threats/investigate-and-respond-to-cases/automation/engines/install-an-engine/docker/docker-hardening-guide/configure-the-cpu-pids-and-open-the-file-descriptors-limit.md): Configure CPU, process, and file descriptor limits for Docker containers. - [Check Docker hardening configurations](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/detect-investigate-and-respond-to-threats/investigate-and-respond-to-cases/automation/engines/install-an-engine/docker/docker-hardening-guide/check-docker-hardening-configurations.md): Verify that Docker hardening settings are configured correctly. - [Podman](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/detect-investigate-and-respond-to-threats/investigate-and-respond-to-cases/automation/engines/install-an-engine/podman.md): Install, configure, and troubleshoot Podman for Cortex XDR engines. - [Change the Container storage](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/detect-investigate-and-respond-to-threats/investigate-and-respond-to-cases/automation/engines/install-an-engine/podman/change-the-container-storage.md): Configure Podman container storage for an engine. - [Install Podman](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/detect-investigate-and-respond-to-threats/investigate-and-respond-to-cases/automation/engines/install-an-engine/podman/install-podman.md): Install and configure Podman for Cortex XDR engines. - [Migrate from Docker to Podman](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/detect-investigate-and-respond-to-threats/investigate-and-respond-to-cases/automation/engines/install-an-engine/podman/migrate-from-docker-to-podman.md): Migrate an existing engine from Docker to Podman. - [Troubleshoot Podman](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/detect-investigate-and-respond-to-threats/investigate-and-respond-to-cases/automation/engines/install-an-engine/podman/troubleshoot-podman.md): Resolve common Podman issues on Cortex XDR engines. - [Manage engines](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/detect-investigate-and-respond-to-threats/investigate-and-respond-to-cases/automation/engines/manage-engines.md): Manage engines and load balancing groups. - [Upgrade an engine](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/detect-investigate-and-respond-to-threats/investigate-and-respond-to-cases/automation/engines/upgrade-an-engine.md): Upgrade an engine on Cortex XDR or directly on the remote machine. - [Remove an engine](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/detect-investigate-and-respond-to-threats/investigate-and-respond-to-cases/automation/engines/remove-an-engine.md): Remove an engine by running the relevant command, depending on your operating system. - [Configure engines](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/detect-investigate-and-respond-to-threats/investigate-and-respond-to-cases/automation/engines/configure-engines.md): Configure Cortex XDR engines by editing the d1.conf file or modifying the configuration in the UI (for shell installations). - [Configure the engine to use a web proxy](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/detect-investigate-and-respond-to-threats/investigate-and-respond-to-cases/automation/engines/configure-engines/configure-the-engine-to-use-a-web-proxy.md): Configure an engine to connect through a web proxy. - [Configure the engine to call the server without using a proxy](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/detect-investigate-and-respond-to-threats/investigate-and-respond-to-cases/automation/engines/configure-engines/configure-the-engine-to-call-the-server-without-using-a-proxy.md): Configure an engine to connect directly without a proxy. - [Use NGINX as a reverse proxy](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/detect-investigate-and-respond-to-threats/investigate-and-respond-to-cases/automation/engines/configure-engines/use-nginx-as-a-reverse-proxy.md): Use NGINX as a reverse proxy for an engine. - [Configure an engine to use custom certificates](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/detect-investigate-and-respond-to-threats/investigate-and-respond-to-cases/automation/engines/configure-engines/configure-an-engine-to-use-custom-certificates.md): Configure custom certificates for a Cortex XDR engine. - [Use an engine in an integration](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/detect-investigate-and-respond-to-threats/investigate-and-respond-to-cases/automation/engines/use-an-engine-in-an-integration.md): Use an engine or a load-balancing group of engines to fetch issues and run commands for an integration. - [Run a script using an engine](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/detect-investigate-and-respond-to-threats/investigate-and-respond-to-cases/automation/engines/run-a-script-using-an-engine.md): Run a script on an engine or load-balancing group to distribute the workload and improve performance. - [Troubleshoot engines](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/detect-investigate-and-respond-to-threats/investigate-and-respond-to-cases/automation/engines/troubleshoot-engines.md): Troubleshoot engines by accessing logs and viewing errors. - [Troubleshoot integrations running on engines](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/detect-investigate-and-respond-to-threats/investigate-and-respond-to-cases/automation/engines/troubleshoot-integrations-running-on-engines.md): Troubleshoot integrations that run on Cortex XDR engines. - [Response actions](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/detect-investigate-and-respond-to-threats/investigate-and-respond-to-cases/response-actions.md): During the case investigation, various response actions are available. - [Initiate a Live Terminal session](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/detect-investigate-and-respond-to-threats/investigate-and-respond-to-cases/response-actions/initiate-a-live-terminal-session.md): Open a Live Terminal session on an endpoint. - [Isolate an endpoint](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/detect-investigate-and-respond-to-threats/investigate-and-respond-to-cases/response-actions/isolate-an-endpoint.md): Isolate an endpoint to contain potential threats. - [Pause endpoint protection](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/detect-investigate-and-respond-to-threats/investigate-and-respond-to-cases/response-actions/pause-endpoint-protection.md): Temporarily pause endpoint protection when required. - [Remediate changes from malicious activity](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/detect-investigate-and-respond-to-threats/investigate-and-respond-to-cases/response-actions/remediate-changes-from-malicious-activity.md): Remediate endpoint changes caused by malicious activity. - [Search and destroy malicious files](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/detect-investigate-and-respond-to-threats/investigate-and-respond-to-cases/response-actions/search-and-destroy-malicious-files.md): Locate and remove malicious files from endpoints. - [Manage external dynamic lists](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/detect-investigate-and-respond-to-threats/investigate-and-respond-to-cases/response-actions/manage-external-dynamic-lists.md): Create and manage external dynamic lists for enforcement. - [Collect a memory image](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/detect-investigate-and-respond-to-threats/investigate-and-respond-to-cases/response-actions/collect-a-memory-image.md): Collect an endpoint memory image for forensic analysis. - [Forensics](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/detect-investigate-and-respond-to-threats/investigate-and-respond-to-cases/forensics.md): Collect and analyze endpoint evidence during forensic investigations. - [Forensic investigations](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/detect-investigate-and-respond-to-threats/investigate-and-respond-to-cases/forensics/forensic-investigations.md): Start, manage, and review endpoint forensic investigations. - [Manage an investigation](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/detect-investigate-and-respond-to-threats/investigate-and-respond-to-cases/forensics/forensic-investigations/manage-an-investigation.md): Manage forensic investigations and their collected evidence. - [Create a new investigation](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/detect-investigate-and-respond-to-threats/investigate-and-respond-to-cases/forensics/forensic-investigations/manage-an-investigation/create-a-new-investigation.md): Create a forensic investigation, assign access, and start a data collection. - [Edit an investigation](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/detect-investigate-and-respond-to-threats/investigate-and-respond-to-cases/forensics/forensic-investigations/manage-an-investigation/edit-an-investigation.md): Update an active investigation's details and user access. - [Close an investigation](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/detect-investigate-and-respond-to-threats/investigate-and-respond-to-cases/forensics/forensic-investigations/manage-an-investigation/close-an-investigation.md): Close an investigation and manage its 24-hour grace period. - [User permissions](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/detect-investigate-and-respond-to-threats/investigate-and-respond-to-cases/forensics/forensic-investigations/manage-an-investigation/user-permissions.md): You can assign users to the investigation for them to view and manage the investigation. - [Data collection](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/detect-investigate-and-respond-to-threats/investigate-and-respond-to-cases/forensics/forensic-investigations/data-collection.md): Collect endpoint data for forensic investigation and analysis. - [Hunting](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/detect-investigate-and-respond-to-threats/investigate-and-respond-to-cases/forensics/forensic-investigations/data-collection/hunting.md): Hunt for evidence and suspicious activity in collected endpoint data. - [Triage](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/detect-investigate-and-respond-to-threats/investigate-and-respond-to-cases/forensics/forensic-investigations/data-collection/triage.md): Triage collected data to prioritize investigation findings. - [Configure collection](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/detect-investigate-and-respond-to-threats/investigate-and-respond-to-cases/forensics/forensic-investigations/data-collection/configure-collection.md): Configure the endpoint data collected for forensic investigations. - [Analysis and documentation](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/detect-investigate-and-respond-to-threats/investigate-and-respond-to-cases/forensics/forensic-investigations/analysis-and-documentation.md): Analyze findings and document the forensic investigation. - [Review alerts](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/detect-investigate-and-respond-to-threats/investigate-and-respond-to-cases/forensics/forensic-investigations/analysis-and-documentation/review-alerts.md): Review alerts related to the forensic investigation. - [Investigation timeline](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/detect-investigate-and-respond-to-threats/investigate-and-respond-to-cases/forensics/forensic-investigations/analysis-and-documentation/investigation-timeline.md): Review the timeline of events collected during an investigation. - [Key assets & artifacts](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/detect-investigate-and-respond-to-threats/investigate-and-respond-to-cases/forensics/forensic-investigations/analysis-and-documentation/key-assets-and-artifacts.md): Review key assets and artifacts identified during an investigation. - [Export](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/detect-investigate-and-respond-to-threats/investigate-and-respond-to-cases/forensics/forensic-investigations/export.md): Export forensic investigation findings and collected evidence. - [Build XQL queries](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/detect-investigate-and-respond-to-threats/investigate-and-respond-to-cases/build-xql-queries.md): Learn more about how to build Cortex Query Language (XQL) queries using the Query Builder. - [About the Query Builder](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/detect-investigate-and-respond-to-threats/investigate-and-respond-to-cases/build-xql-queries/about-the-query-builder.md): The Query Builder facilitates threat detection, case expansion, and data analytics for suspected threats. - [How to build XQL queries](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/detect-investigate-and-respond-to-threats/investigate-and-respond-to-cases/build-xql-queries/how-to-build-xql-queries.md): Learn more about how to build XQL queries in the Query Builder. - [Get started with XQL queries](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/detect-investigate-and-respond-to-threats/investigate-and-respond-to-cases/build-xql-queries/how-to-build-xql-queries/get-started-with-xql-queries.md): Get started writing and running XQL queries. - [Useful XQL user interface features](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/detect-investigate-and-respond-to-threats/investigate-and-respond-to-cases/build-xql-queries/how-to-build-xql-queries/useful-xql-user-interface-features.md): Use the query builder interface to create and run XQL queries. - [XQL Query best practices](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/detect-investigate-and-respond-to-threats/investigate-and-respond-to-cases/build-xql-queries/how-to-build-xql-queries/xql-query-best-practices.md): Apply recommended practices when writing XQL queries. - [Expected results when querying fields](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/detect-investigate-and-respond-to-threats/investigate-and-respond-to-cases/build-xql-queries/how-to-build-xql-queries/expected-results-when-querying-fields.md): Define the expected results before writing an XQL query. - [Create XQL query](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/detect-investigate-and-respond-to-threats/investigate-and-respond-to-cases/build-xql-queries/how-to-build-xql-queries/create-xql-query.md): Create an XQL query to search and analyze data. - [Review XQL query results](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/detect-investigate-and-respond-to-threats/investigate-and-respond-to-cases/build-xql-queries/how-to-build-xql-queries/review-xql-query-results.md): Review and refine the results returned by an XQL query. - [Translate to XQL](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/detect-investigate-and-respond-to-threats/investigate-and-respond-to-cases/build-xql-queries/how-to-build-xql-queries/translate-to-xql.md): Translate supported search queries into XQL syntax. - [Graph query results](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/detect-investigate-and-respond-to-threats/investigate-and-respond-to-cases/build-xql-queries/how-to-build-xql-queries/graph-query-results.md): Visualize XQL query results as a graph. - [XQL query entities](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/detect-investigate-and-respond-to-threats/investigate-and-respond-to-cases/build-xql-queries/legacy-query-builder.md): Learn more about the entities in the Legacy Query Builder. - [Create authentication query](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/detect-investigate-and-respond-to-threats/investigate-and-respond-to-cases/build-xql-queries/legacy-query-builder/create-authentication-query.md): Query authentication events with the XQL dataset. - [Create event log query](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/detect-investigate-and-respond-to-threats/investigate-and-respond-to-cases/build-xql-queries/legacy-query-builder/create-event-log-query.md): Query Windows event log data with XQL. - [Create file query](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/detect-investigate-and-respond-to-threats/investigate-and-respond-to-cases/build-xql-queries/legacy-query-builder/create-file-query.md): Query file activity data with XQL. - [Create image load query](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/detect-investigate-and-respond-to-threats/investigate-and-respond-to-cases/build-xql-queries/legacy-query-builder/create-image-load-query.md): Query image load events with XQL. - [Create network connections query](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/detect-investigate-and-respond-to-threats/investigate-and-respond-to-cases/build-xql-queries/legacy-query-builder/create-network-connections-query.md): Query network connection data with XQL. - [Create network query](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/detect-investigate-and-respond-to-threats/investigate-and-respond-to-cases/build-xql-queries/legacy-query-builder/create-network-query.md): Query network event data with XQL. - [Create process query](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/detect-investigate-and-respond-to-threats/investigate-and-respond-to-cases/build-xql-queries/legacy-query-builder/create-process-query.md): Query process activity data with XQL. - [Create registry query](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/detect-investigate-and-respond-to-threats/investigate-and-respond-to-cases/build-xql-queries/legacy-query-builder/create-registry-query.md): Query registry activity data with XQL. - [Query across all entities](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/detect-investigate-and-respond-to-threats/investigate-and-respond-to-cases/build-xql-queries/legacy-query-builder/query-across-all-entities.md): Query across multiple datasets with XQL. - [Overview of the Query Center](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/detect-investigate-and-respond-to-threats/investigate-and-respond-to-cases/build-xql-queries/overview-of-the-query-center.md): View information about the In Progress and Completed queries that that were run on the tenant. - [Edit and run queries in Query Center](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/detect-investigate-and-respond-to-threats/investigate-and-respond-to-cases/build-xql-queries/overview-of-the-query-center/edit-and-run-queries-in-query-center.md): Edit, test, and run XQL queries in the query builder. - [Query Center reference information](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/detect-investigate-and-respond-to-threats/investigate-and-respond-to-cases/build-xql-queries/overview-of-the-query-center/query-center-reference-information.md): Reference XQL query syntax, functions, and commands. - [Manage scheduled queries](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/detect-investigate-and-respond-to-threats/investigate-and-respond-to-cases/build-xql-queries/manage-scheduled-queries.md): Learn how to manage your scheduled and recurring queries. - [Scheduled Queries reference information](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/detect-investigate-and-respond-to-threats/investigate-and-respond-to-cases/build-xql-queries/manage-scheduled-queries/scheduled-queries-reference-information.md): Reference fields and settings for scheduled XQL queries. - [Manage your personal query library](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/detect-investigate-and-respond-to-threats/investigate-and-respond-to-cases/build-xql-queries/manage-your-personal-query-library.md): Cortex XDR provides as part of the Query Library a personal library for saving and managing your own queries. - [XQL macros](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/detect-investigate-and-respond-to-threats/investigate-and-respond-to-cases/build-xql-queries/xql-macros.md): Create reusable XQL logic with query macros. - [Manage your macros](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/detect-investigate-and-respond-to-threats/investigate-and-respond-to-cases/build-xql-queries/manage-your-macros.md): Create, edit, and manage XQL query macros. - [Quick Launcher](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/detect-investigate-and-respond-to-threats/investigate-and-respond-to-cases/quick-launcher.md): The Quick Launcher provides a quick, in-context shortcut that you can use to search for information, perform common investigation tasks, or initiate actions. - [Research a known threat](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/detect-investigate-and-respond-to-threats/investigate-and-respond-to-cases/research-a-known-threat.md): Cortex XDR enables you to investigate any threat, also referred to as a lead, which has been detected. - [Agentic Assistant chat](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/detect-investigate-and-respond-to-threats/agentic-assistant-chat.md): Chat with the Cortex Agentic Assistant using natural language prompts. - [Get started with Agentic Assistant chat](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/detect-investigate-and-respond-to-threats/agentic-assistant-chat/get-started-with-agentic-assistant-chat.md): Enable Agentic Assistant and access the chat interface. - [Choose an Agentic Assistant agent](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/detect-investigate-and-respond-to-threats/agentic-assistant-chat/choose-an-agentic-assistant-agent.md): Choose a system or custom agent for your chat. - [Chat with an Agentic Assistant agent](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/detect-investigate-and-respond-to-threats/agentic-assistant-chat/chat-with-an-agentic-assistant-agent.md): Tips for chatting with the Cortex Agentic Assistant - [Chat with the Agentic Assistant from Slack](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/detect-investigate-and-respond-to-threats/agentic-assistant-chat/chat-with-the-agentic-assistant-from-slack.md): Enable chatting with an Agentic Assistant agent from Slack. - [Create and run XQL queries with Agentic Assistant chat](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/detect-investigate-and-respond-to-threats/agentic-assistant-chat/create-and-run-xql-queries-with-agentic-assistant-chat.md): Interact with Cortex Agentic Assistant agents to build and run XQL queries. - [Use natural language to query and visualize your data](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/detect-investigate-and-respond-to-threats/agentic-assistant-chat/use-natural-language-to-query-and-visualize-your-data.md): Prompt Cortex Agentic Assistant agents to create graphs and charts from its findings. - [Manage chat history](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/detect-investigate-and-respond-to-threats/agentic-assistant-chat/manage-chat-history.md): Manage and navigate your past chats with the Cortex Agentic Assistant. - [Streamline troubleshooting and support with the Help Center agent](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/detect-investigate-and-respond-to-threats/agentic-assistant-chat/streamline-troubleshooting-and-support-with-the-help-center-agent.md) - [Help Center agent actions](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/detect-investigate-and-respond-to-threats/agentic-assistant-chat/streamline-troubleshooting-and-support-with-the-help-center-agent/help-center-agent-actions.md) - [Threat management](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/detect-investigate-and-respond-to-threats/threat-management.md): Detect, investigate, and respond to threats across your environment. - [Extended Threat Intelligence](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/detect-investigate-and-respond-to-threats/threat-management/extended-threat-intelligence.md): Research threats, investigate indicators, and apply intelligence across Cortex XDR workflows. - [XTI Threat Intel Library](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/detect-investigate-and-respond-to-threats/threat-management/extended-threat-intelligence/xti-threat-intel-library.md): Research curated threat actors, malware families, vulnerabilities, and reports from Unit 42. - [XTI Indicators](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/detect-investigate-and-respond-to-threats/threat-management/extended-threat-intelligence/xti-indicators.md): Investigate, manage, and enrich threat indicators, including domains, IP addresses, URLs, and file hashes. - [Threat intel context in cases and issues](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/detect-investigate-and-respond-to-threats/threat-management/extended-threat-intelligence/threat-intel-context-in-cases-and-issues.md): Analyze indicator intelligence and Behavioral Threat Analysis (BTA) findings in cases and issues. - [XTI indicator rules](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/detect-investigate-and-respond-to-threats/threat-management/extended-threat-intelligence/xti-indicator-rules.md): Create rules that detect known threat indicators and generate issues from matching data. - [Threat intel investigation through XQL](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/detect-investigate-and-respond-to-threats/threat-management/extended-threat-intelligence/threat-intel-investigation-through-xql.md): Query XTI indicators, threat objects, and their relationships using Cortex Query Language. - [Threat Intel Dashboard](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/detect-investigate-and-respond-to-threats/threat-management/extended-threat-intelligence/threat-intel-dashboard.md): Visualize threat intelligence data to monitor distribution, ingestion health, and emerging trends. - [Using XTI with Threat Intel Agent](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/detect-investigate-and-respond-to-threats/threat-management/extended-threat-intelligence/using-xti-with-threat-intel-agent.md): Use the Threat Intel Agent to list, enrich, and update XTI indicators. - [Using XTI in playbooks](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/detect-investigate-and-respond-to-threats/threat-management/extended-threat-intelligence/using-xti-in-playbooks.md): Automate XTI indicator triage, enrichment, and response with supported playbook commands. - [Detection rules](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/detect-investigate-and-respond-to-threats/threat-management/detection-rules.md): Create and manage rules that detect suspicious activity. - [What's an IOC?](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/detect-investigate-and-respond-to-threats/threat-management/detection-rules/whats-an-ioc.md): Learn how indicators of compromise identify known threats. - [IOC rule details](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/detect-investigate-and-respond-to-threats/threat-management/detection-rules/whats-an-ioc/ioc-rule-details.md): Review available fields and settings for IOC rules. - [Create an IOC rule](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/detect-investigate-and-respond-to-threats/threat-management/detection-rules/whats-an-ioc/create-an-ioc-rule.md): Create an IOC rule to detect and respond to known threats. - [What's a BIOC?](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/detect-investigate-and-respond-to-threats/threat-management/detection-rules/whats-a-bioc.md): Learn how behavioral indicators of compromise detect suspicious behavior. - [BIOC rule details](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/detect-investigate-and-respond-to-threats/threat-management/detection-rules/whats-a-bioc/bioc-rule-details.md): Review available fields and settings for BIOC rules. - [Create a BIOC rule](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/detect-investigate-and-respond-to-threats/threat-management/detection-rules/whats-a-bioc/create-a-bioc-rule.md): Create a BIOC rule to detect suspicious behavior. - [Manage Global BIOC Rules](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/detect-investigate-and-respond-to-threats/threat-management/detection-rules/whats-a-bioc/manage-global-bioc-rules.md): Manage Global BIOC rules across your organization. - [What's a correlation rule?](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/detect-investigate-and-respond-to-threats/threat-management/detection-rules/whats-a-correlation-rule.md): Learn how correlation rules connect related security events. - [Correlation rule details](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/detect-investigate-and-respond-to-threats/threat-management/detection-rules/whats-a-correlation-rule/correlation-rule-details.md): Reference correlation rule fields, settings, and behavior. - [Create a correlation rule](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/detect-investigate-and-respond-to-threats/threat-management/detection-rules/whats-a-correlation-rule/create-a-correlation-rule.md): Create a correlation rule to detect related security events. - [Field replacement syntax in correlation rules](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/detect-investigate-and-respond-to-threats/threat-management/detection-rules/whats-a-correlation-rule/field-replacement-syntax-in-correlation-rules.md): Use field replacement syntax in correlation rule definitions. - [Manage correlation rules](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/detect-investigate-and-respond-to-threats/threat-management/detection-rules/whats-a-correlation-rule/manage-correlation-rules.md): Create, edit, and manage correlation rules. - [Monitor correlation rules](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/detect-investigate-and-respond-to-threats/threat-management/detection-rules/whats-a-correlation-rule/monitor-correlation-rules.md): Monitor correlation rule execution and status. - [Troubleshoot server errors in scheduled correlation rules](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/detect-investigate-and-respond-to-threats/threat-management/detection-rules/whats-a-correlation-rule/troubleshoot-server-errors-in-scheduled-correlation-rules.md): Resolve server errors in scheduled correlation rules. - [Manage IOC and BIOC rules](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/detect-investigate-and-respond-to-threats/threat-management/detection-rules/manage-ioc-and-bioc-rules.md): Manage IOC and BIOC rules in Cortex XDR. - [Analytics](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/detect-investigate-and-respond-to-threats/threat-management/analytics.md): Use analytics to detect threats from correlated endpoint activity. - [Analytics overview](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/detect-investigate-and-respond-to-threats/threat-management/analytics/analytics-overview.md): Understand Cortex XDR analytics and their threat detection coverage. - [Analytics engine](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/detect-investigate-and-respond-to-threats/threat-management/analytics/analytics-engine.md): Learn how the analytics engine detects suspicious activity. - [Analytics sensors](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/detect-investigate-and-respond-to-threats/threat-management/analytics/analytics-sensors.md): Learn about analytics sensors and the data they analyze. - [Coverage of MITRE Attack tactics](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/detect-investigate-and-respond-to-threats/threat-management/analytics/coverage-of-mitre-attack-tactics.md): Review analytics coverage aligned with the MITRE ATT\&CK framework. - [Review MITRE ATT\&CK framework coverage](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/detect-investigate-and-respond-to-threats/threat-management/analytics/review-mitre-att-and-ck-framework-coverage.md): Review analytics rules mapped to MITRE ATT\&CK techniques. - [Analytics detection time intervals](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/detect-investigate-and-respond-to-threats/threat-management/analytics/analytics-detection-time-intervals.md): Understand analytics time intervals and their effect on detection. - [Analytics issues and Analytics BIOCs](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/detect-investigate-and-respond-to-threats/threat-management/analytics/analytics-issues-and-analytics-biocs.md): Resolve analytics issues related to BIOC rules. - [View and manage Analytics rules](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/detect-investigate-and-respond-to-threats/threat-management/analytics/view-and-manage-analytics-rules.md): View and manage analytics rules and their detection settings. - [AI Detection & Response in Cortex XDR](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/detect-investigate-and-respond-to-threats/threat-management/analytics/ai-detection-and-response-in-cortex-xdr.md): Use AI-driven detection and response to investigate potential threats. - [Data sources and supported services](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/detect-investigate-and-respond-to-threats/threat-management/analytics/ai-detection-and-response-in-cortex-xdr/data-sources-and-supported-services.md): Configure data sources for AI-driven detection and response. - [Collect prompt logs](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/detect-investigate-and-respond-to-threats/threat-management/analytics/ai-detection-and-response-in-cortex-xdr/collect-prompt-logs.md): Collect prompt logs for AI-driven detection and response. - [Prompt log collection in AWS](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/detect-investigate-and-respond-to-threats/threat-management/analytics/ai-detection-and-response-in-cortex-xdr/collect-prompt-logs/prompt-log-collection-in-aws.md): Configure AWS prompt logging for AI-driven detection and response. - [Enable prompt log collection in Azure](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/detect-investigate-and-respond-to-threats/threat-management/analytics/ai-detection-and-response-in-cortex-xdr/collect-prompt-logs/enable-prompt-log-collection-in-azure.md): Enable Azure data collection for AI-driven detection and response. - [Configure the Azure Event Hub collection in Cortex XSIAM](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/detect-investigate-and-respond-to-threats/threat-management/analytics/ai-detection-and-response-in-cortex-xdr/collect-prompt-logs/enable-prompt-log-collection-in-azure/configure-the-azure-event-hub-collection-in-cortex-xsiam.md): Configure an Azure Event Hub to collect prompt logging data. - [Set up prompt logging](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/detect-investigate-and-respond-to-threats/threat-management/analytics/ai-detection-and-response-in-cortex-xdr/collect-prompt-logs/enable-prompt-log-collection-in-azure/set-up-prompt-logging.md): Set up prompt logging to collect AI activity data. - [Log HTTP data](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/detect-investigate-and-respond-to-threats/threat-management/analytics/ai-detection-and-response-in-cortex-xdr/collect-prompt-logs/enable-prompt-log-collection-in-azure/log-http-data.md): Log HTTP data for AI-driven detection and response. - [Configure diagnostic settings](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/detect-investigate-and-respond-to-threats/threat-management/analytics/ai-detection-and-response-in-cortex-xdr/collect-prompt-logs/enable-prompt-log-collection-in-azure/configure-diagnostic-settings.md): Configure diagnostic settings for AI activity data collection. - [Attack surface management](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/detect-investigate-and-respond-to-threats/attack-surface-management.md): Learn how to discover, monitor, and remediate external asset exposures with attack surface management. - [Learn about Attack Surface Management](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/detect-investigate-and-respond-to-threats/attack-surface-management/get-started-with-attack-surface-management.md): Learn about Cortex XDR Attack Surface Management capabilities for finding, prioritizing, and remediating external asset exposures. - [Network mapping](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/detect-investigate-and-respond-to-threats/attack-surface-management/get-started-with-attack-surface-management/network-mapping.md): Learn how Cortex XDR discovers, attributes, and validates internet-facing assets to map your public attack surface. - [Scanning](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/detect-investigate-and-respond-to-threats/attack-surface-management/get-started-with-attack-surface-management/scanning.md): Learn how Cortex XDR ASM scans internet-facing assets, monitors known assets, and identifies exposed services. - [GeoIP data collection](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/detect-investigate-and-respond-to-threats/attack-surface-management/get-started-with-attack-surface-management/geoip-data-collection.md): Use GeoIP data to validate network distribution, identify location-based compliance risks, and route remediation efforts. - [Attack Surface Management detections](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/detect-investigate-and-respond-to-threats/attack-surface-management/attack-surface-management-detections.md): Review attack surface management detections and their details. - [Attack surface rules](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/detect-investigate-and-respond-to-threats/attack-surface-management/attack-surface-management-detections/attack-surface-rules.md): Create and manage attack surface management rules. - [Attack Surface Testing](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/detect-investigate-and-respond-to-threats/attack-surface-management/attack-surface-management-detections/attack-surface-testing.md): Test attack surface management rules before deployment. - [Externally inferred CVEs](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/detect-investigate-and-respond-to-threats/attack-surface-management/attack-surface-management-detections/externally-inferred-cves.md): Review externally inferred CVEs affecting your attack surface. - [Digital Risk Protection](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/detect-investigate-and-respond-to-threats/attack-surface-management/attack-surface-management-detections/digital-risk-protection.md): Monitor digital risk protection findings and related threats. - [Attack surface assets](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/detect-investigate-and-respond-to-threats/attack-surface-management/attack-surface-assets.md): The assets discovered in an attack surface management scan are called External Surface assets. - [Deploy ASM and Exposure Management enrichment and remediation automation](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/detect-investigate-and-respond-to-threats/attack-surface-management/deploy-asm-and-exposure-management-enrichment-and-remediation-automation.md): Enable the Cortex Exposure Management playbooks to automate ASM and vulnerability issue enrichment and remediation. - [ASM enrichment of cloud assets](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/detect-investigate-and-respond-to-threats/attack-surface-management/asm-enrichment-of-cloud-assets.md): ASM enrichment of cloud assets provides visibility into all the assets in your cloud infrastructure that are exposed to the internet. - [Emerging Vulnerabilities](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/detect-investigate-and-respond-to-threats/attack-surface-management/emerging-vulnerabilities.md): Identify external exposures linked to emerging vulnerabilities, zero-day exploits, and global threat events on the Emerging Vulnerabilities page. - [Global Lookup](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/detect-investigate-and-respond-to-threats/attack-surface-management/global-lookup.md): Search global intelligence for indicators and related context. - [Monitor and track compliance adherence](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/detect-investigate-and-respond-to-threats/monitor-and-track-compliance-adherence.md): Evaluate and track asset compliance against industry standards and organizational policies. - [Choose compliance standards from the compliance catalog](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/detect-investigate-and-respond-to-threats/monitor-and-track-compliance-adherence/choose-compliance-standards-from-the-compliance-catalog.md): Select built-in or custom compliance standards and controls from the compliance catalogs. - [Standards catalog](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/detect-investigate-and-respond-to-threats/monitor-and-track-compliance-adherence/choose-compliance-standards-from-the-compliance-catalog/standards-catalog.md): Browse available compliance standards. - [Use a built-in or custom standard](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/detect-investigate-and-respond-to-threats/monitor-and-track-compliance-adherence/choose-compliance-standards-from-the-compliance-catalog/use-a-built-in-or-custom-standard.md): Use built-in standards or create and edit custom standards for your organization. - [Use a built-in or custom control](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/detect-investigate-and-respond-to-threats/monitor-and-track-compliance-adherence/choose-compliance-standards-from-the-compliance-catalog/use-a-built-in-or-custom-control.md): Add built-in controls or create and manage custom controls for custom standards. - [Create a new custom detection rule](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/detect-investigate-and-respond-to-threats/monitor-and-track-compliance-adherence/choose-compliance-standards-from-the-compliance-catalog/create-a-new-custom-detection-rule.md): Create custom detection rules to enforce compliance requirements and security best practices. - [Use an assessment profile to run compliance checks on your assets](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/detect-investigate-and-respond-to-threats/monitor-and-track-compliance-adherence/use-an-assessment-profile-to-run-compliance-checks-on-your-assets.md): Create assessment profiles to evaluate selected asset groups against compliance standards. - [View and manage compliance assessments and reports](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/detect-investigate-and-respond-to-threats/monitor-and-track-compliance-adherence/view-and-manage-compliance-assessments-and-reports.md): Review assessment results and generate or schedule downloadable compliance reports. - [Review compliance assessments](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/detect-investigate-and-respond-to-threats/monitor-and-track-compliance-adherence/view-and-manage-compliance-assessments-and-reports/assessments.md): View assessment results and drill into control, rule, and asset compliance details. - [Review compliance reports](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/detect-investigate-and-respond-to-threats/monitor-and-track-compliance-adherence/view-and-manage-compliance-assessments-and-reports/reports.md): View, export, and manage historical compliance assessment reports. - [Compliance Overview Dashboard](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/detect-investigate-and-respond-to-threats/monitor-and-track-compliance-adherence/compliance-overview-dashboard.md): Monitor organization-wide compliance scores, standards, failed controls, and asset group performance. - [Exposure management](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/detect-investigate-and-respond-to-threats/exposure-management.md): Identify and prioritize security exposures across your environment. - [Exposure Management](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/detect-investigate-and-respond-to-threats/exposure-management/exposure-management.md): Consolidate, prioritize, and remediate exposures across Palo Alto Networks and third-party data sources. - [Get started with Exposure Management](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/detect-investigate-and-respond-to-threats/exposure-management/get-started-with-exposure-management.md): Set up Exposure Management by configuring scanners, integrations, policies, security controls, and automation. - [Ingest assets and vulnerabilities from third-party applications](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/detect-investigate-and-respond-to-threats/exposure-management/ingest-assets-and-vulnerabilities-from-third-party-applications.md): Ingest assets and vulnerabilities into Cortex Exposure Management from Palo Alto Networks sensors and third-party applications. - [Security controls](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/detect-investigate-and-respond-to-threats/exposure-management/security-controls.md): Detect, create, and manage security controls to assess compensating-control effectiveness and residual risk. - [Cortex Network Scanner](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/detect-investigate-and-respond-to-threats/exposure-management/cortex-network-scanner.md): Use Cortex Network Scanner to identify network exposures. - [Exposure Management Command Center](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/detect-investigate-and-respond-to-threats/exposure-management/exposure-management-command-center.md): Use the Exposure Management Command Center to prioritize exposures. - [Vulnerability management](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/detect-investigate-and-respond-to-threats/vulnerability-management.md): Learn how to identify, prioritize, and remediate vulnerabilities across your environment. - [Vulnerability management in Cortex XDR](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/detect-investigate-and-respond-to-threats/vulnerability-management/vulnerability-management-in-cortex-xdr.md): Vulnerability management helps you identify, assess, prioritize, and remediate security vulnerabilities across your entire IT infrastructure, including endpoints, code, and cloud. - [Cortex Vulnerability Risk Score](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/detect-investigate-and-respond-to-threats/vulnerability-management/cortex-vulnerability-risk-score.md): Learn how Cortex Vulnerability Risk Score prioritizes vulnerabilities using asset context and threat intelligence. - [Vulnerability policies](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/detect-investigate-and-respond-to-threats/vulnerability-management/vulnerability-policies.md): A vulnerability policy defines the action you want to take for a specific set of vulnerability findings. - [Investigate and remediate vulnerabilities](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/detect-investigate-and-respond-to-threats/vulnerability-management/investigate-and-remediate-vulnerabilities.md): Learn how to investigate vulnerability issues, findings, and affected assets, then track remediation. - [Vulnerability Intelligence](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/detect-investigate-and-respond-to-threats/vulnerability-management/vulnerability-intelligence.md): Vulnerability Intelligence is an in-product, real-time feed that provides vulnerability data and threat intelligence from a variety of certified upstream sources. - [Recast CVSS scores and CVSS severities](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/detect-investigate-and-respond-to-threats/vulnerability-management/recast-cvss-scores-and-cvss-severities.md): Customize CVSS scores and CVSS severities in the platform to align your risk management approach with your organizational context and priorities. - [Cortex Advanced Email Security](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/detect-investigate-and-respond-to-threats/cortex-advanced-email-security.md): Configure, monitor, and respond to email security threats. - [Cortex Advanced Email Security module overview](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/detect-investigate-and-respond-to-threats/cortex-advanced-email-security/cortex-advanced-email-security-module-overview.md): Learn how to onboard, configure, and operate the Email Security module. - [Cortex Advanced Email Security module architecture and data flow](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/detect-investigate-and-respond-to-threats/cortex-advanced-email-security/cortex-advanced-email-security-module-architecture-and-data-flow.md): The Cortex Advanced Email Security module, a cloud-native system, integrates multiple components to ingest, analyze, and respond to email-borne threats effectively. - [Getting started with the Cortex Advanced Email Security module](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/detect-investigate-and-respond-to-threats/cortex-advanced-email-security/getting-started-with-the-cortex-advanced-email-security-module.md): High level deployment workflow - [Deploy and configure the Email Security module](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/detect-investigate-and-respond-to-threats/cortex-advanced-email-security/deploy-and-configure-the-email-security-module.md): Configure the Microsoft O365 integration and the module. - [Cortex Advanced Email Security threat detection and issues](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/detect-investigate-and-respond-to-threats/cortex-advanced-email-security/cortex-advanced-email-security-threat-detection-and-issues.md): The Cortex Advanced Email Security module uses artifact-based, metadata-driven, and LLM-powered engines to generate detections and insights. - [Email Security Analytics Rules](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/detect-investigate-and-respond-to-threats/cortex-advanced-email-security/cortex-advanced-email-security-threat-detection-and-issues/email-security-analytics-rules.md): Manage analytics rules for Email Security detections. - [Investigate and respond to email security issues](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/detect-investigate-and-respond-to-threats/cortex-advanced-email-security/investigate-and-respond-to-email-security-issues.md): Investigate the issues generated by the Cortex Advanced Email Security module. - [Automate remediation for the Cortex Advanced Email Security module](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/detect-investigate-and-respond-to-threats/cortex-advanced-email-security/automate-remediation-for-the-cortex-advanced-email-security-module.md): Automated response actions through the Cortex Advanced Email Security module improve efficiency and reduce noise. - [Email Remediation Response Rules](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/detect-investigate-and-respond-to-threats/cortex-advanced-email-security/automate-remediation-for-the-cortex-advanced-email-security-module/email-remediation-response-rules.md): Manage Email Security response rules for remediation. - [Email Security Remediation Action Center](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/detect-investigate-and-respond-to-threats/cortex-advanced-email-security/automate-remediation-for-the-cortex-advanced-email-security-module/email-security-remediation-action-center.md): Use the Email Security Remediation Action Center to manage actions. - [Email Command Center](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/detect-investigate-and-respond-to-threats/cortex-advanced-email-security/email-command-center.md): View a dynamic overview of your email security status in the Email Command Center. - [Malicious Email Inventory](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/detect-investigate-and-respond-to-threats/cortex-advanced-email-security/malicious-email-inventory.md): Triage, analyze, and act on malicious email threats - [Mailbox Inventory](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/detect-investigate-and-respond-to-threats/cortex-advanced-email-security/mailbox-inventory.md): View and manage your active email security assets - [Advanced Email Security module security and compliance](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/detect-investigate-and-respond-to-threats/cortex-advanced-email-security/advanced-email-security-module-security-and-compliance.md): Configure security and compliance for the Advanced Email Security module. - [Identity Threat Detection and Response (ITDR)](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/detect-investigate-and-respond-to-threats/identity-threat-module-itdr.md): Detect, investigate, and respond to identity-based threats. - [Get started with ITDR](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/detect-investigate-and-respond-to-threats/identity-threat-module-itdr/get-started-with-itdr.md): Get started with Identity Threat Detection and Response. - [Manage role based access control (RBAC) in ITDR](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/detect-investigate-and-respond-to-threats/identity-threat-module-itdr/manage-role-based-access-control-rbac-in-itdr.md): Configure ITDR permissions with role-based access control. - [Monitor user risk exposure](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/detect-investigate-and-respond-to-threats/identity-threat-module-itdr/monitor-user-risk-exposure.md): Monitor user risk and prioritize potential threats. - [Investigate user risk](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/detect-investigate-and-respond-to-threats/identity-threat-module-itdr/investigate-user-risk.md): Investigate user risks and related security activity. - [Manage user asset roles](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/detect-investigate-and-respond-to-threats/identity-threat-module-itdr/asset-roles.md): Manage roles assigned to user assets. - [Improve Active Directory posture with AD-SPM](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/detect-investigate-and-respond-to-threats/identity-threat-module-itdr/active-directory-security-posture-management.md): Improve Active Directory security posture with AD-SPM. - [Enforce dynamic access control with CAP](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/detect-investigate-and-respond-to-threats/identity-threat-module-itdr/conditional-access-policy.md): Enforce risk-based access control with Conditional Access Policies. - [Prevent malicious LDAP queries](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/detect-investigate-and-respond-to-threats/identity-threat-module-itdr/prevent-malicious-ldap-queries.md): Prevent malicious LDAP queries that target identity infrastructure. - [Cortex XDR XQL](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/reference-and-developer-docs/cortex-xdr-xql.md): Explore XQL language documentation, query guidance, and reference material. - [Get started with XQL](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/reference-and-developer-docs/cortex-xdr-xql/get-started-with-xql.md): XQL is the Palo Alto Networks Cortex Query Language used in Cortex XDR. - [XQL language features](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/reference-and-developer-docs/cortex-xdr-xql/get-started-with-xql/xql-language-features.md): Learn more about the Cortex Query Language features to query for raw network and endpoint data. - [XQL Language Structure](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/reference-and-developer-docs/cortex-xdr-xql/get-started-with-xql/xql-language-structure.md): Learn more about the Cortex Query Language structure when creating a query. - [Supported operators](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/reference-and-developer-docs/cortex-xdr-xql/get-started-with-xql/supported-operators.md): Cortex Query Language supports specific comparison, boolean, and set operators in Cortex XDR. - [Datasets and presets](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/reference-and-developer-docs/cortex-xdr-xql/get-started-with-xql/datasets-and-presets.md): The Cortex Query Language supports built-in datasets, custom datasets, and presets. - [About examples](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/reference-and-developer-docs/cortex-xdr-xql/get-started-with-xql/about-examples.md): Learn more about the Cortex Query Language (XQL) examples provided. - [JSON functions](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/reference-and-developer-docs/cortex-xdr-xql/get-started-with-xql/json-functions.md): Learn more about how Cortex XDR treats JSON functions in the Cortex Query Language. - [How to filter for empty values in the results table](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/reference-and-developer-docs/cortex-xdr-xql/get-started-with-xql/how-to-filter-for-empty-values-in-the-results-table.md): Learn how to filter for empty values in the results table in Cortex Query Language. - [Understanding string manipulation in XQL](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/reference-and-developer-docs/cortex-xdr-xql/get-started-with-xql/understanding-string-manipulation-in-xql.md): Learn more about string manipulation in Cortex Query Language (XQL) using double and triple quotes. - [Build XQL queries](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/reference-and-developer-docs/cortex-xdr-xql/build-xql-queries.md): Learn more about how to build Cortex Query Language (XQL) queries using the Query Builder. - [About the Query Builder](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/reference-and-developer-docs/cortex-xdr-xql/build-xql-queries/about-the-query-builder.md): The Query Builder facilitates threat detection, case expansion, and data analytics for suspected threats. - [How to build XQL queries](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/reference-and-developer-docs/cortex-xdr-xql/build-xql-queries/how-to-build-xql-queries.md): Learn more about how to build XQL queries in the Query Builder. - [Get started with XQL queries](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/reference-and-developer-docs/cortex-xdr-xql/build-xql-queries/how-to-build-xql-queries/get-started-with-xql-queries.md): Get started writing and running XQL queries. - [Useful XQL user interface features](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/reference-and-developer-docs/cortex-xdr-xql/build-xql-queries/how-to-build-xql-queries/useful-xql-user-interface-features.md): Use Query Builder features to create and run XQL queries. - [XQL Query best practices](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/reference-and-developer-docs/cortex-xdr-xql/build-xql-queries/how-to-build-xql-queries/xql-query-best-practices.md): Apply recommended practices when writing XQL queries. - [Expected results when querying fields](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/reference-and-developer-docs/cortex-xdr-xql/build-xql-queries/how-to-build-xql-queries/expected-results-when-querying-fields.md): Define expected results before writing an XQL query. - [Create XQL query](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/reference-and-developer-docs/cortex-xdr-xql/build-xql-queries/how-to-build-xql-queries/create-xql-query.md): Create an XQL query to search and analyze data. - [Review XQL query results](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/reference-and-developer-docs/cortex-xdr-xql/build-xql-queries/how-to-build-xql-queries/review-xql-query-results.md): Review and refine the results returned by an XQL query. - [Translate to XQL](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/reference-and-developer-docs/cortex-xdr-xql/build-xql-queries/how-to-build-xql-queries/translate-to-xql.md): Translate supported search queries into XQL syntax. - [Graph query results](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/reference-and-developer-docs/cortex-xdr-xql/build-xql-queries/how-to-build-xql-queries/graph-query-results.md): Visualize XQL query results as a graph. - [XQL query entities](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/reference-and-developer-docs/cortex-xdr-xql/build-xql-queries/legacy-query-builder.md): Learn more about the entities in the Legacy Query Builder. - [Create authentication query](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/reference-and-developer-docs/cortex-xdr-xql/build-xql-queries/legacy-query-builder/create-authentication-query.md): Query authentication events with XQL. - [Create event log query](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/reference-and-developer-docs/cortex-xdr-xql/build-xql-queries/legacy-query-builder/create-event-log-query.md): Query Windows event log data with XQL. - [Create file query](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/reference-and-developer-docs/cortex-xdr-xql/build-xql-queries/legacy-query-builder/create-file-query.md): Query file activity data with XQL. - [Create image load query](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/reference-and-developer-docs/cortex-xdr-xql/build-xql-queries/legacy-query-builder/create-image-load-query.md): Query image load events with XQL. - [Create network connections query](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/reference-and-developer-docs/cortex-xdr-xql/build-xql-queries/legacy-query-builder/create-network-connections-query.md): Query network connection data with XQL. - [Create network query](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/reference-and-developer-docs/cortex-xdr-xql/build-xql-queries/legacy-query-builder/create-network-query.md): Query network event data with XQL. - [Create process query](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/reference-and-developer-docs/cortex-xdr-xql/build-xql-queries/legacy-query-builder/create-process-query.md): Query process activity data with XQL. - [Create registry query](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/reference-and-developer-docs/cortex-xdr-xql/build-xql-queries/legacy-query-builder/create-registry-query.md): Query registry activity data with XQL. - [Query across all entities](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/reference-and-developer-docs/cortex-xdr-xql/build-xql-queries/legacy-query-builder/query-across-all-entities.md): Query across multiple datasets with XQL. - [Overview of the Query Center](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/reference-and-developer-docs/cortex-xdr-xql/build-xql-queries/overview-of-the-query-center.md): View information about the In Progress and Completed queries that that were run on the tenant. - [Edit and run queries in Query Center](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/reference-and-developer-docs/cortex-xdr-xql/build-xql-queries/overview-of-the-query-center/edit-and-run-queries-in-query-center.md): Edit, test, and run XQL queries in Query Center. - [Query Center reference information](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/reference-and-developer-docs/cortex-xdr-xql/build-xql-queries/overview-of-the-query-center/query-center-reference-information.md): Reference XQL query syntax, functions, and commands. - [Manage scheduled queries](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/reference-and-developer-docs/cortex-xdr-xql/build-xql-queries/manage-scheduled-queries.md): Learn how to manage your scheduled and recurring queries. - [Scheduled Queries reference information](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/reference-and-developer-docs/cortex-xdr-xql/build-xql-queries/manage-scheduled-queries/scheduled-queries-reference-information.md): Reference fields and settings for scheduled XQL queries. - [Manage your personal query library](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/reference-and-developer-docs/cortex-xdr-xql/build-xql-queries/manage-your-personal-query-library.md): Cortex XDR provides as part of the Query Library a personal library for saving and managing your own queries. - [XQL macros](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/reference-and-developer-docs/cortex-xdr-xql/build-xql-queries/xql-macros.md): Create reusable XQL logic with query macros. - [Manage your macros](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/reference-and-developer-docs/cortex-xdr-xql/build-xql-queries/manage-your-macros.md): Create, edit, and manage XQL query macros. - [Cortex XQL syntax, parameters, and examples](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/reference-and-developer-docs/cortex-xdr-xql/cortex-xql-syntax-parameters-and-examples.md): Comprehensive syntax rules and structural requirements for XQL queries - [Graph Search](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/reference-and-developer-docs/graph-search.md): Learn more about Graph Search in Cortex XDR. - [What is Graph Search?](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/reference-and-developer-docs/graph-search/what-is-graph-search.md): Learn more about how to use Graph Search to search assets, findings, and their contextual data. - [Get started with Graph Search queries](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/reference-and-developer-docs/graph-search/get-started-with-graph-search-queries.md): Learn more about how to get started before building a Graph Search query. - [How to build Graph Search queries?](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/reference-and-developer-docs/graph-search/how-to-build-graph-search-queries.md): Learn more about building Graph Search queries using the built-in query interface. - [Understand Graph Search query results](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/reference-and-developer-docs/graph-search/understand-graph-search-query-results.md): Learn more about the Graph Search query results. - [Create Graph Search query](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/reference-and-developer-docs/graph-search/create-graph-search-query.md): Learn how to create Graph Search queries in Cortex XDR. - [Graph Search examples](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/reference-and-developer-docs/graph-search/graph-search-examples.md): Learn how to build Graph Search queries by working through a few examples. - [Manage the Graph Search Query Library](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/reference-and-developer-docs/graph-search/manage-the-graph-search-query-library.md): Learn more about the Cortex XDR Graph Search Query Library to manage your queries. - [Edit and run queries in Query Center](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/reference-and-developer-docs/graph-search/edit-and-run-queries-in-query-center.md): Learn more about viewing the results of a query, modifying a query, and rerunning queries from Query Center. - [Supported assets and findings](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/reference-and-developer-docs/graph-search/supported-assets-and-findings.md): Review assets and findings supported by Graph Search. - [FAQ on Graph Search](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/reference-and-developer-docs/graph-search/faq-on-graph-search.md): Answer some frequently asked questions relating to Graph Search. - [Create detection rules based on graph search](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/reference-and-developer-docs/graph-search/create-detection-rules-based-on-graph-search.md): Create detection rules from Graph Search query results. - [Cortex XDR API Reference](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/reference-and-developer-docs/cortex-xdr-api-reference.md): Reference Cortex XDR API endpoints, requests, and responses. - [Role-Based Access Control](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/reference-and-developer-docs/role-based-access-control.md): Learn how to limit role permissions in Cortex XDR. - [Role permissions by component](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/reference-and-developer-docs/role-based-access-control/role-permissions-by-component.md): Learn how to manage role permissions in Cortex XDR. - [Core tenant and administrative permissions](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/reference-and-developer-docs/role-based-access-control/core-tenant-and-administrative-permissions.md): Review permissions for core tenant administration and management. - [Configuration permissions](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/reference-and-developer-docs/role-based-access-control/configuration-permissions.md): Configure permissions for Cortex XDR configuration features. - [Auditing permissions](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/reference-and-developer-docs/role-based-access-control/configuration-permissions/auditing-permissions.md): Configure permissions for auditing features. - [Alert Notifications permissions](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/reference-and-developer-docs/role-based-access-control/configuration-permissions/alert-notifications-permissions.md): Configure permissions for alert notifications. - [General Configuration permissions](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/reference-and-developer-docs/role-based-access-control/configuration-permissions/general-configuration-permissions.md): Configure permissions for general Cortex XDR settings. - [Cortex XDR Analytics permissions](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/reference-and-developer-docs/role-based-access-control/configuration-permissions/cortex-xdr-analytics-permissions.md): Configure permissions for Cortex XDR Analytics. - [Access management permissions](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/reference-and-developer-docs/role-based-access-control/configuration-permissions/access-management-permissions.md): Configure permissions for user access and role management. - [Data Broker permissions](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/reference-and-developer-docs/role-based-access-control/configuration-permissions/data-broker-permissions.md): Configure permissions for Data Broker management. - [Log Collection permissions](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/reference-and-developer-docs/role-based-access-control/configuration-permissions/log-collection-permissions.md): Configure permissions for log collection. - [Data Sources permissions](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/reference-and-developer-docs/role-based-access-control/configuration-permissions/data-sources-permissions.md): Configure permissions for data source management. - [External Issues Mapping permissions](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/reference-and-developer-docs/role-based-access-control/configuration-permissions/external-issues-mapping-permissions.md): Configure permissions for external issue mappings. - [Integrations - instance permissions](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/reference-and-developer-docs/role-based-access-control/configuration-permissions/integrations-instance-permissions.md): Configure permissions for integration instances. - [Integrations Permissions](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/reference-and-developer-docs/role-based-access-control/configuration-permissions/integrations-permissions.md): Configure permissions for integrations. - [Data Management permissions](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/reference-and-developer-docs/role-based-access-control/configuration-permissions/data-management-permissions.md): Configure permissions for data management. - [Public API](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/reference-and-developer-docs/role-based-access-control/configuration-permissions/public-api.md): Configure permissions for the Cortex XDR public API. - [Threat Intelligence permission - API configuration](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/reference-and-developer-docs/role-based-access-control/configuration-permissions/threat-intelligence-permission-api-configuration.md): Configure permissions for Threat Intelligence API settings. - [Long-running HTTP Integrations configuration](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/reference-and-developer-docs/role-based-access-control/configuration-permissions/long-running-http-integrations-configuration.md): Configure permissions for long-running HTTP integrations. - [Credentials permissions](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/reference-and-developer-docs/role-based-access-control/configuration-permissions/credentials-permissions.md): Configure permissions for credentials. - [Object Setup permissions](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/reference-and-developer-docs/role-based-access-control/configuration-permissions/object-setup-permissions.md): Configure permissions for object setup features. - [Case Properties permissions](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/reference-and-developer-docs/role-based-access-control/configuration-permissions/object-setup-permissions/case-properties-permissions.md): Configure permissions for case properties. - [Exclusion List permissions](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/reference-and-developer-docs/role-based-access-control/configuration-permissions/object-setup-permissions/exclusion-list-permissions.md): Configure permissions for exclusion lists. - [Fields and Types permissions](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/reference-and-developer-docs/role-based-access-control/configuration-permissions/object-setup-permissions/fields-and-types-permissions.md): Configure permissions for fields and types. - [Sync Profile permissions](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/reference-and-developer-docs/role-based-access-control/configuration-permissions/object-setup-permissions/sync-profile-permissions.md): Configure permissions for sync profiles. - [Marketplace permissions](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/reference-and-developer-docs/role-based-access-control/marketplace-permissions.md): Configure Marketplace permissions for RBAC. - [Help permissions](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/reference-and-developer-docs/role-based-access-control/help-permissions.md): Configure permissions for Help features. - [SOC Operations, Investigation & Response permissions](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/reference-and-developer-docs/role-based-access-control/soc-operations-investigation-and-response-permissions.md): Configure permissions for SOC operations, investigation, and response. - [Dashboards and Reports permissions](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/reference-and-developer-docs/role-based-access-control/dashboards-and-reports-permissions.md): Set permissions for dashboards and reports in Cortex XDR. - [Dashboards permissions](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/reference-and-developer-docs/role-based-access-control/dashboards-and-reports-permissions/dashboards-permissions.md): Configure permissions for dashboards. - [Command Center Dashboard permissions](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/reference-and-developer-docs/role-based-access-control/dashboards-and-reports-permissions/command-center-dashboard-permissions.md): Configure permissions for Command Center dashboards. - [Ingestion Monitoring dashboard permissions](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/reference-and-developer-docs/role-based-access-control/dashboards-and-reports-permissions/ingestion-monitoring-dashboard-permissions.md): Configure permissions for the Ingestion Monitoring dashboard. - [Reports permissions](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/reference-and-developer-docs/role-based-access-control/dashboards-and-reports-permissions/reports-permissions.md): Configure permissions for reports. - [Email Command Center permissions](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/reference-and-developer-docs/role-based-access-control/dashboards-and-reports-permissions/email-command-center-permissions.md): Configure permissions for Email Command Center. - [Cloud Security Command Center permissions](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/reference-and-developer-docs/role-based-access-control/dashboards-and-reports-permissions/cloud-security-command-center-permissions.md): Configure permissions for Cloud Security Command Center. - [Cases and Issues permissions](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/reference-and-developer-docs/role-based-access-control/cases-and-issues-permissions.md): Set up Cases and Issues permissions. - [Investigation and Response permissions](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/reference-and-developer-docs/role-based-access-control/investigation-and-response-permissions.md): Configure investigation and response permissions, which include search, response, and automation permissions. - [Search permissions](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/reference-and-developer-docs/role-based-access-control/investigation-and-response-permissions/search-permissions.md): Configure permissions for search features. - [Query Library permissions](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/reference-and-developer-docs/role-based-access-control/investigation-and-response-permissions/search-permissions/query-library-permissions.md): Configure permissions for Query Library. - [Query Center permissions](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/reference-and-developer-docs/role-based-access-control/investigation-and-response-permissions/search-permissions/query-center-permissions.md): Configure permissions for Query Center. - [Forensics permissions](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/reference-and-developer-docs/role-based-access-control/investigation-and-response-permissions/search-permissions/forensics-permissions.md): Configure permissions for forensics. - [Host Insights permissions](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/reference-and-developer-docs/role-based-access-control/investigation-and-response-permissions/search-permissions/host-insights-permissions.md): Configure permissions for Host Insights. - [Graph Search permissions](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/reference-and-developer-docs/role-based-access-control/investigation-and-response-permissions/search-permissions/graph-search-permissions.md): Configure permissions for Graph Search. - [Response permissions](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/reference-and-developer-docs/role-based-access-control/investigation-and-response-permissions/response-permissions.md): Configure permissions for response actions. - [Action Center permissions](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/reference-and-developer-docs/role-based-access-control/investigation-and-response-permissions/response-permissions/action-center-permissions.md): Configure permissions for Action Center. - [EDL permissions](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/reference-and-developer-docs/role-based-access-control/investigation-and-response-permissions/response-permissions/edl-permissions.md): Configure permissions for external dynamic lists. - [Agent Scripts Library permissions](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/reference-and-developer-docs/role-based-access-control/investigation-and-response-permissions/response-permissions/agent-scripts-library-permissions.md): Configure permissions for Agent Scripts Library. - [Live Terminal permissions](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/reference-and-developer-docs/role-based-access-control/investigation-and-response-permissions/response-permissions/live-terminal-permissions.md): Configure permissions for Live Terminal. - [Automation Rules](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/reference-and-developer-docs/role-based-access-control/investigation-and-response-permissions/response-permissions/automation-rules.md): Configure permissions for automation rules. - [Automation permissions](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/reference-and-developer-docs/role-based-access-control/investigation-and-response-permissions/automation-permissions.md): Configure permissions for automation features. - [Playbook permissions](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/reference-and-developer-docs/role-based-access-control/investigation-and-response-permissions/automation-permissions/playbook-permissions.md): Configure permissions for playbooks. - [Script permissions](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/reference-and-developer-docs/role-based-access-control/investigation-and-response-permissions/automation-permissions/script-permissions.md): Configure permissions for scripts. - [Playground permissions](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/reference-and-developer-docs/role-based-access-control/investigation-and-response-permissions/automation-permissions/playground-permissions.md): Configure permissions for Playground. - [Automation Exclusion Center permissions](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/reference-and-developer-docs/role-based-access-control/investigation-and-response-permissions/automation-permissions/automation-exclusion-center-permissions.md): Configure permissions for Automation Exclusion Center. - [Search permissions](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/reference-and-developer-docs/role-based-access-control/investigation-and-response-permissions/search-permissions-1.md): Configure permissions for search features. - [Query Library permissions](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/reference-and-developer-docs/role-based-access-control/investigation-and-response-permissions/search-permissions-1/query-library-permissions.md): Configure permissions for Query Library. - [Query Center permissions](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/reference-and-developer-docs/role-based-access-control/investigation-and-response-permissions/search-permissions-1/query-center-permissions.md): Configure permissions for Query Center. - [Forensics permissions](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/reference-and-developer-docs/role-based-access-control/investigation-and-response-permissions/search-permissions-1/forensics-permissions.md): Configure permissions for forensics. - [Host Insights permissions](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/reference-and-developer-docs/role-based-access-control/investigation-and-response-permissions/search-permissions-1/host-insights-permissions.md): Configure permissions for Host Insights. - [Graph Search permissions](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/reference-and-developer-docs/role-based-access-control/investigation-and-response-permissions/search-permissions-1/graph-search-permissions.md): Configure permissions for Graph Search. - [Response permissions](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/reference-and-developer-docs/role-based-access-control/investigation-and-response-permissions/response-permissions-1.md): Configure permissions for response actions. - [Action Center permissions](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/reference-and-developer-docs/role-based-access-control/investigation-and-response-permissions/response-permissions-1/action-center-permissions.md): Configure permissions for Action Center. - [EDL permissions](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/reference-and-developer-docs/role-based-access-control/investigation-and-response-permissions/response-permissions-1/edl-permissions.md): Configure permissions for external dynamic lists. - [Agent Scripts Library permissions](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/reference-and-developer-docs/role-based-access-control/investigation-and-response-permissions/response-permissions-1/agent-scripts-library-permissions.md): Configure permissions for Agent Scripts Library. - [Live Terminal permissions](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/reference-and-developer-docs/role-based-access-control/investigation-and-response-permissions/response-permissions-1/live-terminal-permissions.md): Configure permissions for Live Terminal. - [Automation permissions](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/reference-and-developer-docs/role-based-access-control/investigation-and-response-permissions/automation-permissions-1.md): Configure permissions for automation features. - [Playbook permissions](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/reference-and-developer-docs/role-based-access-control/investigation-and-response-permissions/automation-permissions-1/playbook-permissions.md): Configure permissions for playbooks. - [Script permissions](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/reference-and-developer-docs/role-based-access-control/investigation-and-response-permissions/automation-permissions-1/script-permissions.md): Configure permissions for scripts. - [Playground permissions](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/reference-and-developer-docs/role-based-access-control/investigation-and-response-permissions/automation-permissions-1/playground-permissions.md): Configure permissions for Playground. - [Automation Exclusion Center permissions](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/reference-and-developer-docs/role-based-access-control/investigation-and-response-permissions/automation-permissions-1/automation-exclusion-center-permissions.md): Configure permissions for Automation Exclusion Center. - [Threat Management permissions](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/reference-and-developer-docs/role-based-access-control/threat-management-permissions.md): Configure Detection Rules and Threat Intel permissions. - [Detection Rules permissions](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/reference-and-developer-docs/role-based-access-control/threat-management-permissions/detection-rules-permissions.md): Configure Detection Rules permissions. - [Threat Intelligence permissions](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/reference-and-developer-docs/role-based-access-control/threat-management-permissions/threat-intelligence-permissions.md): Configure permissions for Threat Intelligence. - [Exceptions Configuration permissions](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/reference-and-developer-docs/role-based-access-control/exceptions-configuration-permissions.md): Configure issue exclusion permissions. - [Issue Exclusions permissions](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/reference-and-developer-docs/role-based-access-control/exceptions-configuration-permissions/issue-exclusions-permissions.md): Configure Issue Exclusions permissions. - [Exception Management Admin permissions](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/reference-and-developer-docs/role-based-access-control/exceptions-configuration-permissions/exception-management-admin-permissions.md): Configure Exception Management Admin permissions. - [Exception Approver Admin permissions](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/reference-and-developer-docs/role-based-access-control/exceptions-configuration-permissions/exception-approver-admin-permissions.md): Configure Exception Approver Admin permissions. - [Cortex Agentic Assistant permissions](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/reference-and-developer-docs/role-based-access-control/cortex-agentic-assistant-permissions.md): Configure the Cortex Agentic Assistant permissions, which include AI Prompts and Agent permissions. - [AI Prompts](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/reference-and-developer-docs/role-based-access-control/cortex-agentic-assistant-permissions/ai-prompts.md): Configure AI Prompts permissions. - [Cortex Agentic Assistant Agents](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/reference-and-developer-docs/role-based-access-control/cortex-agentic-assistant-permissions/cortex-agentic-assistant-agents.md): Configure Cortex Agentic Assistant Agents permissions. - [Agents and endpoint protection](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/reference-and-developer-docs/role-based-access-control/agents-and-endpoint-protection.md): Configure permissions for agents and endpoint protection. - [Inventory - Agent permissions](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/reference-and-developer-docs/role-based-access-control/inventory-agent-permissions.md): Configure permissions for Endpoints (XDR Agent). - [Agent Administrations](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/reference-and-developer-docs/role-based-access-control/inventory-agent-permissions/agent-administrations.md): Configure permissions for agent administration. - [Agent Groups](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/reference-and-developer-docs/role-based-access-control/inventory-agent-permissions/agent-groups.md): Configure permissions for agent groups. - [Agent Prevention Policies](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/reference-and-developer-docs/role-based-access-control/inventory-agent-permissions/agent-prevention-policies.md): Configure permissions for agent prevention policies. - [Global Exceptions](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/reference-and-developer-docs/role-based-access-control/inventory-agent-permissions/global-exceptions.md): Configure permissions for global exceptions. - [Agent Profiles](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/reference-and-developer-docs/role-based-access-control/inventory-agent-permissions/agent-profiles.md): Configure permissions for agent profiles. - [Agent Extension Policies](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/reference-and-developer-docs/role-based-access-control/inventory-agent-permissions/agent-extension-policies.md): Configure permissions for agent extension policies. - [Agent Installations](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/reference-and-developer-docs/role-based-access-control/inventory-agent-permissions/agent-installations.md): Configure permissions for agent installation. - [Host Firewall](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/reference-and-developer-docs/role-based-access-control/inventory-agent-permissions/host-firewall.md): Configure permissions for host firewall. - [Device Control](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/reference-and-developer-docs/role-based-access-control/inventory-agent-permissions/device-control.md): Configure permissions for device control. - [Data Security - Endpoint DLP permissions](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/reference-and-developer-docs/role-based-access-control/data-security-endpoint-dlp-permissions.md): Configure permissions for Endpoint DLP features. - [Data-in-Motion Rules](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/reference-and-developer-docs/role-based-access-control/data-security-endpoint-dlp-permissions/data-in-motion-rules.md): Configure permissions for data-in-motion rules. - [Endpoint Applications](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/reference-and-developer-docs/role-based-access-control/data-security-endpoint-dlp-permissions/endpoint-applications.md): Configure permissions for endpoint applications. - [Endpoint Applications Groups](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/reference-and-developer-docs/role-based-access-control/data-security-endpoint-dlp-permissions/endpoint-applications-groups.md): Configure permissions for endpoint application groups. - [Endpoint DLP Settings](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/reference-and-developer-docs/role-based-access-control/data-security-endpoint-dlp-permissions/endpoint-dlp-settings.md): Configure permissions for Endpoint DLP settings. - [Inventory - Assets permissions](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/reference-and-developer-docs/role-based-access-control/inventory-assets-permissions.md): Consider adding inventory permissions for Assets and Agents (Endpoints). - [Network Configuration permissions](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/reference-and-developer-docs/role-based-access-control/inventory-assets-permissions/network-configuration-permissions.md): Configure permissions for network configuration. - [Compliance (Legacy) permissions](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/reference-and-developer-docs/role-based-access-control/inventory-assets-permissions/compliance-legacy-permissions.md): Configure permissions for legacy compliance features. - [Asset Inventory permissions](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/reference-and-developer-docs/role-based-access-control/inventory-assets-permissions/asset-inventory-permissions.md): Configure permissions for Asset Inventory. - [Asset Roles configuration permissions](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/reference-and-developer-docs/role-based-access-control/inventory-assets-permissions/asset-roles-configuration-permissions.md): Configure permissions for asset role configuration. - [Asset Groups permissions](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/reference-and-developer-docs/role-based-access-control/inventory-assets-permissions/asset-groups-permissions.md): Configure permissions for asset groups. - [Attack Surface permissions](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/reference-and-developer-docs/role-based-access-control/attack-surface-permissions.md): Configure permissions for Attack Surface Management. - [Vulnerability Management permissions](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/reference-and-developer-docs/role-based-access-control/vulnerability-management-permissions.md): Configure permissions for Vulnerability Management. - [Cloud Security and Posture Management permissions](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/reference-and-developer-docs/role-based-access-control/cloud-security-and-posture-management-permissions.md): Configure permissions for Cloud Security and Posture Management. - [CLI Tool permissions](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/reference-and-developer-docs/role-based-access-control/cloud-security-and-posture-management-permissions/cli-tool-permissions.md): Configure permissions for CLI tools. - [Application Security permissions](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/reference-and-developer-docs/role-based-access-control/cloud-security-and-posture-management-permissions/application-security-permissions.md): Configure permissions for Application Security. - [Application Security - Generic Collector permissions](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/reference-and-developer-docs/role-based-access-control/cloud-security-and-posture-management-permissions/application-security-permissions/application-security-generic-collector-permissions.md): Configure permissions for Application Security generic collectors. - [Application Security - Issues permissions](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/reference-and-developer-docs/role-based-access-control/cloud-security-and-posture-management-permissions/application-security-permissions/application-security-issues-permissions.md): Configure permissions for Application Security issues. - [Application Security - Scans permissions](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/reference-and-developer-docs/role-based-access-control/cloud-security-and-posture-management-permissions/application-security-permissions/application-security-scans-permissions.md): Configure permissions for Application Security scans. - [Application Security - Policy Management permissions](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/reference-and-developer-docs/role-based-access-control/cloud-security-and-posture-management-permissions/application-security-permissions/application-security-policy-management-permissions.md): Configure permissions for Application Security policy management. - [Application Security - 3rd Party tools permissions](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/reference-and-developer-docs/role-based-access-control/cloud-security-and-posture-management-permissions/application-security-permissions/application-security-3rd-party-tools-permissions.md): Configure permissions for third-party Application Security tools. - [Configurations - Application Security permissions](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/reference-and-developer-docs/role-based-access-control/cloud-security-and-posture-management-permissions/application-security-permissions/configurations-application-security-permissions.md): Configure permissions for Application Security configurations. - [Policies - Cloud Workload permissions](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/reference-and-developer-docs/role-based-access-control/cloud-security-and-posture-management-permissions/policies-cloud-workload-permissions.md): Configure permissions for cloud workload policies. - [Cloud Security permissions](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/reference-and-developer-docs/role-based-access-control/cloud-security-and-posture-management-permissions/cloud-security-permissions.md): Configure permissions for Cloud Security. - [Compliance - Cloud permissions](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/reference-and-developer-docs/role-based-access-control/cloud-security-and-posture-management-permissions/compliance-cloud-permissions.md): Configure permissions for cloud compliance. - [Data Security permissions](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/reference-and-developer-docs/role-based-access-control/cloud-security-and-posture-management-permissions/data-security-permissions.md): Configure permissions for Data Security. - [AI Security permissions](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/reference-and-developer-docs/role-based-access-control/cloud-security-and-posture-management-permissions/ai-security-permissions.md): Configure permissions for AI Security. - [Data Classification permissions](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/reference-and-developer-docs/role-based-access-control/cloud-security-and-posture-management-permissions/data-classification-permissions.md): Configure permissions for data classification. - [Identity Security permissions](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/reference-and-developer-docs/role-based-access-control/cloud-security-and-posture-management-permissions/identity-security-permissions.md): Configure permissions for Identity Security. - [Cortex secure deployment practices](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/reference-and-developer-docs/cortex-secure-deployment-practices.md): Follow secure deployment practices for Cortex XDR. - [Microsoft Windows security auditing setup](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/reference-and-developer-docs/microsoft-windows-security-auditing-setup.md): Configure Windows security auditing for Cortex XDR data collection. - [Enable security auditing event IDs](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/reference-and-developer-docs/microsoft-windows-security-auditing-setup/enable-security-auditing-event-ids.md): Enable required Windows security auditing event IDs. - [Enable security auditing event IDs with GPO](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/reference-and-developer-docs/microsoft-windows-security-auditing-setup/enable-security-auditing-event-ids/enable-security-auditing-event-ids-with-gpo.md): Enable Windows security auditing event IDs through Group Policy. - [Set up local machine security auditing without GPO](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/reference-and-developer-docs/microsoft-windows-security-auditing-setup/enable-security-auditing-event-ids/set-up-local-machine-security-auditing-with-gpo.md): Configure Windows security auditing locally without Group Policy. - [Additional setup for Active Directory Certificate Services (ADCS) events](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/reference-and-developer-docs/microsoft-windows-security-auditing-setup/enable-security-auditing-event-ids/additional-setup-for-active-directory-certificate-services-adcs-events.md): Configure auditing for Active Directory Certificate Services events. - [Enable auditing access to AD domain objects - 4662](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/reference-and-developer-docs/microsoft-windows-security-auditing-setup/enable-security-auditing-event-ids/enable-auditing-access-to-ad-domain-objects-4662.md): Enable auditing for Active Directory domain object access event 4662. - [Enable additional event logs using Event Viewer](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/reference-and-developer-docs/microsoft-windows-security-auditing-setup/enable-additional-event-logs-using-event-viewer.md): Enable additional Windows event logs using Event Viewer. - [Enable LDAP server events logging (1644)](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/reference-and-developer-docs/microsoft-windows-security-auditing-setup/enable-ldap-server-events-logging-1644.md): Enable LDAP server event logging for event ID 1644. - [Enable LDAP server events logging using RegEdit](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/reference-and-developer-docs/microsoft-windows-security-auditing-setup/enable-ldap-server-events-logging-1644/enable-ldap-server-events-logging-using-regedit.md): Enable LDAP server event logging using Registry Editor. - [Enable LDAP server events logging using GPO](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/reference-and-developer-docs/microsoft-windows-security-auditing-setup/enable-ldap-server-events-logging-1644/enable-ldap-server-events-logging-using-gpo.md): Enable LDAP server event logging using Group Policy. - [Validate log collection for LDAP Server events](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/reference-and-developer-docs/microsoft-windows-security-auditing-setup/enable-ldap-server-events-logging-1644/validate-log-collection-for-ldap-server-events.md): Verify Cortex XDR collects LDAP server event logs. - [Learn more about migrating to the latest Broker VM image](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/migrate-to-a-new-broker-vm-image/migrating-to-a-new-broker-vm-image.md): Learn more about migrating to the latest broker VM image in Cortex XDR. - [Standalone Broker VM](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/migrate-to-a-new-broker-vm-image/standalone-broker-vm.md): Learn more about migrating a standalone broker VM image. - [Broker VM high availability cluster node](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/migrate-to-a-new-broker-vm-image/broker-vm-high-availability-cluster-node.md): Learn more about migrating a broker VM High Availability (HA) cluster node. ## Cortex XDR 3.x Documentation - [Get started with Cortex XDR](https://cortex-docs.paloaltonetworks.com/cortex-xdr-3.x/cortex-xdr-3.x-documentation/readme.md): Learn about key functionality within Cortex XDR, the available license plans, and the typical roles and responsibilities in a Security Operations Center (SOC) team. - [What is Cortex XDR?](https://cortex-docs.paloaltonetworks.com/cortex-xdr-3.x/cortex-xdr-3.x-documentation/readme/what-is-cortex-xdr.md): Learn about Cortex XDR and the security challenges it addresses. - [Concepts](https://cortex-docs.paloaltonetworks.com/cortex-xdr-3.x/cortex-xdr-3.x-documentation/readme/concepts.md): Learn more about the Cortex XDR main concepts. - [Supported web browsers](https://cortex-docs.paloaltonetworks.com/cortex-xdr-3.x/cortex-xdr-3.x-documentation/readme/supported-web-browsers.md) - [Use the interface](https://cortex-docs.paloaltonetworks.com/cortex-xdr-3.x/cortex-xdr-3.x-documentation/readme/use-the-interface.md): Learn more about how to use the Cortex XDR interface. - [What is Cortex Gateway?](https://cortex-docs.paloaltonetworks.com/cortex-xdr-3.x/cortex-xdr-3.x-documentation/readme/what-is-cortex-gateway.md): A brief introduction to Cortex Gateway - [Understand Cortex XDR license plans](https://cortex-docs.paloaltonetworks.com/cortex-xdr-3.x/cortex-xdr-3.x-documentation/readme/understand-cortex-xdr-license-plans.md): Learn more about the available Cortex XDR licenses and add-ons. - [Data retention in Cortex XDR](https://cortex-docs.paloaltonetworks.com/cortex-xdr-3.x/cortex-xdr-3.x-documentation/readme/understand-cortex-xdr-license-plans/data-retention-in-cortex-xdr.md): Learn more about the default retention periods for all Cortex XDR licenses, and the available retention add-ons. - [Data storage lifecycle](https://cortex-docs.paloaltonetworks.com/cortex-xdr-3.x/cortex-xdr-3.x-documentation/readme/understand-cortex-xdr-license-plans/data-storage-lifecycle.md) - [License allocation](https://cortex-docs.paloaltonetworks.com/cortex-xdr-3.x/cortex-xdr-3.x-documentation/readme/understand-cortex-xdr-license-plans/license-allocation.md): Learn more about how Cortex XDR regulates licenses. - [License expiration](https://cortex-docs.paloaltonetworks.com/cortex-xdr-3.x/cortex-xdr-3.x-documentation/readme/understand-cortex-xdr-license-plans/license-expiration.md): Learn more about the Cortex XDR license expiration and validation period. - [Upgrade your tenant](https://cortex-docs.paloaltonetworks.com/cortex-xdr-3.x/cortex-xdr-3.x-documentation/readme/understand-cortex-xdr-license-plans/upgrade-your-tenant.md) - [Security Operations Center roles and responsibilities](https://cortex-docs.paloaltonetworks.com/cortex-xdr-3.x/cortex-xdr-3.x-documentation/readme/security-operations-center-roles-and-responsibilities.md): Learn about the typical core roles that make up a SOC team. - [In-product support case creation](https://cortex-docs.paloaltonetworks.com/cortex-xdr-3.x/cortex-xdr-3.x-documentation/readme/in-product-support-case-creation.md): Open a support case directly in Cortex XDR and record your console to capture your issues and have the case handled efficiently. - [Upgrade to Cortex XDR 5.x](https://cortex-docs.paloaltonetworks.com/cortex-xdr-3.x/cortex-xdr-3.x-documentation/readme/upgrade-to-cortex-xdr-5.x.md) - [Onboard and configure Cortex XDR](https://cortex-docs.paloaltonetworks.com/cortex-xdr-3.x/cortex-xdr-3.x-documentation/onboard-and-configure-cortex-xdr.md): Learn about the deployment preparation and procedures to onboard and configure Cortex XDR. - [Deployment steps](https://cortex-docs.paloaltonetworks.com/cortex-xdr-3.x/cortex-xdr-3.x-documentation/onboard-and-configure-cortex-xdr/deployment-steps.md): Follow the steps in the onboarding checklist to successfully deploy and onboard Cortex XDR. - [Plan and prepare](https://cortex-docs.paloaltonetworks.com/cortex-xdr-3.x/cortex-xdr-3.x-documentation/onboard-and-configure-cortex-xdr/deployment-steps/plan-and-prepare.md): Learn more about deployment considerations and onboarding steps. - [Cortex XDR onboarding checklist](https://cortex-docs.paloaltonetworks.com/cortex-xdr-3.x/cortex-xdr-3.x-documentation/onboard-and-configure-cortex-xdr/deployment-steps/cortex-xdr-onboarding-checklist.md): Review the steps to deploy and onboard Cortex XDR. - [Step 1: Activate Cortex XDR](https://cortex-docs.paloaltonetworks.com/cortex-xdr-3.x/cortex-xdr-3.x-documentation/onboard-and-configure-cortex-xdr/deployment-steps/step-1-activate-cortex-xdr.md): Learn how to activate your tenant. - [Cortex XDR supported regions](https://cortex-docs.paloaltonetworks.com/cortex-xdr-3.x/cortex-xdr-3.x-documentation/onboard-and-configure-cortex-xdr/deployment-steps/step-1-activate-cortex-xdr/cortex-xdr-supported-regions.md): Supported regions in which you want to host Cortex XDR and any associated services. - [Enable access to required PANW resources](https://cortex-docs.paloaltonetworks.com/cortex-xdr-3.x/cortex-xdr-3.x-documentation/onboard-and-configure-cortex-xdr/deployment-steps/step-1-activate-cortex-xdr/enable-access-to-required-panw-resources.md): Learn more about enabling network access to the Cortex XDR resources. - [Step 2: Pre-installation steps for Cortex XDR agents](https://cortex-docs.paloaltonetworks.com/cortex-xdr-3.x/cortex-xdr-3.x-documentation/onboard-and-configure-cortex-xdr/deployment-steps/step-2-pre-installation-steps-for-cortex-xdr-agents.md) - [Assign user roles and groups](https://cortex-docs.paloaltonetworks.com/cortex-xdr-3.x/cortex-xdr-3.x-documentation/onboard-and-configure-cortex-xdr/deployment-steps/step-2-pre-installation-steps-for-cortex-xdr-agents/assign-user-roles-and-groups.md): Learn how to assign users to roles and user groups. - [Set up authentication](https://cortex-docs.paloaltonetworks.com/cortex-xdr-3.x/cortex-xdr-3.x-documentation/onboard-and-configure-cortex-xdr/deployment-steps/step-2-pre-installation-steps-for-cortex-xdr-agents/set-up-authentication.md): Authenticate Cortex XDR users using SAML 2.0 or Cortex Gateway. - [Authenticate users through the Customer Support Portal](https://cortex-docs.paloaltonetworks.com/cortex-xdr-3.x/cortex-xdr-3.x-documentation/onboard-and-configure-cortex-xdr/deployment-steps/step-2-pre-installation-steps-for-cortex-xdr-agents/set-up-authentication/authenticate-users-through-the-customer-support-portal.md): Authenticate Cortex XDR users when using the Customer Support Portal. - [Authenticate users using SSO](https://cortex-docs.paloaltonetworks.com/cortex-xdr-3.x/cortex-xdr-3.x-documentation/onboard-and-configure-cortex-xdr/deployment-steps/step-2-pre-installation-steps-for-cortex-xdr-agents/set-up-authentication/authenticate-users-using-sso.md): Set up authentication in the Cortex XDR tenant using SSO. - [Set up Okta as the Identity Provider Using SAML 2.0](https://cortex-docs.paloaltonetworks.com/cortex-xdr-3.x/cortex-xdr-3.x-documentation/onboard-and-configure-cortex-xdr/deployment-steps/step-2-pre-installation-steps-for-cortex-xdr-agents/set-up-authentication/set-up-okta-as-the-identity-provider-using-saml-2.0.md) - [Set up Microsoft Entra ID as the Identity Provider Using SAML 2.0](https://cortex-docs.paloaltonetworks.com/cortex-xdr-3.x/cortex-xdr-3.x-documentation/onboard-and-configure-cortex-xdr/deployment-steps/step-2-pre-installation-steps-for-cortex-xdr-agents/set-up-authentication/set-up-microsoft-entra-id-as-the-identity-provider-using-saml-2.0.md) - [Define endpoint groups](https://cortex-docs.paloaltonetworks.com/cortex-xdr-3.x/cortex-xdr-3.x-documentation/onboard-and-configure-cortex-xdr/deployment-steps/step-2-pre-installation-steps-for-cortex-xdr-agents/define-endpoint-groups.md): Define an endpoint group and then apply policy rules and manage specific endpoints. - [Manage endpoint profiles](https://cortex-docs.paloaltonetworks.com/cortex-xdr-3.x/cortex-xdr-3.x-documentation/onboard-and-configure-cortex-xdr/deployment-steps/step-2-pre-installation-steps-for-cortex-xdr-agents/manage-endpoint-profiles.md): Endpoint security profiles can be used immediately, or customized, to protect your endpoints from threats. - [Endpoint data collection](https://cortex-docs.paloaltonetworks.com/cortex-xdr-3.x/cortex-xdr-3.x-documentation/onboard-and-configure-cortex-xdr/deployment-steps/step-2-pre-installation-steps-for-cortex-xdr-agents/endpoint-data-collection.md): To aid in endpoint detection and alert investigation, the Cortex XDR agent collects endpoint information when an alert is triggered. - [Configure global agent settings](https://cortex-docs.paloaltonetworks.com/cortex-xdr-3.x/cortex-xdr-3.x-documentation/onboard-and-configure-cortex-xdr/deployment-steps/step-2-pre-installation-steps-for-cortex-xdr-agents/configure-global-agent-settings.md): Learn how to configure the Cortex XDR agent global settings that operate on your endpoints. - [Step 3: Install Cortex XDR agents](https://cortex-docs.paloaltonetworks.com/cortex-xdr-3.x/cortex-xdr-3.x-documentation/onboard-and-configure-cortex-xdr/deployment-steps/step-3-install-cortex-xdr-agents.md): Learn about the initial steps required to deploy Cortex XDR agent software to endpoints. - [Plan your agent deployment](https://cortex-docs.paloaltonetworks.com/cortex-xdr-3.x/cortex-xdr-3.x-documentation/onboard-and-configure-cortex-xdr/deployment-steps/step-3-install-cortex-xdr-agents/plan-your-agent-deployment.md) - [Guidelines for keeping Cortex XDR agents and content updated](https://cortex-docs.paloaltonetworks.com/cortex-xdr-3.x/cortex-xdr-3.x-documentation/onboard-and-configure-cortex-xdr/deployment-steps/step-3-install-cortex-xdr-agents/guidelines-for-keeping-cortex-xdr-agents-and-content-updated.md): Learn more about how to control Cortex XDR agent and content upgrades. - [Create an agent installation package](https://cortex-docs.paloaltonetworks.com/cortex-xdr-3.x/cortex-xdr-3.x-documentation/onboard-and-configure-cortex-xdr/deployment-steps/step-3-install-cortex-xdr-agents/create-an-agent-installation-package.md): Learn how to create a Cortex XDR agent installation package to deploy to your endpoints. - [Deploy agent installation packages](https://cortex-docs.paloaltonetworks.com/cortex-xdr-3.x/cortex-xdr-3.x-documentation/onboard-and-configure-cortex-xdr/deployment-steps/step-3-install-cortex-xdr-agents/deploy-agent-installation-packages.md): Learn how to deploy an agent installation package on endpoints. - [Step 4: Configure and deploy Cortex XDR](https://cortex-docs.paloaltonetworks.com/cortex-xdr-3.x/cortex-xdr-3.x-documentation/onboard-and-configure-cortex-xdr/deployment-steps/step-4-configure-and-deploy-cortex-xdr.md) - [Cortex XDR - Analytics](https://cortex-docs.paloaltonetworks.com/cortex-xdr-3.x/cortex-xdr-3.x-documentation/onboard-and-configure-cortex-xdr/deployment-steps/step-4-configure-and-deploy-cortex-xdr/cortex-xdr-analytics.md) - [Configure Cortex XDR network parameters](https://cortex-docs.paloaltonetworks.com/cortex-xdr-3.x/cortex-xdr-3.x-documentation/onboard-and-configure-cortex-xdr/deployment-steps/step-4-configure-and-deploy-cortex-xdr/cortex-xdr-analytics/configure-cortex-xdr-network-parameters.md) - [Enable the Analytics Engine and Identity Analytics](https://cortex-docs.paloaltonetworks.com/cortex-xdr-3.x/cortex-xdr-3.x-documentation/onboard-and-configure-cortex-xdr/deployment-steps/step-4-configure-and-deploy-cortex-xdr/cortex-xdr-analytics/enable-the-analytics-engine-and-identity-analytics.md) - [Set up Cloud Identity Engine](https://cortex-docs.paloaltonetworks.com/cortex-xdr-3.x/cortex-xdr-3.x-documentation/onboard-and-configure-cortex-xdr/deployment-steps/step-4-configure-and-deploy-cortex-xdr/set-up-cloud-identity-engine.md): Learn how to set up Cloud Identity Engine to use with Cortex XDR. - [Step 5: Define data sources](https://cortex-docs.paloaltonetworks.com/cortex-xdr-3.x/cortex-xdr-3.x-documentation/onboard-and-configure-cortex-xdr/deployment-steps/step-5-define-data-sources.md): Learn how to configure data ingestion ingest data from a variety of Palo Alto Networks and third-party sources. - [Step 6: Perform health checks](https://cortex-docs.paloaltonetworks.com/cortex-xdr-3.x/cortex-xdr-3.x-documentation/onboard-and-configure-cortex-xdr/deployment-steps/step-6-perform-health-checks.md): Learn which health checks to perform after deployment. - [Monitor agent operational status in Cortex XDR](https://cortex-docs.paloaltonetworks.com/cortex-xdr-3.x/cortex-xdr-3.x-documentation/onboard-and-configure-cortex-xdr/deployment-steps/step-6-perform-health-checks/monitor-agent-operational-status-in-cortex-xdr.md): View the operational status of any Cortex XDR agent that you manage. - [Post-deployment steps](https://cortex-docs.paloaltonetworks.com/cortex-xdr-3.x/cortex-xdr-3.x-documentation/onboard-and-configure-cortex-xdr/post-deployment-steps.md) - [Set up your environment](https://cortex-docs.paloaltonetworks.com/cortex-xdr-3.x/cortex-xdr-3.x-documentation/onboard-and-configure-cortex-xdr/post-deployment-steps/set-up-your-environment.md) - [Configure server settings](https://cortex-docs.paloaltonetworks.com/cortex-xdr-3.x/cortex-xdr-3.x-documentation/onboard-and-configure-cortex-xdr/post-deployment-steps/set-up-your-environment/configure-server-settings.md): Configure server settings such as keyboard shortcuts, timezone, and timestamp format. - [Configure security settings](https://cortex-docs.paloaltonetworks.com/cortex-xdr-3.x/cortex-xdr-3.x-documentation/onboard-and-configure-cortex-xdr/post-deployment-steps/set-up-your-environment/configure-security-settings.md): Configure security settings such as session expiration, user login expiration, and dashboard expiration. - [Log forwarding](https://cortex-docs.paloaltonetworks.com/cortex-xdr-3.x/cortex-xdr-3.x-documentation/onboard-and-configure-cortex-xdr/post-deployment-steps/set-up-your-environment/log-forwarding.md): Stay informed and updated about events in your system by forwarding alerts and reports to an external service, such as a syslog receiver, a Slack channel, or an email account. - [Forward logs from Cortex XDR to external services](https://cortex-docs.paloaltonetworks.com/cortex-xdr-3.x/cortex-xdr-3.x-documentation/onboard-and-configure-cortex-xdr/post-deployment-steps/set-up-your-environment/log-forwarding/forward-logs-from-cortex-xdr-to-external-services.md): Learn how to forward logs from Cortex XDR to external services such as email, Slack, or a syslog receiver. - [Integrate a syslog receiver](https://cortex-docs.paloaltonetworks.com/cortex-xdr-3.x/cortex-xdr-3.x-documentation/onboard-and-configure-cortex-xdr/post-deployment-steps/set-up-your-environment/log-forwarding/forward-logs-from-cortex-xdr-to-external-services/integrate-a-syslog-receiver.md): Define syslog settings and then configure notification forwarding to receive notifications about alerts and reports. - [Integrate Slack for outbound notifications](https://cortex-docs.paloaltonetworks.com/cortex-xdr-3.x/cortex-xdr-3.x-documentation/onboard-and-configure-cortex-xdr/post-deployment-steps/set-up-your-environment/log-forwarding/forward-logs-from-cortex-xdr-to-external-services/integrate-slack-for-outbound-notifications.md): Learn how to integrate Cortex XDR with your Slack workspace and stay updated on important alerts and events. - [Configure notification forwarding](https://cortex-docs.paloaltonetworks.com/cortex-xdr-3.x/cortex-xdr-3.x-documentation/onboard-and-configure-cortex-xdr/post-deployment-steps/set-up-your-environment/log-forwarding/forward-logs-from-cortex-xdr-to-external-services/configure-notification-forwarding.md): Learn how to create a forwarding configuration that specifies the log type you want to forward. - [Monitor administrative activity](https://cortex-docs.paloaltonetworks.com/cortex-xdr-3.x/cortex-xdr-3.x-documentation/onboard-and-configure-cortex-xdr/post-deployment-steps/set-up-your-environment/log-forwarding/forward-logs-from-cortex-xdr-to-external-services/monitor-administrative-activity.md): View all Cortex XDR administrator-initiated actions taken on alerts, incidents, and live terminal sessions. - [Log notification formats](https://cortex-docs.paloaltonetworks.com/cortex-xdr-3.x/cortex-xdr-3.x-documentation/onboard-and-configure-cortex-xdr/post-deployment-steps/set-up-your-environment/log-forwarding/log-notification-formats.md): Cortex XDR provides you with different formats for its log notifications. - [Management audit log messages](https://cortex-docs.paloaltonetworks.com/cortex-xdr-3.x/cortex-xdr-3.x-documentation/onboard-and-configure-cortex-xdr/post-deployment-steps/set-up-your-environment/log-forwarding/log-notification-formats/management-audit-log-messages.md): View the types of Cortex XDR management audit log messages that are sent. - [Alert notification format](https://cortex-docs.paloaltonetworks.com/cortex-xdr-3.x/cortex-xdr-3.x-documentation/onboard-and-configure-cortex-xdr/post-deployment-steps/set-up-your-environment/log-forwarding/log-notification-formats/alert-notification-format.md): Learn about the formats used to forward Cortex XDR agent, BIOC, IOC, analytics, correlation, and third-party alerts. - [Agent Audit log notification format](https://cortex-docs.paloaltonetworks.com/cortex-xdr-3.x/cortex-xdr-3.x-documentation/onboard-and-configure-cortex-xdr/post-deployment-steps/set-up-your-environment/log-forwarding/log-notification-formats/agent-audit-log-notification-format.md): An email account or a syslog receiver are the notification channels through which the Agent Audit log is communicated. - [Management Audit log notification format](https://cortex-docs.paloaltonetworks.com/cortex-xdr-3.x/cortex-xdr-3.x-documentation/onboard-and-configure-cortex-xdr/post-deployment-steps/set-up-your-environment/log-forwarding/log-notification-formats/management-audit-log-notification-format.md): An email account or a syslog receiver are the notification channels through which the Management Audit log is communicated. - [Log format for IOC and BIOC alerts](https://cortex-docs.paloaltonetworks.com/cortex-xdr-3.x/cortex-xdr-3.x-documentation/onboard-and-configure-cortex-xdr/post-deployment-steps/set-up-your-environment/log-forwarding/log-notification-formats/log-format-for-ioc-and-bioc-alerts.md): An email account or a syslog receiver are the notification channels through which IOC and BIOC alerts are communicated. - [Analytics log format](https://cortex-docs.paloaltonetworks.com/cortex-xdr-3.x/cortex-xdr-3.x-documentation/onboard-and-configure-cortex-xdr/post-deployment-steps/set-up-your-environment/log-forwarding/log-notification-formats/analytics-log-format.md): Learn about the syntax and different variables that are used in the analytics log format. - [Log formats](https://cortex-docs.paloaltonetworks.com/cortex-xdr-3.x/cortex-xdr-3.x-documentation/onboard-and-configure-cortex-xdr/post-deployment-steps/set-up-your-environment/log-forwarding/log-notification-formats/log-formats.md): Learn about the different log formats that Cortex XDR can forward to an external server or email account. - [Automation rules](https://cortex-docs.paloaltonetworks.com/cortex-xdr-3.x/cortex-xdr-3.x-documentation/onboard-and-configure-cortex-xdr/post-deployment-steps/set-up-your-environment/automation-rules.md): Use automation rules to define alert conditions that trigger an action that you specify within the rule. - [Manage automation rules](https://cortex-docs.paloaltonetworks.com/cortex-xdr-3.x/cortex-xdr-3.x-documentation/onboard-and-configure-cortex-xdr/post-deployment-steps/set-up-your-environment/automation-rules/manage-automation-rules.md): Learn how to manage automation rules for Cortex XDR. - [Automation settings](https://cortex-docs.paloaltonetworks.com/cortex-xdr-3.x/cortex-xdr-3.x-documentation/onboard-and-configure-cortex-xdr/post-deployment-steps/set-up-your-environment/automation-rules/automation-settings.md): Threshold limits may be implemented for settings of automation rules. - [Automation rule actions](https://cortex-docs.paloaltonetworks.com/cortex-xdr-3.x/cortex-xdr-3.x-documentation/onboard-and-configure-cortex-xdr/post-deployment-steps/set-up-your-environment/automation-rules/automation-rule-actions.md): Includes the list of actions to take when the alert condition of the automation rule is triggered for Cortex XDR. - [Automation Audit Log](https://cortex-docs.paloaltonetworks.com/cortex-xdr-3.x/cortex-xdr-3.x-documentation/onboard-and-configure-cortex-xdr/post-deployment-steps/set-up-your-environment/automation-rules/automation-audit-log.md): Includes the list of fields included in the Automation Audit Log for Cortex XDR. - [Manage user roles and access management](https://cortex-docs.paloaltonetworks.com/cortex-xdr-3.x/cortex-xdr-3.x-documentation/onboard-and-configure-cortex-xdr/post-deployment-steps/manage-user-roles-and-access-management.md): Learn how to manage access for users, user roles, user groups, and Single Sign-On (SSO) for users on a specific Cortex XDR tenant. - [Manage user roles](https://cortex-docs.paloaltonetworks.com/cortex-xdr-3.x/cortex-xdr-3.x-documentation/onboard-and-configure-cortex-xdr/post-deployment-steps/manage-user-roles-and-access-management/manage-user-roles.md): Manage user roles that are assigned to Cortex XDR users or user groups in Cortex XDR Access Management. - [Manage user access](https://cortex-docs.paloaltonetworks.com/cortex-xdr-3.x/cortex-xdr-3.x-documentation/onboard-and-configure-cortex-xdr/post-deployment-steps/manage-user-roles-and-access-management/manage-user-access.md): Manage access permissions for Cortex XDR users. - [User access reference information](https://cortex-docs.paloaltonetworks.com/cortex-xdr-3.x/cortex-xdr-3.x-documentation/onboard-and-configure-cortex-xdr/post-deployment-steps/manage-user-roles-and-access-management/manage-user-access/user-access-reference-information.md) - [Manage user scope](https://cortex-docs.paloaltonetworks.com/cortex-xdr-3.x/cortex-xdr-3.x-documentation/onboard-and-configure-cortex-xdr/post-deployment-steps/manage-user-roles-and-access-management/manage-user-scope.md): Learn about Scope-Based Access Control (SBAC) and how to assign users to specific tags of different types in your organization. - [XQL query management](https://cortex-docs.paloaltonetworks.com/cortex-xdr-3.x/cortex-xdr-3.x-documentation/onboard-and-configure-cortex-xdr/post-deployment-steps/xql-query-management.md): Administrators can set controls on running XQL queries. - [Dashboards and reports](https://cortex-docs.paloaltonetworks.com/cortex-xdr-3.x/cortex-xdr-3.x-documentation/onboard-and-configure-cortex-xdr/post-deployment-steps/dashboards-and-reports.md) - [Endpoint security](https://cortex-docs.paloaltonetworks.com/cortex-xdr-3.x/cortex-xdr-3.x-documentation/endpoint-security.md): Learn about configuring and managing endpoint security. - [Endpoint protection](https://cortex-docs.paloaltonetworks.com/cortex-xdr-3.x/cortex-xdr-3.x-documentation/endpoint-security/endpoint-protection.md): This topic provides an overview of traditional endpoint protection versus the protection of endpoints using Cortex XDR. - [Malware protection](https://cortex-docs.paloaltonetworks.com/cortex-xdr-3.x/cortex-xdr-3.x-documentation/endpoint-security/endpoint-protection/malware-protection.md): Cortex XDR prevents malware attacks and provides protection on endpoints based on the different operating systems. - [Exploit protection](https://cortex-docs.paloaltonetworks.com/cortex-xdr-3.x/cortex-xdr-3.x-documentation/endpoint-security/endpoint-protection/exploit-protection.md): Cortex XDR prevents exploit attempts and provides protection on endpoints based on the different operating systems. - [File analysis and protection flow](https://cortex-docs.paloaltonetworks.com/cortex-xdr-3.x/cortex-xdr-3.x-documentation/endpoint-security/endpoint-protection/file-analysis-and-protection-flow.md): The Cortex XDR agent utilizes advanced multi-method protection and prevention techniques to protect from both known and unknown malware and software exploits. - [Endpoint protection capabilities](https://cortex-docs.paloaltonetworks.com/cortex-xdr-3.x/cortex-xdr-3.x-documentation/endpoint-security/endpoint-protection/endpoint-protection-capabilities.md): The endpoint protection capabilities vary depending on the platform (operating system) that is used on each of your endpoints. - [Endpoint protection modules](https://cortex-docs.paloaltonetworks.com/cortex-xdr-3.x/cortex-xdr-3.x-documentation/endpoint-security/endpoint-protection/endpoint-protection-modules.md): Security modules are activated for your endpoints depending on the chosen security profile and the operating system on the endpoint. - [Processes protected by exploit security policy](https://cortex-docs.paloaltonetworks.com/cortex-xdr-3.x/cortex-xdr-3.x-documentation/endpoint-security/endpoint-protection/processes-protected-by-exploit-security-policy.md): Application processes that run on your endpoint are protected by the exploit security policy. - [WildFire analysis concepts](https://cortex-docs.paloaltonetworks.com/cortex-xdr-3.x/cortex-xdr-3.x-documentation/endpoint-security/endpoint-protection/wildfire-analysis-concepts.md): Learn about the analysis concepts used by Wildfire. - [About content updates](https://cortex-docs.paloaltonetworks.com/cortex-xdr-3.x/cortex-xdr-3.x-documentation/endpoint-security/endpoint-protection/about-content-updates.md): To increase security coverage and quickly resolve any issues in policy, Palo Alto Networks can seamlessly deliver software packages called content updates. - [Endpoint data collection](https://cortex-docs.paloaltonetworks.com/cortex-xdr-3.x/cortex-xdr-3.x-documentation/endpoint-security/endpoint-protection/endpoint-data-collection.md): To aid in endpoint detection and alert investigation, the Cortex XDR agent collects endpoint information when an alert is triggered. - [Guidelines for keeping Cortex XDR agents and content updated](https://cortex-docs.paloaltonetworks.com/cortex-xdr-3.x/cortex-xdr-3.x-documentation/endpoint-security/endpoint-protection/guidelines-for-keeping-cortex-xdr-agents-and-content-updated.md): Learn more about how to control Cortex XDR agent and content upgrades. - [Install and manage endpoints](https://cortex-docs.paloaltonetworks.com/cortex-xdr-3.x/cortex-xdr-3.x-documentation/endpoint-security/install-and-manage-endpoints.md): Learn how to set up profiles, policies and other settings for endpoint protection, how to install Cortex XDR agent on endpoints, and how to manage them after installation. - [Set up endpoint protection](https://cortex-docs.paloaltonetworks.com/cortex-xdr-3.x/cortex-xdr-3.x-documentation/endpoint-security/install-and-manage-endpoints/set-up-endpoint-protection.md): Set up endpoint protection profiles and policies, exceptions, endpoint hardening, and other endpoint settings. - [Set up endpoint profiles and exception rules](https://cortex-docs.paloaltonetworks.com/cortex-xdr-3.x/cortex-xdr-3.x-documentation/endpoint-security/install-and-manage-endpoints/set-up-endpoint-protection/set-up-endpoint-profiles-and-exception-rules.md): Endpoint security profiles can be used immediately, or customized, to protect your endpoints from threats. - [Set up malware prevention profiles](https://cortex-docs.paloaltonetworks.com/cortex-xdr-3.x/cortex-xdr-3.x-documentation/endpoint-security/install-and-manage-endpoints/set-up-endpoint-protection/set-up-endpoint-profiles-and-exception-rules/set-up-malware-prevention-profiles.md): Configure malware prevention profiles to control the actions taken by Cortex XDR agents when known malware, macros, and unknown files try to run. - [Set up exploit prevention profiles](https://cortex-docs.paloaltonetworks.com/cortex-xdr-3.x/cortex-xdr-3.x-documentation/endpoint-security/install-and-manage-endpoints/set-up-endpoint-protection/set-up-endpoint-profiles-and-exception-rules/set-up-exploit-prevention-profiles.md): Exploit prevention profiles control the action that the Cortex XDR agent takes when attempts to exploit software vulnerabilities or flaws occur. - [Set up agent settings profiles](https://cortex-docs.paloaltonetworks.com/cortex-xdr-3.x/cortex-xdr-3.x-documentation/endpoint-security/install-and-manage-endpoints/set-up-endpoint-protection/set-up-endpoint-profiles-and-exception-rules/set-up-agent-settings-profiles.md): Use agent settings profiles to customize Cortex XDR agent settings for different platforms and groups of users. - [Set up restrictions prevention profiles](https://cortex-docs.paloaltonetworks.com/cortex-xdr-3.x/cortex-xdr-3.x-documentation/endpoint-security/install-and-manage-endpoints/set-up-endpoint-protection/set-up-endpoint-profiles-and-exception-rules/set-up-restrictions-prevention-profiles.md): Restrictions prevention profiles limit where executables can run on an endpoint. - [Set up exception profiles and rules](https://cortex-docs.paloaltonetworks.com/cortex-xdr-3.x/cortex-xdr-3.x-documentation/endpoint-security/install-and-manage-endpoints/set-up-endpoint-protection/set-up-endpoint-profiles-and-exception-rules/set-up-exception-profiles-and-rules.md): Exception profiles can be configured to override security policies for known processes, files, digital signers, URLs, BTP rules, telephone numbers, and other exceptions. - [Exception configuration](https://cortex-docs.paloaltonetworks.com/cortex-xdr-3.x/cortex-xdr-3.x-documentation/endpoint-security/install-and-manage-endpoints/set-up-endpoint-protection/set-up-endpoint-profiles-and-exception-rules/set-up-exception-profiles-and-rules/exception-configuration.md): Learn how to configure exceptions from your baseline policy. - [Alert exclusions](https://cortex-docs.paloaltonetworks.com/cortex-xdr-3.x/cortex-xdr-3.x-documentation/endpoint-security/install-and-manage-endpoints/set-up-endpoint-protection/set-up-endpoint-profiles-and-exception-rules/set-up-exception-profiles-and-rules/alert-exclusions.md): Learn how to review and manage alert exclusions. - [Add an alert exclusion rule](https://cortex-docs.paloaltonetworks.com/cortex-xdr-3.x/cortex-xdr-3.x-documentation/endpoint-security/install-and-manage-endpoints/set-up-endpoint-protection/set-up-endpoint-profiles-and-exception-rules/set-up-exception-profiles-and-rules/alert-exclusions/add-an-alert-exclusion-rule.md): Learn how to create a rule to exclude certain criteria from raising alerts in Cortex XDR. - [Add an IOC or BIOC rule exception](https://cortex-docs.paloaltonetworks.com/cortex-xdr-3.x/cortex-xdr-3.x-documentation/endpoint-security/install-and-manage-endpoints/set-up-endpoint-protection/set-up-endpoint-profiles-and-exception-rules/set-up-exception-profiles-and-rules/add-an-ioc-or-bioc-rule-exception.md): Learn how to add an IOC or BIOC rule exception. - [Add a disable prevention rule](https://cortex-docs.paloaltonetworks.com/cortex-xdr-3.x/cortex-xdr-3.x-documentation/endpoint-security/install-and-manage-endpoints/set-up-endpoint-protection/set-up-endpoint-profiles-and-exception-rules/set-up-exception-profiles-and-rules/add-a-disable-prevention-rule.md): You can create granular exceptions to prevention actions defined for your endpoints. - [Add a disable injection and prevention rule](https://cortex-docs.paloaltonetworks.com/cortex-xdr-3.x/cortex-xdr-3.x-documentation/endpoint-security/install-and-manage-endpoints/set-up-endpoint-protection/set-up-endpoint-profiles-and-exception-rules/set-up-exception-profiles-and-rules/add-a-disable-injection-and-prevention-rule.md): You can generate a temporary exception to bypass a process from prevention modules and injections. - [Add a support exception rule](https://cortex-docs.paloaltonetworks.com/cortex-xdr-3.x/cortex-xdr-3.x-documentation/endpoint-security/install-and-manage-endpoints/set-up-endpoint-protection/set-up-endpoint-profiles-and-exception-rules/set-up-exception-profiles-and-rules/add-a-support-exception-rule.md): Learn how to add a support exception rule. - [Add a legacy exception rule](https://cortex-docs.paloaltonetworks.com/cortex-xdr-3.x/cortex-xdr-3.x-documentation/endpoint-security/install-and-manage-endpoints/set-up-endpoint-protection/set-up-endpoint-profiles-and-exception-rules/set-up-exception-profiles-and-rules/add-a-legacy-exception-rule.md): Learn how to use Cortex XDR Legacy Exception rules to configure an exception to prevention and protection modules on endpoints for selected profiles. - [Add a new exceptions security profile](https://cortex-docs.paloaltonetworks.com/cortex-xdr-3.x/cortex-xdr-3.x-documentation/endpoint-security/install-and-manage-endpoints/set-up-endpoint-protection/set-up-endpoint-profiles-and-exception-rules/set-up-exception-profiles-and-rules/add-a-legacy-exception-rule/add-a-new-exceptions-security-profile.md): Learn how to add a new exceptions security profile. - [Add a global endpoint policy exception](https://cortex-docs.paloaltonetworks.com/cortex-xdr-3.x/cortex-xdr-3.x-documentation/endpoint-security/install-and-manage-endpoints/set-up-endpoint-protection/set-up-endpoint-profiles-and-exception-rules/set-up-exception-profiles-and-rules/add-a-legacy-exception-rule/add-a-global-endpoint-policy-exception.md): Learn how to define and manage global endpoint policy exceptions in Cortex XDR. - [Define endpoint groups](https://cortex-docs.paloaltonetworks.com/cortex-xdr-3.x/cortex-xdr-3.x-documentation/endpoint-security/install-and-manage-endpoints/set-up-endpoint-protection/define-endpoint-groups.md): Define an endpoint group and then apply policy rules and manage specific endpoints. - [Configure global agent settings](https://cortex-docs.paloaltonetworks.com/cortex-xdr-3.x/cortex-xdr-3.x-documentation/endpoint-security/install-and-manage-endpoints/set-up-endpoint-protection/configure-global-agent-settings.md): Learn how to configure the Cortex XDR agent global settings that operate on your endpoints. - [Apply profiles to endpoints](https://cortex-docs.paloaltonetworks.com/cortex-xdr-3.x/cortex-xdr-3.x-documentation/endpoint-security/install-and-manage-endpoints/set-up-endpoint-protection/apply-profiles-to-endpoints.md): Learn how to apply security profiles to your endpoints, depending on the platform used. - [Create an agent installation package](https://cortex-docs.paloaltonetworks.com/cortex-xdr-3.x/cortex-xdr-3.x-documentation/endpoint-security/install-and-manage-endpoints/set-up-endpoint-protection/create-an-agent-installation-package.md): Learn how to create a Cortex XDR agent installation package to deploy to your endpoints. - [Manage an agent installation package](https://cortex-docs.paloaltonetworks.com/cortex-xdr-3.x/cortex-xdr-3.x-documentation/endpoint-security/install-and-manage-endpoints/set-up-endpoint-protection/create-an-agent-installation-package/manage-an-agent-installation-package.md): Learn how to make changes such as deleting an agent installation package or editing the package name. - [Harden endpoint security](https://cortex-docs.paloaltonetworks.com/cortex-xdr-3.x/cortex-xdr-3.x-documentation/endpoint-security/install-and-manage-endpoints/set-up-endpoint-protection/harden-endpoint-security.md): By hardening your endpoints with Cortex XDR agent, you can make these endpoints more secure and safer from attackers. - [Device control](https://cortex-docs.paloaltonetworks.com/cortex-xdr-3.x/cortex-xdr-3.x-documentation/endpoint-security/install-and-manage-endpoints/set-up-endpoint-protection/harden-endpoint-security/device-control.md): Protect your Windows and macOS-based endpoints from connecting to malicious USB-connected removable devices, to Bluetooth devices, and to print jobs. - [Host firewall](https://cortex-docs.paloaltonetworks.com/cortex-xdr-3.x/cortex-xdr-3.x-documentation/endpoint-security/install-and-manage-endpoints/set-up-endpoint-protection/harden-endpoint-security/host-firewall.md): Control communications on your endpoints based on the network location of your device by using the Cortex XDR host firewall. - [Host firewall for Windows](https://cortex-docs.paloaltonetworks.com/cortex-xdr-3.x/cortex-xdr-3.x-documentation/endpoint-security/install-and-manage-endpoints/set-up-endpoint-protection/harden-endpoint-security/host-firewall/host-firewall-for-windows.md): Control communications on your endpoints based on the network location of your device by using the host firewall. - [Host firewall for macOS](https://cortex-docs.paloaltonetworks.com/cortex-xdr-3.x/cortex-xdr-3.x-documentation/endpoint-security/install-and-manage-endpoints/set-up-endpoint-protection/harden-endpoint-security/host-firewall/host-firewall-for-macos.md): Control communications on your endpoints based on the network location of your device by using the host firewall. - [Disk encryption](https://cortex-docs.paloaltonetworks.com/cortex-xdr-3.x/cortex-xdr-3.x-documentation/endpoint-security/install-and-manage-endpoints/set-up-endpoint-protection/harden-endpoint-security/disk-encryption.md): For enhanced security, you can configure and apply disk encryption profiles to the disks of your Windows and Mac endpoints. - [Host Inventory](https://cortex-docs.paloaltonetworks.com/cortex-xdr-3.x/cortex-xdr-3.x-documentation/endpoint-security/install-and-manage-endpoints/set-up-endpoint-protection/harden-endpoint-security/host-inventory.md): Review the inventory of all your hosts (endpoints), and identify in the inventory any IT and security issues in your network. - [Vulnerability Assessment](https://cortex-docs.paloaltonetworks.com/cortex-xdr-3.x/cortex-xdr-3.x-documentation/endpoint-security/install-and-manage-endpoints/set-up-endpoint-protection/harden-endpoint-security/vulnerability-assessment.md): Perform a vulnerability assessment of all endpoints in your network using Cortex XDR. This includes CVE, endpoint, and application analysis. - [Set a Cortex XDR agent Critical Environment version](https://cortex-docs.paloaltonetworks.com/cortex-xdr-3.x/cortex-xdr-3.x-documentation/endpoint-security/install-and-manage-endpoints/set-up-endpoint-protection/set-a-cortex-xdr-agent-critical-environment-version.md): Set the Cortex XDR agent as a Critical Environment (CE) version. - [Set an application proxy for Cortex XDR agents](https://cortex-docs.paloaltonetworks.com/cortex-xdr-3.x/cortex-xdr-3.x-documentation/endpoint-security/install-and-manage-endpoints/set-up-endpoint-protection/set-an-application-proxy-for-cortex-xdr-agents.md): Set an application-specific proxy for the Cortex XDR agent without affecting the communication of other applications on the endpoint. - [Pairing Prisma Cloud Compute with Cortex XDR](https://cortex-docs.paloaltonetworks.com/cortex-xdr-3.x/cortex-xdr-3.x-documentation/endpoint-security/install-and-manage-endpoints/set-up-endpoint-protection/pairing-prisma-cloud-compute-with-cortex-xdr.md): Learn how to pair Prisma Cloud Compute with Cortex XDR for use with the Cortex XDR Agent for Cloud. - [Manage endpoint protection](https://cortex-docs.paloaltonetworks.com/cortex-xdr-3.x/cortex-xdr-3.x-documentation/endpoint-security/install-and-manage-endpoints/manage-endpoint-protection.md) - [Manage endpoint tags](https://cortex-docs.paloaltonetworks.com/cortex-xdr-3.x/cortex-xdr-3.x-documentation/endpoint-security/install-and-manage-endpoints/manage-endpoint-protection/manage-endpoint-tags.md): Segment your endpoints according to dynamic tags. - [Set an alias for an endpoint](https://cortex-docs.paloaltonetworks.com/cortex-xdr-3.x/cortex-xdr-3.x-documentation/endpoint-security/install-and-manage-endpoints/manage-endpoint-protection/set-an-alias-for-an-endpoint.md): Configure an alias to identify one or more endpoints by a name that is different from the endpoint hostname. - [Manage endpoint prevention profiles](https://cortex-docs.paloaltonetworks.com/cortex-xdr-3.x/cortex-xdr-3.x-documentation/endpoint-security/install-and-manage-endpoints/manage-endpoint-protection/manage-endpoint-prevention-profiles.md): You can manage the endpoint prevention profiles of your Cortex XDR agent endpoints in various ways, including editing, duplicating, and populating endpoint prevention policy rules. - [Upgrade Cortex XDR agents](https://cortex-docs.paloaltonetworks.com/cortex-xdr-3.x/cortex-xdr-3.x-documentation/endpoint-security/install-and-manage-endpoints/manage-endpoint-protection/upgrade-cortex-xdr-agents.md): You can upgrade the Cortex XDR agent software by using the appropriate method for the endpoint operating system. - [Restart agent](https://cortex-docs.paloaltonetworks.com/cortex-xdr-3.x/cortex-xdr-3.x-documentation/endpoint-security/install-and-manage-endpoints/manage-endpoint-protection/restart-agent.md): Learn how to restart the agent on the endpoint. - [Uninstall the Cortex XDR agent](https://cortex-docs.paloaltonetworks.com/cortex-xdr-3.x/cortex-xdr-3.x-documentation/endpoint-security/install-and-manage-endpoints/manage-endpoint-protection/uninstall-the-cortex-xdr-agent.md): Uninstall Cortex XDR agent from one or more endpoints at any time using the Action Center, or one-by-one using the All Endpoints page. - [Delete Cortex XDR agents](https://cortex-docs.paloaltonetworks.com/cortex-xdr-3.x/cortex-xdr-3.x-documentation/endpoint-security/install-and-manage-endpoints/manage-endpoint-protection/delete-cortex-xdr-agents.md): Delete endpoints from Cortex XDR tenant views. - [Manage agent tokens](https://cortex-docs.paloaltonetworks.com/cortex-xdr-3.x/cortex-xdr-3.x-documentation/endpoint-security/install-and-manage-endpoints/manage-endpoint-protection/manage-agent-tokens.md): Manage tokens per agent to retrieve the password used to run functions at the agent. - [Retrieve support file password](https://cortex-docs.paloaltonetworks.com/cortex-xdr-3.x/cortex-xdr-3.x-documentation/endpoint-security/install-and-manage-endpoints/manage-endpoint-protection/retrieve-support-file-password.md): Learn how to retrieve the password to access files from the Tech Support File (TSF), which is generated in a zip format protected by an encrypted password. - [Move agents between managing servers](https://cortex-docs.paloaltonetworks.com/cortex-xdr-3.x/cortex-xdr-3.x-documentation/endpoint-security/install-and-manage-endpoints/manage-endpoint-protection/move-agents-between-managing-servers.md): You can move Cortex XDR agents to other Cortex XDR managing servers. - [Clear agent database](https://cortex-docs.paloaltonetworks.com/cortex-xdr-3.x/cortex-xdr-3.x-documentation/endpoint-security/install-and-manage-endpoints/manage-endpoint-protection/clear-agent-database.md): Learn how to clear the Cortex XDR agent database. - [Send push notifications to iOS](https://cortex-docs.paloaltonetworks.com/cortex-xdr-3.x/cortex-xdr-3.x-documentation/endpoint-security/install-and-manage-endpoints/manage-endpoint-protection/send-push-notifications-to-ios.md): Learn how to send push notifications to an iOS endpoint. - [Monitor agent operational status](https://cortex-docs.paloaltonetworks.com/cortex-xdr-3.x/cortex-xdr-3.x-documentation/endpoint-security/install-and-manage-endpoints/manage-endpoint-protection/monitor-agent-operational-status.md): You can view the operational status of any Cortex XDR agent that you manage. - [Monitor agent activity](https://cortex-docs.paloaltonetworks.com/cortex-xdr-3.x/cortex-xdr-3.x-documentation/endpoint-security/install-and-manage-endpoints/manage-endpoint-protection/monitor-agent-activity.md): You can monitor the activity of any Cortex XDR Broker VM that you manage. - [Monitor agent upgrade status](https://cortex-docs.paloaltonetworks.com/cortex-xdr-3.x/cortex-xdr-3.x-documentation/endpoint-security/install-and-manage-endpoints/manage-endpoint-protection/monitor-agent-upgrade-status.md) - [Detect threats and analyze data](https://cortex-docs.paloaltonetworks.com/cortex-xdr-3.x/cortex-xdr-3.x-documentation/detect-threats-and-analyze-data.md) - [Detection rules](https://cortex-docs.paloaltonetworks.com/cortex-xdr-3.x/cortex-xdr-3.x-documentation/detect-threats-and-analyze-data/detection-rules.md): Cortex XDR uses rules to detect threats and raise alerts. - [What's an IOC?](https://cortex-docs.paloaltonetworks.com/cortex-xdr-3.x/cortex-xdr-3.x-documentation/detect-threats-and-analyze-data/detection-rules/whats-an-ioc.md): Indicators of compromise (IOCs) alert you about known malicious objects on your endpoints. - [IOC rule details](https://cortex-docs.paloaltonetworks.com/cortex-xdr-3.x/cortex-xdr-3.x-documentation/detect-threats-and-analyze-data/detection-rules/whats-an-ioc/ioc-rule-details.md): Manage all indicators of compromise (IOCs) configured from or uploaded to Cortex XDR. - [Create an IOC rule](https://cortex-docs.paloaltonetworks.com/cortex-xdr-3.x/cortex-xdr-3.x-documentation/detect-threats-and-analyze-data/detection-rules/whats-an-ioc/create-an-ioc-rule.md): From the Cortex XDR management console, you can upload or configure indicator of compromise (IOC) rules criteria. - [What's a BIOC?](https://cortex-docs.paloaltonetworks.com/cortex-xdr-3.x/cortex-xdr-3.x-documentation/detect-threats-and-analyze-data/detection-rules/whats-a-bioc.md): Behavioral indicators of compromise (BIOCs) alert you to respond to potentially compromising behaviors. - [BIOC rule details](https://cortex-docs.paloaltonetworks.com/cortex-xdr-3.x/cortex-xdr-3.x-documentation/detect-threats-and-analyze-data/detection-rules/whats-a-bioc/bioc-rule-details.md): From the Cortex XDR management console, you can define your own rules based on behavior with the behavioral indicator of compromise (BIOC) rules. - [Create a BIOC rule](https://cortex-docs.paloaltonetworks.com/cortex-xdr-3.x/cortex-xdr-3.x-documentation/detect-threats-and-analyze-data/detection-rules/whats-a-bioc/create-a-bioc-rule.md): You can configure rules for behavioral indicators of compromise (BIOCs) to trigger an alert on an identified threat. - [Manage Global BIOC Rules](https://cortex-docs.paloaltonetworks.com/cortex-xdr-3.x/cortex-xdr-3.x-documentation/detect-threats-and-analyze-data/detection-rules/whats-a-bioc/manage-global-bioc-rules.md): Update and copy BIOC rules, and add rule exceptions in Cortex XDR. - [What's a correlation rule?](https://cortex-docs.paloaltonetworks.com/cortex-xdr-3.x/cortex-xdr-3.x-documentation/detect-threats-and-analyze-data/detection-rules/whats-a-correlation-rule.md) - [Correlation rule details](https://cortex-docs.paloaltonetworks.com/cortex-xdr-3.x/cortex-xdr-3.x-documentation/detect-threats-and-analyze-data/detection-rules/whats-a-correlation-rule/correlation-rule-details.md): In the Correlation Rules page, you can view all of your enabled rules in a table format and the various fields displayed. - [Create a correlation rule](https://cortex-docs.paloaltonetworks.com/cortex-xdr-3.x/cortex-xdr-3.x-documentation/detect-threats-and-analyze-data/detection-rules/whats-a-correlation-rule/create-a-correlation-rule.md): Create new correlation rules from either the Correlation Rules page or when building a query in XQL Search, or import a many correlation rules from a file. - [Field replacement syntax in correlation rules](https://cortex-docs.paloaltonetworks.com/cortex-xdr-3.x/cortex-xdr-3.x-documentation/detect-threats-and-analyze-data/detection-rules/whats-a-correlation-rule/field-replacement-syntax-in-correlation-rules.md): Learn more about how to use field replacement syntax when creating correlation rules. - [Manage correlation rules](https://cortex-docs.paloaltonetworks.com/cortex-xdr-3.x/cortex-xdr-3.x-documentation/detect-threats-and-analyze-data/detection-rules/whats-a-correlation-rule/manage-correlation-rules.md): View and manage your correlation rules - [Monitor correlation rules](https://cortex-docs.paloaltonetworks.com/cortex-xdr-3.x/cortex-xdr-3.x-documentation/detect-threats-and-analyze-data/detection-rules/whats-a-correlation-rule/monitor-correlation-rules.md): You can monitor your correlation executions with the correlations\_auditing dataset. - [Troubleshoot server errors in scheduled correlation rules](https://cortex-docs.paloaltonetworks.com/cortex-xdr-3.x/cortex-xdr-3.x-documentation/detect-threats-and-analyze-data/detection-rules/whats-a-correlation-rule/troubleshoot-server-errors-in-scheduled-correlation-rules.md): Learn more about how to troubleshoot server errors in scheduled correlation rules. - [Manage existing indicators](https://cortex-docs.paloaltonetworks.com/cortex-xdr-3.x/cortex-xdr-3.x-documentation/detect-threats-and-analyze-data/detection-rules/manage-existing-indicators.md): Edit, export, copy, disable, or remove rules, and add rule exceptions for existing indicators in Cortex XDR. - [Analytics](https://cortex-docs.paloaltonetworks.com/cortex-xdr-3.x/cortex-xdr-3.x-documentation/detect-threats-and-analyze-data/analytics.md): Cortex XDR uses an Analytics engine to examine logs and data from your sensors. - [Analytics engine](https://cortex-docs.paloaltonetworks.com/cortex-xdr-3.x/cortex-xdr-3.x-documentation/detect-threats-and-analyze-data/analytics/analytics-engine.md) - [Analytics sensors](https://cortex-docs.paloaltonetworks.com/cortex-xdr-3.x/cortex-xdr-3.x-documentation/detect-threats-and-analyze-data/analytics/analytics-sensors.md) - [Coverage of MITRE Attack tactics](https://cortex-docs.paloaltonetworks.com/cortex-xdr-3.x/cortex-xdr-3.x-documentation/detect-threats-and-analyze-data/analytics/coverage-of-mitre-attack-tactics.md) - [Analytics detection time intervals](https://cortex-docs.paloaltonetworks.com/cortex-xdr-3.x/cortex-xdr-3.x-documentation/detect-threats-and-analyze-data/analytics/analytics-detection-time-intervals.md) - [Analytics alerts and Analytics BIOCs](https://cortex-docs.paloaltonetworks.com/cortex-xdr-3.x/cortex-xdr-3.x-documentation/detect-threats-and-analyze-data/analytics/analytics-alerts-and-analytics-biocs.md) - [View and manage Analytics rules](https://cortex-docs.paloaltonetworks.com/cortex-xdr-3.x/cortex-xdr-3.x-documentation/detect-threats-and-analyze-data/analytics/view-and-manage-analytics-rules.md): View and manage all Analytics rules - [Identity Analytics](https://cortex-docs.paloaltonetworks.com/cortex-xdr-3.x/cortex-xdr-3.x-documentation/detect-threats-and-analyze-data/analytics/identity-analytics.md) - [Identity Threat Module](https://cortex-docs.paloaltonetworks.com/cortex-xdr-3.x/cortex-xdr-3.x-documentation/detect-threats-and-analyze-data/analytics/identity-threat-module.md) - [Forensic investigations](https://cortex-docs.paloaltonetworks.com/cortex-xdr-3.x/cortex-xdr-3.x-documentation/detect-threats-and-analyze-data/forensic-investigations.md): Learn about forensics, how to create forensic investigations, how to create and manage data collections, and how to assess other forensic related settings. - [Manage an investigation](https://cortex-docs.paloaltonetworks.com/cortex-xdr-3.x/cortex-xdr-3.x-documentation/detect-threats-and-analyze-data/forensic-investigations/manage-an-investigation.md): Manage an investigation by adding collections, managing alerts, adjusting the timeline, analyzing assets and artifacts. - [Create a new investigation](https://cortex-docs.paloaltonetworks.com/cortex-xdr-3.x/cortex-xdr-3.x-documentation/detect-threats-and-analyze-data/forensic-investigations/manage-an-investigation/create-a-new-investigation.md): Learn how to create a forensics investigation. This includes adding a collection, exporting the data collection, managing alerts and key assets & artifacts. - [Edit an investigation](https://cortex-docs.paloaltonetworks.com/cortex-xdr-3.x/cortex-xdr-3.x-documentation/detect-threats-and-analyze-data/forensic-investigations/manage-an-investigation/edit-an-investigation.md): Edit an existing investigation from the Forensic Investigations page. - [Close an investigation](https://cortex-docs.paloaltonetworks.com/cortex-xdr-3.x/cortex-xdr-3.x-documentation/detect-threats-and-analyze-data/forensic-investigations/manage-an-investigation/close-an-investigation.md): Close an existing investigation from the Forensic Investigations page. - [User permissions](https://cortex-docs.paloaltonetworks.com/cortex-xdr-3.x/cortex-xdr-3.x-documentation/detect-threats-and-analyze-data/forensic-investigations/manage-an-investigation/user-permissions.md): You can assign users to the investigation for them to view and manage the investigation. - [Data collection](https://cortex-docs.paloaltonetworks.com/cortex-xdr-3.x/cortex-xdr-3.x-documentation/detect-threats-and-analyze-data/forensic-investigations/data-collection.md) - [Hunting](https://cortex-docs.paloaltonetworks.com/cortex-xdr-3.x/cortex-xdr-3.x-documentation/detect-threats-and-analyze-data/forensic-investigations/data-collection/hunting.md): Search for specific data across a large number of hosts. - [Create a hunt](https://cortex-docs.paloaltonetworks.com/cortex-xdr-3.x/cortex-xdr-3.x-documentation/detect-threats-and-analyze-data/forensic-investigations/data-collection/hunting/create-a-hunt.md): Hunt collections enable you to search endpoints for suspicious activity to contribute to helping resolve the investigation. - [Hunt results](https://cortex-docs.paloaltonetworks.com/cortex-xdr-3.x/cortex-xdr-3.x-documentation/detect-threats-and-analyze-data/forensic-investigations/data-collection/hunting/hunt-results.md): The hunt results page consolidates information collected by the Cortex XDR agent enabling you to investigate and take action on your endpoints. - [Hunt status](https://cortex-docs.paloaltonetworks.com/cortex-xdr-3.x/cortex-xdr-3.x-documentation/detect-threats-and-analyze-data/forensic-investigations/data-collection/hunting/hunt-status.md): In the Actions table, you can scroll or use the filters to see the status of any search within a hunt across any of the targeted endpoints. - [Triage](https://cortex-docs.paloaltonetworks.com/cortex-xdr-3.x/cortex-xdr-3.x-documentation/detect-threats-and-analyze-data/forensic-investigations/data-collection/triage.md): Triage collection gathers a wide range of artifacts that can be used to help understand the event that occurred on an endpoint. - [Create a triage](https://cortex-docs.paloaltonetworks.com/cortex-xdr-3.x/cortex-xdr-3.x-documentation/detect-threats-and-analyze-data/forensic-investigations/data-collection/triage/create-a-triage.md): Triage collections enable you to obtain additional information for certain activities that have occurred on the endpoints. This helps towards the forensics analytics of an investigation. - [Upload an offline triage package](https://cortex-docs.paloaltonetworks.com/cortex-xdr-3.x/cortex-xdr-3.x-documentation/detect-threats-and-analyze-data/forensic-investigations/data-collection/triage/upload-an-offline-triage-package.md): Use the Upload Offline Triage to upload archives containing forensic data collected by the offline collector. - [Offline triage collection](https://cortex-docs.paloaltonetworks.com/cortex-xdr-3.x/cortex-xdr-3.x-documentation/detect-threats-and-analyze-data/forensic-investigations/data-collection/triage/offline-triage-collection.md): Offline triage collection is supported for endpoints with no network connection or no Cortex XDR agent currently installed. - [Triage results](https://cortex-docs.paloaltonetworks.com/cortex-xdr-3.x/cortex-xdr-3.x-documentation/detect-threats-and-analyze-data/forensic-investigations/data-collection/triage/triage-results.md): You can drill down from the triage collection to review the results. - [Triage status](https://cortex-docs.paloaltonetworks.com/cortex-xdr-3.x/cortex-xdr-3.x-documentation/detect-threats-and-analyze-data/forensic-investigations/data-collection/triage/triage-status.md): From the Actions table, you can view the search status of all the artifacts for the triage. - [Analysis and documentation](https://cortex-docs.paloaltonetworks.com/cortex-xdr-3.x/cortex-xdr-3.x-documentation/detect-threats-and-analyze-data/forensic-investigations/analysis-and-documentation.md): Learn more about your investigation by reviewing the additional data for analysis and documentation purposes. - [Review alerts](https://cortex-docs.paloaltonetworks.com/cortex-xdr-3.x/cortex-xdr-3.x-documentation/detect-threats-and-analyze-data/forensic-investigations/analysis-and-documentation/review-alerts.md): The alerts table displays all the collections within the investigation that has identified suspicious or malicious activity within the forensics data sets. - [Investigation timeline](https://cortex-docs.paloaltonetworks.com/cortex-xdr-3.x/cortex-xdr-3.x-documentation/detect-threats-and-analyze-data/forensic-investigations/analysis-and-documentation/investigation-timeline.md): Investigation timeline shows the tagged forensic artifacts that were tagged. The tags display details of the forensic data collected from the endpoints. - [Key assets & artifacts](https://cortex-docs.paloaltonetworks.com/cortex-xdr-3.x/cortex-xdr-3.x-documentation/detect-threats-and-analyze-data/forensic-investigations/analysis-and-documentation/key-assets-and-artifacts.md): Displays the forensic investigation based on the tagged data and aligns it to the corresponding category. - [Export](https://cortex-docs.paloaltonetworks.com/cortex-xdr-3.x/cortex-xdr-3.x-documentation/detect-threats-and-analyze-data/forensic-investigations/export.md): Select the export option to export data collection for long-term retention or offline analysis. - [Asset management](https://cortex-docs.paloaltonetworks.com/cortex-xdr-3.x/cortex-xdr-3.x-documentation/detect-threats-and-analyze-data/asset-management.md) - [Vulnerability Assessment](https://cortex-docs.paloaltonetworks.com/cortex-xdr-3.x/cortex-xdr-3.x-documentation/detect-threats-and-analyze-data/asset-management/vulnerability-assessment.md): Perform a vulnerability assessment of all endpoints in your network using Cortex XDR. This includes CVE, endpoint, and application analysis. - [Network configuration](https://cortex-docs.paloaltonetworks.com/cortex-xdr-3.x/cortex-xdr-3.x-documentation/detect-threats-and-analyze-data/asset-management/network-configuration.md): Cortex XDR Network Configuration provides a representation of your network assets by collecting and analyzing your network resources. - [Configure your network parameters](https://cortex-docs.paloaltonetworks.com/cortex-xdr-3.x/cortex-xdr-3.x-documentation/detect-threats-and-analyze-data/asset-management/network-configuration/configure-your-network-parameters.md): Define the IP address ranges and domain names used by Cortex XDR to identify your network assets. - [Cloud Compliance](https://cortex-docs.paloaltonetworks.com/cortex-xdr-3.x/cortex-xdr-3.x-documentation/detect-threats-and-analyze-data/asset-management/cloud-compliance.md): Learn more about Cloud Compliance in Cortex XDR. - [Manage Asset Scores](https://cortex-docs.paloaltonetworks.com/cortex-xdr-3.x/cortex-xdr-3.x-documentation/detect-threats-and-analyze-data/asset-management/manage-asset-scores.md): Learn how to view and investigate User Scores and Host Scores using the Asset Scores page. - [Asset Inventory](https://cortex-docs.paloaltonetworks.com/cortex-xdr-3.x/cortex-xdr-3.x-documentation/detect-threats-and-analyze-data/asset-management/asset-inventory.md): From the Cortex XDR management console, you can manage your different network assets. - [All Assets](https://cortex-docs.paloaltonetworks.com/cortex-xdr-3.x/cortex-xdr-3.x-documentation/detect-threats-and-analyze-data/asset-management/asset-inventory/all-assets.md): Cortex XDR enables you to view all external assets from the various asset categories on the All Assets page. - [Specific Assets](https://cortex-docs.paloaltonetworks.com/cortex-xdr-3.x/cortex-xdr-3.x-documentation/detect-threats-and-analyze-data/asset-management/asset-inventory/specific-assets.md): Cortex XDR enables you to view specific external assets from a designated assets category in the Specific Assets page. - [Asset Roles](https://cortex-docs.paloaltonetworks.com/cortex-xdr-3.x/cortex-xdr-3.x-documentation/detect-threats-and-analyze-data/asset-management/asset-roles.md): View asset roles and the number of assets that are associated with each role. Learn how to manage asset roles for users and endpoints. - [Manage Asset Roles for Users](https://cortex-docs.paloaltonetworks.com/cortex-xdr-3.x/cortex-xdr-3.x-documentation/detect-threats-and-analyze-data/asset-management/asset-roles/manage-asset-roles-for-users.md): Learn how to edit the user lists assigned to asset roles. - [Honey user](https://cortex-docs.paloaltonetworks.com/cortex-xdr-3.x/cortex-xdr-3.x-documentation/detect-threats-and-analyze-data/asset-management/asset-roles/manage-asset-roles-for-users/honey-user.md): Honey users are decoy users designed to attract potential attackers. - [Manage Asset Roles for Endpoints](https://cortex-docs.paloaltonetworks.com/cortex-xdr-3.x/cortex-xdr-3.x-documentation/detect-threats-and-analyze-data/asset-management/asset-roles/manage-asset-roles-for-endpoints.md): Learn how to edit the host lists assigned to asset roles. - [Cloud Inventory Assets](https://cortex-docs.paloaltonetworks.com/cortex-xdr-3.x/cortex-xdr-3.x-documentation/detect-threats-and-analyze-data/asset-management/cloud-inventory-assets.md): Cortex XDR provides a unified, normalized asset inventory for cloud assets to provide deeper visibility and context for incident investigation. - [All Cloud Assets](https://cortex-docs.paloaltonetworks.com/cortex-xdr-3.x/cortex-xdr-3.x-documentation/detect-threats-and-analyze-data/asset-management/cloud-inventory-assets/all-cloud-assets.md): Cortex XDR enables you to view all your cloud assets from the various cloud assets categories on the All Cloud Assets page. - [Specific Cloud Assets](https://cortex-docs.paloaltonetworks.com/cortex-xdr-3.x/cortex-xdr-3.x-documentation/detect-threats-and-analyze-data/asset-management/cloud-inventory-assets/specific-cloud-assets.md): Cortex XDR enables you to view specific cloud assets from a designated cloud assets category in the Specific Cloud Asset pages. - [Manage Your Cloud Inventory Assets](https://cortex-docs.paloaltonetworks.com/cortex-xdr-3.x/cortex-xdr-3.x-documentation/detect-threats-and-analyze-data/asset-management/cloud-inventory-assets/manage-your-cloud-inventory-assets.md): Cortex XDR provides a central location to view and investigate information relating to inventory assets in the cloud. - [Configure incidents and alerts](https://cortex-docs.paloaltonetworks.com/cortex-xdr-3.x/cortex-xdr-3.x-documentation/configure-incidents-and-alerts.md) - [External integrations](https://cortex-docs.paloaltonetworks.com/cortex-xdr-3.x/cortex-xdr-3.x-documentation/configure-incidents-and-alerts/external-integrations.md): Gain additional verification on key artifacts by integrating Cortex XDR with other Palo Alto Networks and third-party security products. - [Prioritize incidents with starring and scoring](https://cortex-docs.paloaltonetworks.com/cortex-xdr-3.x/cortex-xdr-3.x-documentation/configure-incidents-and-alerts/prioritize-incidents-with-starring-and-scoring.md): Prioritize and filter your incidents by using incident starring and incident scoring. - [Incident starring](https://cortex-docs.paloaltonetworks.com/cortex-xdr-3.x/cortex-xdr-3.x-documentation/configure-incidents-and-alerts/prioritize-incidents-with-starring-and-scoring/incident-starring.md): Starring incidents can help you to prioritize and filter your incidents. - [Incident scoring](https://cortex-docs.paloaltonetworks.com/cortex-xdr-3.x/cortex-xdr-3.x-documentation/configure-incidents-and-alerts/prioritize-incidents-with-starring-and-scoring/incident-scoring.md): Learn about the different incident scoring methods. - [Set up incident scoring](https://cortex-docs.paloaltonetworks.com/cortex-xdr-3.x/cortex-xdr-3.x-documentation/configure-incidents-and-alerts/prioritize-incidents-with-starring-and-scoring/incident-scoring/set-up-incident-scoring.md): Set up incident scoring by enabling SmartScore and defining scoring rules. - [Automation rules](https://cortex-docs.paloaltonetworks.com/cortex-xdr-3.x/cortex-xdr-3.x-documentation/configure-incidents-and-alerts/automation-rules.md): Automation rules enable you to create rules comprised of alert conditions that trigger an action. - [Automation settings](https://cortex-docs.paloaltonetworks.com/cortex-xdr-3.x/cortex-xdr-3.x-documentation/configure-incidents-and-alerts/automation-rules/automation-settings.md): Threshold limits may be implemented for settings of automation rules. - [Automation rule actions](https://cortex-docs.paloaltonetworks.com/cortex-xdr-3.x/cortex-xdr-3.x-documentation/configure-incidents-and-alerts/automation-rules/automation-rule-actions.md): Includes the list of actions to take when the alert condition of the automation rule is triggered for Cortex XDR. - [Automation audit log](https://cortex-docs.paloaltonetworks.com/cortex-xdr-3.x/cortex-xdr-3.x-documentation/configure-incidents-and-alerts/automation-rules/automation-audit-log.md): Includes the list of fields included in the automation audit log for Cortex XDR. - [Investigate and respond to incidents](https://cortex-docs.paloaltonetworks.com/cortex-xdr-3.x/cortex-xdr-3.x-documentation/investigate-and-respond-to-incidents.md): Learn about the Cortex XDR investigation and response operations. - [Incident handling](https://cortex-docs.paloaltonetworks.com/cortex-xdr-3.x/cortex-xdr-3.x-documentation/investigate-and-respond-to-incidents/incident-handling.md): Learn about how incidents are created, the information contained in an incident, and how to prioritize and manage incidents. - [What are incidents?](https://cortex-docs.paloaltonetworks.com/cortex-xdr-3.x/cortex-xdr-3.x-documentation/investigate-and-respond-to-incidents/incident-handling/what-are-incidents.md): Learn about how incidents are created, incident terminology, incident thresholds, and incident planning and response - [Understanding the Incidents page](https://cortex-docs.paloaltonetworks.com/cortex-xdr-3.x/cortex-xdr-3.x-documentation/investigate-and-respond-to-incidents/incident-handling/understanding-the-incidents-page.md): Use the Incidents page to review incident details and take remedial action. - [Incidents table view reference information](https://cortex-docs.paloaltonetworks.com/cortex-xdr-3.x/cortex-xdr-3.x-documentation/investigate-and-respond-to-incidents/incident-handling/understanding-the-incidents-page/incidents-table-view-reference-information.md): Describes the fields in the table view. - [Manage incidents](https://cortex-docs.paloaltonetworks.com/cortex-xdr-3.x/cortex-xdr-3.x-documentation/investigate-and-respond-to-incidents/incident-handling/manage-incidents.md): Lean how to investigate and manage your incidents. - [Resolution reasons for incidents and alerts](https://cortex-docs.paloaltonetworks.com/cortex-xdr-3.x/cortex-xdr-3.x-documentation/investigate-and-respond-to-incidents/incident-handling/manage-incidents/resolution-reasons-for-incidents-and-alerts.md): Describes the resolution reasons for incidents and alerts. - [Investigate artifacts and assets](https://cortex-docs.paloaltonetworks.com/cortex-xdr-3.x/cortex-xdr-3.x-documentation/investigate-and-respond-to-incidents/investigate-artifacts-and-assets.md): You can investigate specific artifacts and assets on dedicated views related to IP address, Network Assets, and File and Process Hash information. - [Investigate an IP address](https://cortex-docs.paloaltonetworks.com/cortex-xdr-3.x/cortex-xdr-3.x-documentation/investigate-and-respond-to-incidents/investigate-artifacts-and-assets/investigate-an-ip-address.md): Investigate incidents, connections, and threat intelligence reports related to a specific IP address on the IP View. - [Investigate an asset](https://cortex-docs.paloaltonetworks.com/cortex-xdr-3.x/cortex-xdr-3.x-documentation/investigate-and-respond-to-incidents/investigate-artifacts-and-assets/investigate-an-asset.md): Investigate host assets and view host insights on the Asset View. - [Investigate a host](https://cortex-docs.paloaltonetworks.com/cortex-xdr-3.x/cortex-xdr-3.x-documentation/investigate-and-respond-to-incidents/investigate-artifacts-and-assets/investigate-a-host.md): Investigate host assets associated with your incidents - [Investigate a file and process hash](https://cortex-docs.paloaltonetworks.com/cortex-xdr-3.x/cortex-xdr-3.x-documentation/investigate-and-respond-to-incidents/investigate-artifacts-and-assets/investigate-a-file-and-process-hash.md): Investigate incidents, actions, and threat intelligence reports related to a specific file or process hash on the Hash View. - [Investigate a user](https://cortex-docs.paloaltonetworks.com/cortex-xdr-3.x/cortex-xdr-3.x-documentation/investigate-and-respond-to-incidents/investigate-artifacts-and-assets/investigate-a-user.md): Investigate user assets associated with your incidents. - [Investigate alerts](https://cortex-docs.paloaltonetworks.com/cortex-xdr-3.x/cortex-xdr-3.x-documentation/investigate-and-respond-to-incidents/investigate-alerts.md): Cortex XDR generates alerts to bring your attention to security risks in your framework. - [Overview of the Alerts page](https://cortex-docs.paloaltonetworks.com/cortex-xdr-3.x/cortex-xdr-3.x-documentation/investigate-and-respond-to-incidents/investigate-alerts/overview-of-the-alerts-page.md): The Alerts page consolidates all non-informational alerts from your detection sources, and helps you to analyze and triage the alerts on your system. - [Triage and investigate alerts](https://cortex-docs.paloaltonetworks.com/cortex-xdr-3.x/cortex-xdr-3.x-documentation/investigate-and-respond-to-incidents/investigate-alerts/triage-and-investigate-alerts.md): You can triage, investigate, and take actions on alerts from the Alerts page. - [Copy alerts](https://cortex-docs.paloaltonetworks.com/cortex-xdr-3.x/cortex-xdr-3.x-documentation/investigate-and-respond-to-incidents/investigate-alerts/triage-and-investigate-alerts/copy-alerts.md): You can copy an alert into memory. - [Analyze an alert](https://cortex-docs.paloaltonetworks.com/cortex-xdr-3.x/cortex-xdr-3.x-documentation/investigate-and-respond-to-incidents/investigate-alerts/triage-and-investigate-alerts/analyze-an-alert.md): Learn more about analyzing alerts in the alert side panel and the causality view. - [Create profile exceptions](https://cortex-docs.paloaltonetworks.com/cortex-xdr-3.x/cortex-xdr-3.x-documentation/investigate-and-respond-to-incidents/investigate-alerts/triage-and-investigate-alerts/create-profile-exceptions.md): You can create profile exceptions for agent alerts. - [Add a file path to a malware profile allow list](https://cortex-docs.paloaltonetworks.com/cortex-xdr-3.x/cortex-xdr-3.x-documentation/investigate-and-respond-to-incidents/investigate-alerts/triage-and-investigate-alerts/add-a-file-path-to-a-malware-profile-allow-list.md): You can add a file path to an existing malware profile. - [Create a featured alert field](https://cortex-docs.paloaltonetworks.com/cortex-xdr-3.x/cortex-xdr-3.x-documentation/investigate-and-respond-to-incidents/investigate-alerts/triage-and-investigate-alerts/create-a-featured-alert-field.md): You can label specific alert attributes as featured alert fields. - [View generating BIOC or IOC rule](https://cortex-docs.paloaltonetworks.com/cortex-xdr-3.x/cortex-xdr-3.x-documentation/investigate-and-respond-to-incidents/investigate-alerts/triage-and-investigate-alerts/view-generating-bioc-or-ioc-rule.md): You can view the BIOC or IOC rules that generated alerts directly from the Alerts table. - [Retrieve additional alert details](https://cortex-docs.paloaltonetworks.com/cortex-xdr-3.x/cortex-xdr-3.x-documentation/investigate-and-respond-to-incidents/investigate-alerts/triage-and-investigate-alerts/retrieve-additional-alert-details.md): Access additional information relating to an alert, including related files and memory content analysis. - [Alert deduplication](https://cortex-docs.paloaltonetworks.com/cortex-xdr-3.x/cortex-xdr-3.x-documentation/investigate-and-respond-to-incidents/investigate-alerts/triage-and-investigate-alerts/alert-deduplication.md): Learn about how Cortex XDR deduplicates alerts - [Export alert details to a file](https://cortex-docs.paloaltonetworks.com/cortex-xdr-3.x/cortex-xdr-3.x-documentation/investigate-and-respond-to-incidents/investigate-alerts/triage-and-investigate-alerts/export-alert-details-to-a-file.md): You can review alert details offline by exporting alerts to a TSV file. - [Exclude an alert](https://cortex-docs.paloaltonetworks.com/cortex-xdr-3.x/cortex-xdr-3.x-documentation/investigate-and-respond-to-incidents/investigate-alerts/triage-and-investigate-alerts/exclude-an-alert.md): You can exclude alerts that are not deemed to be a threat. - [Investigate contributing events](https://cortex-docs.paloaltonetworks.com/cortex-xdr-3.x/cortex-xdr-3.x-documentation/investigate-and-respond-to-incidents/investigate-alerts/triage-and-investigate-alerts/investigate-contributing-events.md): You can investigate the events created by an alert. - [Query incident and alert data](https://cortex-docs.paloaltonetworks.com/cortex-xdr-3.x/cortex-xdr-3.x-documentation/investigate-and-respond-to-incidents/investigate-alerts/triage-and-investigate-alerts/query-incident-and-alert-data.md): You can run queries on incident and alert data with the incidents and alerts datasets. - [Manage automation rules](https://cortex-docs.paloaltonetworks.com/cortex-xdr-3.x/cortex-xdr-3.x-documentation/investigate-and-respond-to-incidents/investigate-alerts/triage-and-investigate-alerts/manage-automation-rules.md): Procedure of how to manage the automation rules of Cortex XDR as needed, which includes to edit, save as new, disable, delete or copy. - [Alert investigation views](https://cortex-docs.paloaltonetworks.com/cortex-xdr-3.x/cortex-xdr-3.x-documentation/investigate-and-respond-to-incidents/investigate-alerts/alert-investigation-views.md): From the Alerts page, you can pivot on an alert to open the alert investigation views. - [Alert side panel](https://cortex-docs.paloaltonetworks.com/cortex-xdr-3.x/cortex-xdr-3.x-documentation/investigate-and-respond-to-incidents/investigate-alerts/alert-investigation-views/alert-side-panel.md): The alert side panel provides detailed information about alerts at a glance and in the context of the incident. - [Causality view](https://cortex-docs.paloaltonetworks.com/cortex-xdr-3.x/cortex-xdr-3.x-documentation/investigate-and-respond-to-incidents/investigate-alerts/alert-investigation-views/causality-view.md): See the causality of an alert—the entire process execution chain that led up to the alert in the Cortex XDR app. - [Network causality view](https://cortex-docs.paloaltonetworks.com/cortex-xdr-3.x/cortex-xdr-3.x-documentation/investigate-and-respond-to-incidents/investigate-alerts/alert-investigation-views/network-causality-view.md): The network causality view shows a chain of individual network processes that together and in a particular sequence of operation triggered an alert. - [Cloud causality view](https://cortex-docs.paloaltonetworks.com/cortex-xdr-3.x/cortex-xdr-3.x-documentation/investigate-and-respond-to-incidents/investigate-alerts/alert-investigation-views/cloud-causality-view.md): See the causality of a cloud-type alert—the entire process execution chain that led up to the alert in the Cortex XDR app. - [SaaS causality view](https://cortex-docs.paloaltonetworks.com/cortex-xdr-3.x/cortex-xdr-3.x-documentation/investigate-and-respond-to-incidents/investigate-alerts/alert-investigation-views/saas-causality-view.md): Learn more about the SaaS causality view used to identify and investigate SaaS-specific data associated with SaaS-related alerts and SaaS audit logs. - [Analytics alert view](https://cortex-docs.paloaltonetworks.com/cortex-xdr-3.x/cortex-xdr-3.x-documentation/investigate-and-respond-to-incidents/investigate-alerts/alert-investigation-views/analytics-alert-view.md): From the Cortex XDR management console, you can view a detailed summary of the behavior that triggered analytics alerts. - [Timeline](https://cortex-docs.paloaltonetworks.com/cortex-xdr-3.x/cortex-xdr-3.x-documentation/investigate-and-respond-to-incidents/investigate-alerts/alert-investigation-views/timeline.md): From the Cortex XDR tenant you can view the sequence (or timeline) of events and alerts that are involved in any particular threat. - [Investigate endpoints](https://cortex-docs.paloaltonetworks.com/cortex-xdr-3.x/cortex-xdr-3.x-documentation/investigate-and-respond-to-incidents/investigate-endpoints.md): You can investigate and take actions on your endpoints in the Action Center. - [Overview of the Action Center](https://cortex-docs.paloaltonetworks.com/cortex-xdr-3.x/cortex-xdr-3.x-documentation/investigate-and-respond-to-incidents/investigate-endpoints/overview-of-the-action-center.md): From the Action Center, you can track the progress of all investigation, response, and maintenance actions performed on your endpoints. - [Initiate and monitor endpoint actions](https://cortex-docs.paloaltonetworks.com/cortex-xdr-3.x/cortex-xdr-3.x-documentation/investigate-and-respond-to-incidents/investigate-endpoints/overview-of-the-action-center/initiate-and-monitor-endpoint-actions.md): Take these steps to initiate and monitor actions on your endpoints. - [Action Center reference information](https://cortex-docs.paloaltonetworks.com/cortex-xdr-3.x/cortex-xdr-3.x-documentation/investigate-and-respond-to-incidents/investigate-endpoints/overview-of-the-action-center/action-center-reference-information.md): See descriptions of the fields in the Action Center. - [Manage endpoints](https://cortex-docs.paloaltonetworks.com/cortex-xdr-3.x/cortex-xdr-3.x-documentation/investigate-and-respond-to-incidents/investigate-endpoints/manage-endpoints.md): You can view and take actions on endpoints on the All Endpoints page. - [Retrieve files from an endpoint](https://cortex-docs.paloaltonetworks.com/cortex-xdr-3.x/cortex-xdr-3.x-documentation/investigate-and-respond-to-incidents/investigate-endpoints/retrieve-files-from-an-endpoint.md): You can retrieve files from one or more endpoints by initiating a files retrieval request. - [Retrieve support logs from an endpoint](https://cortex-docs.paloaltonetworks.com/cortex-xdr-3.x/cortex-xdr-3.x-documentation/investigate-and-respond-to-incidents/investigate-endpoints/retrieve-support-logs-from-an-endpoint.md): Retrieve support logs from an endpoint when additional forensic data is needed. - [Retrieve support file password](https://cortex-docs.paloaltonetworks.com/cortex-xdr-3.x/cortex-xdr-3.x-documentation/investigate-and-respond-to-incidents/investigate-endpoints/retrieve-support-file-password.md): Learn how to retrieve the password to access files from the Tech Support File (TSF), which is generated in a zip format protected by an encrypted password. - [Scan an endpoint for malware](https://cortex-docs.paloaltonetworks.com/cortex-xdr-3.x/cortex-xdr-3.x-documentation/investigate-and-respond-to-incidents/investigate-endpoints/scan-an-endpoint-for-malware.md): The agent can scan your Windows and Mac endpoints and attached removable drives for dormant malware that is not actively attempting to run. - [Investigate files](https://cortex-docs.paloaltonetworks.com/cortex-xdr-3.x/cortex-xdr-3.x-documentation/investigate-and-respond-to-incidents/investigate-files.md) - [Manage file execution](https://cortex-docs.paloaltonetworks.com/cortex-xdr-3.x/cortex-xdr-3.x-documentation/investigate-and-respond-to-incidents/investigate-files/manage-file-execution.md): Set rules for the execution (or running) of particular files on your endpoints in Cortex XDR. - [Manage quarantined files](https://cortex-docs.paloaltonetworks.com/cortex-xdr-3.x/cortex-xdr-3.x-documentation/investigate-and-respond-to-incidents/investigate-files/manage-quarantined-files.md): You can review and manage all files that have been quarantined by the agent due to a security incident. - [Review WildFire analysis details](https://cortex-docs.paloaltonetworks.com/cortex-xdr-3.x/cortex-xdr-3.x-documentation/investigate-and-respond-to-incidents/investigate-files/review-wildfire-analysis-details.md): For each file, Cortex XDR receives a file verdict and the WildFire Analysis Report detailing additional information you can use to assess the nature of a file. - [Import file hash exceptions](https://cortex-docs.paloaltonetworks.com/cortex-xdr-3.x/cortex-xdr-3.x-documentation/investigate-and-respond-to-incidents/investigate-files/import-file-hash-exceptions.md): You can import file hash exceptions from the Endpoint Security Manager or from external feeds. - [Response actions](https://cortex-docs.paloaltonetworks.com/cortex-xdr-3.x/cortex-xdr-3.x-documentation/investigate-and-respond-to-incidents/response-actions.md): As a result of an incident investigation, different response actions are possible. - [Initiate a Live Terminal session](https://cortex-docs.paloaltonetworks.com/cortex-xdr-3.x/cortex-xdr-3.x-documentation/investigate-and-respond-to-incidents/response-actions/initiate-a-live-terminal-session.md): Initiate a Live Terminal session from the Cortex XDR management console to control the endpoint remotely. - [Isolate an endpoint](https://cortex-docs.paloaltonetworks.com/cortex-xdr-3.x/cortex-xdr-3.x-documentation/investigate-and-respond-to-incidents/response-actions/isolate-an-endpoint.md): In the event that an endpoint is compromised, you can immediately isolate it to reduce an attacker’s mobility. - [Pause endpoint protection](https://cortex-docs.paloaltonetworks.com/cortex-xdr-3.x/cortex-xdr-3.x-documentation/investigate-and-respond-to-incidents/response-actions/pause-endpoint-protection.md): Disable the Cortex XDR agent protection capabilities on an endpoint. - [Remediate changes from malicious activity](https://cortex-docs.paloaltonetworks.com/cortex-xdr-3.x/cortex-xdr-3.x-documentation/investigate-and-respond-to-incidents/response-actions/remediate-changes-from-malicious-activity.md): You can obtain action remediation suggestions from Cortex XDR about malicious causality chains that have been detected. - [Run scripts on an endpoint](https://cortex-docs.paloaltonetworks.com/cortex-xdr-3.x/cortex-xdr-3.x-documentation/investigate-and-respond-to-incidents/response-actions/run-scripts-on-an-endpoint.md): Execute Python scripts from Cortex XDR directly on the endpoint to perform actions, retrieve data, and retrieve files. - [Search and destroy malicious files](https://cortex-docs.paloaltonetworks.com/cortex-xdr-3.x/cortex-xdr-3.x-documentation/investigate-and-respond-to-incidents/response-actions/search-and-destroy-malicious-files.md): Cortex XDR enables you to effectively hunt down any identified malicious file that may exist on any of your endpoints. - [Manage external dynamic lists](https://cortex-docs.paloaltonetworks.com/cortex-xdr-3.x/cortex-xdr-3.x-documentation/investigate-and-respond-to-incidents/response-actions/manage-external-dynamic-lists.md): Configure and manage your external dynamic lists in Cortex XDR. - [Collect a memory image](https://cortex-docs.paloaltonetworks.com/cortex-xdr-3.x/cortex-xdr-3.x-documentation/investigate-and-respond-to-incidents/response-actions/collect-a-memory-image.md): Collect a memory image from a Windows endpoint. - [Build XQL queries](https://cortex-docs.paloaltonetworks.com/cortex-xdr-3.x/cortex-xdr-3.x-documentation/investigate-and-respond-to-incidents/build-xql-queries.md): Learn more about how to build Cortex Query Language (XQL) queries using the Query Builder. - [About the Query Builder](https://cortex-docs.paloaltonetworks.com/cortex-xdr-3.x/cortex-xdr-3.x-documentation/investigate-and-respond-to-incidents/build-xql-queries/about-the-query-builder.md): The Query Builder facilitates threat detection, incident expansion, and data analytics for suspected threats. - [How to build XQL queries](https://cortex-docs.paloaltonetworks.com/cortex-xdr-3.x/cortex-xdr-3.x-documentation/investigate-and-respond-to-incidents/build-xql-queries/how-to-build-xql-queries.md): Learn more about how to build XQL queries in the Query Builder. - [Get started with XQL queries](https://cortex-docs.paloaltonetworks.com/cortex-xdr-3.x/cortex-xdr-3.x-documentation/investigate-and-respond-to-incidents/build-xql-queries/how-to-build-xql-queries/get-started-with-xql-queries.md): Learn more about some important information before getting started with XQL queries. - [Useful XQL user interface features](https://cortex-docs.paloaltonetworks.com/cortex-xdr-3.x/cortex-xdr-3.x-documentation/investigate-and-respond-to-incidents/build-xql-queries/how-to-build-xql-queries/useful-xql-user-interface-features.md): Learn about useful XQL query features in the user interface. - [XQL Query best practices](https://cortex-docs.paloaltonetworks.com/cortex-xdr-3.x/cortex-xdr-3.x-documentation/investigate-and-respond-to-incidents/build-xql-queries/how-to-build-xql-queries/xql-query-best-practices.md): Learn about best practices for streamlining XQL queries. - [Expected results when querying fields](https://cortex-docs.paloaltonetworks.com/cortex-xdr-3.x/cortex-xdr-3.x-documentation/investigate-and-respond-to-incidents/build-xql-queries/how-to-build-xql-queries/expected-results-when-querying-fields.md): Learn what to expect in the query results when querying fields. - [Create XQL query](https://cortex-docs.paloaltonetworks.com/cortex-xdr-3.x/cortex-xdr-3.x-documentation/investigate-and-respond-to-incidents/build-xql-queries/how-to-build-xql-queries/create-xql-query.md): Learn how to create queries using the Cortex Query Language (XQL). - [Review XQL query results](https://cortex-docs.paloaltonetworks.com/cortex-xdr-3.x/cortex-xdr-3.x-documentation/investigate-and-respond-to-incidents/build-xql-queries/how-to-build-xql-queries/review-xql-query-results.md): Learn more about reviewing the results returned from an XQL query. - [Translate to XQL](https://cortex-docs.paloaltonetworks.com/cortex-xdr-3.x/cortex-xdr-3.x-documentation/investigate-and-respond-to-incidents/build-xql-queries/how-to-build-xql-queries/translate-to-xql.md): Learn how to translate your Splunk queries to XQL queries in Cortex XDR. - [Graph query results](https://cortex-docs.paloaltonetworks.com/cortex-xdr-3.x/cortex-xdr-3.x-documentation/investigate-and-respond-to-incidents/build-xql-queries/how-to-build-xql-queries/graph-query-results.md): Cortex XDR enables you to generate helpful visualizations of your XQL query results. - [XQL query entities](https://cortex-docs.paloaltonetworks.com/cortex-xdr-3.x/cortex-xdr-3.x-documentation/investigate-and-respond-to-incidents/build-xql-queries/xql-query-entities.md): Learn more about the Cortex Query Language (XQL) entities available in the Query Builder. - [Create authentication query](https://cortex-docs.paloaltonetworks.com/cortex-xdr-3.x/cortex-xdr-3.x-documentation/investigate-and-respond-to-incidents/build-xql-queries/xql-query-entities/create-authentication-query.md): Learn more about creating a query to investigate any authentication activity. - [Create event log query](https://cortex-docs.paloaltonetworks.com/cortex-xdr-3.x/cortex-xdr-3.x-documentation/investigate-and-respond-to-incidents/build-xql-queries/xql-query-entities/create-event-log-query.md): Learn more about creating a query to investigate Windows and Linux event log attributes and investigate event logs across endpoints. - [Create file query](https://cortex-docs.paloaltonetworks.com/cortex-xdr-3.x/cortex-xdr-3.x-documentation/investigate-and-respond-to-incidents/build-xql-queries/xql-query-entities/create-file-query.md): Learn more about creating a query to investigate the connections between file activity and endpoints. - [Create image load query](https://cortex-docs.paloaltonetworks.com/cortex-xdr-3.x/cortex-xdr-3.x-documentation/investigate-and-respond-to-incidents/build-xql-queries/xql-query-entities/create-image-load-query.md): Learn more about create a query to investigate the connections between image load activity, acting processes, and endpoints. - [Create network connections query](https://cortex-docs.paloaltonetworks.com/cortex-xdr-3.x/cortex-xdr-3.x-documentation/investigate-and-respond-to-incidents/build-xql-queries/xql-query-entities/create-network-connections-query.md): Learn more about creating a query to investigate the connections between firewall logs, endpoints, and network activity. - [Create network query](https://cortex-docs.paloaltonetworks.com/cortex-xdr-3.x/cortex-xdr-3.x-documentation/investigate-and-respond-to-incidents/build-xql-queries/xql-query-entities/create-network-query.md): Learn more about creating a query to investigate the connections between network activity, acting processes, and endpoints. - [Create process query](https://cortex-docs.paloaltonetworks.com/cortex-xdr-3.x/cortex-xdr-3.x-documentation/investigate-and-respond-to-incidents/build-xql-queries/xql-query-entities/create-process-query.md): Learn more about creating a query to investigate connections between processes, child processes, and endpoints. - [Create registry query](https://cortex-docs.paloaltonetworks.com/cortex-xdr-3.x/cortex-xdr-3.x-documentation/investigate-and-respond-to-incidents/build-xql-queries/xql-query-entities/create-registry-query.md): Learn more about creating a query to investigate connections between registry activity, processes, and endpoints. - [Query across all entities](https://cortex-docs.paloaltonetworks.com/cortex-xdr-3.x/cortex-xdr-3.x-documentation/investigate-and-respond-to-incidents/build-xql-queries/xql-query-entities/query-across-all-entities.md): From the Cortex XDR management console, you can search for endpoints and processes across all endpoint activity. - [Overview of the Query Center](https://cortex-docs.paloaltonetworks.com/cortex-xdr-3.x/cortex-xdr-3.x-documentation/investigate-and-respond-to-incidents/build-xql-queries/overview-of-the-query-center.md): View information about the In Progress and Completed queries that that were run on the tenant. - [Edit and rerun queries in Query Center](https://cortex-docs.paloaltonetworks.com/cortex-xdr-3.x/cortex-xdr-3.x-documentation/investigate-and-respond-to-incidents/build-xql-queries/overview-of-the-query-center/edit-and-rerun-queries-in-query-center.md): Learn more about viewing the results of a query, modifying a query, and rerunning queries from Query Center. - [Query Center reference information](https://cortex-docs.paloaltonetworks.com/cortex-xdr-3.x/cortex-xdr-3.x-documentation/investigate-and-respond-to-incidents/build-xql-queries/overview-of-the-query-center/edit-and-rerun-queries-in-query-center/query-center-reference-information.md): Descriptions of the fields in the Query Center table. - [Manage scheduled queries](https://cortex-docs.paloaltonetworks.com/cortex-xdr-3.x/cortex-xdr-3.x-documentation/investigate-and-respond-to-incidents/build-xql-queries/manage-scheduled-queries.md): Learn how to manage your scheduled and recurring queries. - [Scheduled Queries reference information](https://cortex-docs.paloaltonetworks.com/cortex-xdr-3.x/cortex-xdr-3.x-documentation/investigate-and-respond-to-incidents/build-xql-queries/manage-scheduled-queries/scheduled-queries-reference-information.md): Descriptions of the fields in the Scheduled Queries table. - [Manage your personal query library](https://cortex-docs.paloaltonetworks.com/cortex-xdr-3.x/cortex-xdr-3.x-documentation/investigate-and-respond-to-incidents/build-xql-queries/manage-your-personal-query-library.md): Cortex XDR provides as part of the Query Library a personal library for saving and managing your own queries. - [Dashboards](https://cortex-docs.paloaltonetworks.com/cortex-xdr-3.x/cortex-xdr-3.x-documentation/investigate-and-respond-to-incidents/dashboards.md): Cortex XDR dashboards help you to monitor system activity in your environment. You can use any of the predefined dashboards that are provided in Cortex XDR, or you can create your own custom dashboard - [About dashboards](https://cortex-docs.paloaltonetworks.com/cortex-xdr-3.x/cortex-xdr-3.x-documentation/investigate-and-respond-to-incidents/dashboards/about-dashboards.md): Dashboards help you to monitor system activity in your environment. Select a dashboard from the drop-down menu, or take actions on your dashboards from the Dashboard Manager. - [Predefined dashboards](https://cortex-docs.paloaltonetworks.com/cortex-xdr-3.x/cortex-xdr-3.x-documentation/investigate-and-respond-to-incidents/dashboards/predefined-dashboards.md): Predefined dashboards are set up to help you monitor different aspects of your environment. - [Custom dashboards](https://cortex-docs.paloaltonetworks.com/cortex-xdr-3.x/cortex-xdr-3.x-documentation/investigate-and-respond-to-incidents/dashboards/custom-dashboards.md): Custom dashboards can support your day-to-day operations by providing options that are tailored to your unique workflow. - [Build a custom dashboard](https://cortex-docs.paloaltonetworks.com/cortex-xdr-3.x/cortex-xdr-3.x-documentation/investigate-and-respond-to-incidents/dashboards/custom-dashboards/build-a-custom-dashboard.md): Build customized dashboards to display and filter the information that is most relevant to you. - [Manage your Widget Library](https://cortex-docs.paloaltonetworks.com/cortex-xdr-3.x/cortex-xdr-3.x-documentation/investigate-and-respond-to-incidents/dashboards/custom-dashboards/manage-your-widget-library.md): Create, search, and view custom widgets in Cortex XDR, or use predefined widgets. - [Create a text widget](https://cortex-docs.paloaltonetworks.com/cortex-xdr-3.x/cortex-xdr-3.x-documentation/investigate-and-respond-to-incidents/dashboards/custom-dashboards/create-a-text-widget.md): Create a text-based widget to present information in a dashboard or report. Markdown is supported for formatting. - [Create custom XQL widgets](https://cortex-docs.paloaltonetworks.com/cortex-xdr-3.x/cortex-xdr-3.x-documentation/investigate-and-respond-to-incidents/dashboards/custom-dashboards/create-custom-xql-widgets.md): You can create custom XQL widgets based on a Cortex Query Language (XQL) query, and add parameters that you can configure as fixed filters or dashboard drilldowns. - [Configure fixed dashboard filters](https://cortex-docs.paloaltonetworks.com/cortex-xdr-3.x/cortex-xdr-3.x-documentation/investigate-and-respond-to-incidents/dashboards/custom-dashboards/configure-fixed-dashboard-filters.md): Configure fixed filters that enable dashboard users to alter the scope of the dashboard by selecting predefined and dynamic values. - [Configure dashboard drilldowns](https://cortex-docs.paloaltonetworks.com/cortex-xdr-3.x/cortex-xdr-3.x-documentation/investigate-and-respond-to-incidents/dashboards/custom-dashboards/configure-dashboard-drilldowns.md): Configure drilldowns on custom dashboards to provide users with interactive data insights when clicking on data points in a widget - [Variables in drilldowns](https://cortex-docs.paloaltonetworks.com/cortex-xdr-3.x/cortex-xdr-3.x-documentation/investigate-and-respond-to-incidents/dashboards/custom-dashboards/configure-dashboard-drilldowns/variables-in-drilldowns.md): Learn about the widget variable values that you can use in dashboard drilldowns. - [Reports](https://cortex-docs.paloaltonetworks.com/cortex-xdr-3.x/cortex-xdr-3.x-documentation/investigate-and-respond-to-incidents/dashboards/reports.md): Create, edit, and customize reports in Cortex XDR. Schedule reports with Cron expressions. - [Report templates](https://cortex-docs.paloaltonetworks.com/cortex-xdr-3.x/cortex-xdr-3.x-documentation/investigate-and-respond-to-incidents/dashboards/reports/report-templates.md): View, import, export, create, and modify report templates - [Run or schedule reports](https://cortex-docs.paloaltonetworks.com/cortex-xdr-3.x/cortex-xdr-3.x-documentation/investigate-and-respond-to-incidents/dashboards/reports/run-or-schedule-reports.md): You can run reports that are based on dashboard templates, or you can create reports from scratch. - [Quick Launcher](https://cortex-docs.paloaltonetworks.com/cortex-xdr-3.x/cortex-xdr-3.x-documentation/investigate-and-respond-to-incidents/quick-launcher.md): The Quick Launcher provides a quick, in-context shortcut that you can use to search for information, perform common investigation tasks, or initiate actions. - [Research a known threat](https://cortex-docs.paloaltonetworks.com/cortex-xdr-3.x/cortex-xdr-3.x-documentation/investigate-and-respond-to-incidents/research-a-known-threat.md): Cortex XDR enables you to investigate any threat, also referred to as a lead, which has been detected. - [Data management](https://cortex-docs.paloaltonetworks.com/cortex-xdr-3.x/cortex-xdr-3.x-documentation/data-management.md) - [Broker VM](https://cortex-docs.paloaltonetworks.com/cortex-xdr-3.x/cortex-xdr-3.x-documentation/data-management/broker-vm.md): Set up a Broker VM to establish a secure connection in which you can route your endpoints, and collect and forward logs and files for analysis. - [What is the Broker VM?](https://cortex-docs.paloaltonetworks.com/cortex-xdr-3.x/cortex-xdr-3.x-documentation/data-management/broker-vm/what-is-the-broker-vm.md): Learn about the Cortex XDR Broker virtual machine (VM) and why use it in your network configuration. - [Set up and configure Broker VM](https://cortex-docs.paloaltonetworks.com/cortex-xdr-3.x/cortex-xdr-3.x-documentation/data-management/broker-vm/set-up-and-configure-broker-vm.md): Learn more about how to set up and configure a Broker VM as a standalone broker or add the broker to a high availability (HA) cluster. - [Broker VM image installations](https://cortex-docs.paloaltonetworks.com/cortex-xdr-3.x/cortex-xdr-3.x-documentation/data-management/broker-vm/set-up-and-configure-broker-vm/broker-vm-image-installations.md): Learn more about the Broker VM image types available that are compatible with your viirtual machine (VM). - [Set up Broker VM on Alibaba Cloud](https://cortex-docs.paloaltonetworks.com/cortex-xdr-3.x/cortex-xdr-3.x-documentation/data-management/broker-vm/set-up-and-configure-broker-vm/broker-vm-image-installations/set-up-broker-vm-on-alibaba-cloud.md): Learn how to set up your Cortex XDR Broker virtual machine (VM) on Alibaba Cloud. - [Set up Broker VM on Amazon Web Services](https://cortex-docs.paloaltonetworks.com/cortex-xdr-3.x/cortex-xdr-3.x-documentation/data-management/broker-vm/set-up-and-configure-broker-vm/broker-vm-image-installations/set-up-broker-vm-on-amazon-web-services.md): Learn how to set up your Cortex XDR Broker virtual machine (VM) on AWS. - [Set up Broker VM on Google Cloud Platform (GCP)](https://cortex-docs.paloaltonetworks.com/cortex-xdr-3.x/cortex-xdr-3.x-documentation/data-management/broker-vm/set-up-and-configure-broker-vm/broker-vm-image-installations/set-up-broker-vm-on-google-cloud-platform-gcp.md): Learn more about how to set up your Cortex XDR Broker VM on Google Cloud Platform. - [Set up Broker VM on KVM using Ubuntu](https://cortex-docs.paloaltonetworks.com/cortex-xdr-3.x/cortex-xdr-3.x-documentation/data-management/broker-vm/set-up-and-configure-broker-vm/broker-vm-image-installations/set-up-broker-vm-on-kvm-using-ubuntu.md): Learn set up your Cortex XDR Broker virtual machine (VM) on a KVM using Ubuntu. - [Set up Broker VM on Microsoft Azure](https://cortex-docs.paloaltonetworks.com/cortex-xdr-3.x/cortex-xdr-3.x-documentation/data-management/broker-vm/set-up-and-configure-broker-vm/broker-vm-image-installations/set-up-broker-vm-on-microsoft-azure.md): Learn how to set up your Cortex XDR Broker virtual machine (VM) on Microsoft Azure. - [Set up Broker VM on Microsoft Hyper-V](https://cortex-docs.paloaltonetworks.com/cortex-xdr-3.x/cortex-xdr-3.x-documentation/data-management/broker-vm/set-up-and-configure-broker-vm/broker-vm-image-installations/set-up-broker-vm-on-microsoft-hyper-v.md): Learn how to set up your Cortex XDR Broker virtual machine (VM) on Microsoft Hyper-V. - [Set up Broker VM on Nutanix Hypervisor](https://cortex-docs.paloaltonetworks.com/cortex-xdr-3.x/cortex-xdr-3.x-documentation/data-management/broker-vm/set-up-and-configure-broker-vm/broker-vm-image-installations/set-up-broker-vm-on-nutanix-hypervisor.md): Learn how to set up your Cortex XDR Broker virtual machine (VM) on Nutanix Hypervisor. - [Set up Broker VM on VMware ESXi using vSphere Client](https://cortex-docs.paloaltonetworks.com/cortex-xdr-3.x/cortex-xdr-3.x-documentation/data-management/broker-vm/set-up-and-configure-broker-vm/broker-vm-image-installations/set-up-broker-vm-on-vmware-esxi-using-vsphere-client.md): Learn more about how to set up you Cortex XDR Broker VM on VMware ESXi. - [Broker VM data collector applets](https://cortex-docs.paloaltonetworks.com/cortex-xdr-3.x/cortex-xdr-3.x-documentation/data-management/broker-vm/set-up-and-configure-broker-vm/broker-vm-data-collector-applets.md): Learn more about the different Broker VM data collector applets available to configure. - [Activate Apache Kafka Collector](https://cortex-docs.paloaltonetworks.com/cortex-xdr-3.x/cortex-xdr-3.x-documentation/data-management/broker-vm/set-up-and-configure-broker-vm/broker-vm-data-collector-applets/activate-apache-kafka-collector.md): Learn more about activating the Broker VM with an Apache Kafka Collector applet. - [Activate CSV Collector](https://cortex-docs.paloaltonetworks.com/cortex-xdr-3.x/cortex-xdr-3.x-documentation/data-management/broker-vm/set-up-and-configure-broker-vm/broker-vm-data-collector-applets/activate-csv-collector.md): Learn more about activating the Broker VM with a CSV Collector applet. - [Activate Database Collector](https://cortex-docs.paloaltonetworks.com/cortex-xdr-3.x/cortex-xdr-3.x-documentation/data-management/broker-vm/set-up-and-configure-broker-vm/broker-vm-data-collector-applets/activate-database-collector.md): Learn more about activating a Broker VM with a Database Collector applet. - [Activate Files and Folders Collector](https://cortex-docs.paloaltonetworks.com/cortex-xdr-3.x/cortex-xdr-3.x-documentation/data-management/broker-vm/set-up-and-configure-broker-vm/broker-vm-data-collector-applets/activate-files-and-folders-collector.md): Learn more about activating a Broker VM with a Files and Folders Collector applet. - [Activate FTP Collector](https://cortex-docs.paloaltonetworks.com/cortex-xdr-3.x/cortex-xdr-3.x-documentation/data-management/broker-vm/set-up-and-configure-broker-vm/broker-vm-data-collector-applets/activate-ftp-collector.md): Learn more about activating a Broker VM with a FTP Collector applet. - [Activate Local Agent Settings](https://cortex-docs.paloaltonetworks.com/cortex-xdr-3.x/cortex-xdr-3.x-documentation/data-management/broker-vm/set-up-and-configure-broker-vm/broker-vm-data-collector-applets/activate-local-agent-settings.md): Learn more about activating a Local Agent Settings applet on a Broker VM. - [Activate NetFlow Collector](https://cortex-docs.paloaltonetworks.com/cortex-xdr-3.x/cortex-xdr-3.x-documentation/data-management/broker-vm/set-up-and-configure-broker-vm/broker-vm-data-collector-applets/activate-netflow-collector.md): Learn more about activating a Broker VM with a NetflFlow Collector applet. - [Activate Network Mapper](https://cortex-docs.paloaltonetworks.com/cortex-xdr-3.x/cortex-xdr-3.x-documentation/data-management/broker-vm/set-up-and-configure-broker-vm/broker-vm-data-collector-applets/activate-network-mapper.md): Learn more about activating the Network Mapper to scan your network. - [Activate Syslog Collector](https://cortex-docs.paloaltonetworks.com/cortex-xdr-3.x/cortex-xdr-3.x-documentation/data-management/broker-vm/set-up-and-configure-broker-vm/broker-vm-data-collector-applets/activate-syslog-collector.md): Learn how to set up and activate the Syslog Collector applet on a Broker VM within your network. - [Activate Windows Event Collector](https://cortex-docs.paloaltonetworks.com/cortex-xdr-3.x/cortex-xdr-3.x-documentation/data-management/broker-vm/set-up-and-configure-broker-vm/broker-vm-data-collector-applets/activate-windows-event-collector.md): Set up your Windows Event Collector to connect with the Cortex XDR Broker VM and collect events. - [Activate Windows Event Collector on Windows Core](https://cortex-docs.paloaltonetworks.com/cortex-xdr-3.x/cortex-xdr-3.x-documentation/data-management/broker-vm/set-up-and-configure-broker-vm/broker-vm-data-collector-applets/activate-windows-event-collector/activate-windows-event-collector-on-windows-core.md): Learn more about activating the Windrows Event Collector on Windows Core OS to connect with the Broker VM. - [Renew WEC certificates](https://cortex-docs.paloaltonetworks.com/cortex-xdr-3.x/cortex-xdr-3.x-documentation/data-management/broker-vm/set-up-and-configure-broker-vm/broker-vm-data-collector-applets/activate-windows-event-collector/renew-wec-certificates.md): Learn more about renewing your WEC certificates in Cortex XDR. - [Manage Broker VM](https://cortex-docs.paloaltonetworks.com/cortex-xdr-3.x/cortex-xdr-3.x-documentation/data-management/broker-vm/manage-broker-vm.md): Learn more about managing your Broker VMs from the management console. - [Edit Broker VM Configuration](https://cortex-docs.paloaltonetworks.com/cortex-xdr-3.x/cortex-xdr-3.x-documentation/data-management/broker-vm/manage-broker-vm/edit-broker-vm-configuration.md): Learn more about editing the configuration of a Broker VM. - [Increase Broker VM storage allocated for data caching](https://cortex-docs.paloaltonetworks.com/cortex-xdr-3.x/cortex-xdr-3.x-documentation/data-management/broker-vm/manage-broker-vm/increase-broker-vm-storage-allocated-for-data-caching.md): Learn more about increasing the storage allocated for data caching in the Broker VM. - [Monitor Broker VM using Prometheus](https://cortex-docs.paloaltonetworks.com/cortex-xdr-3.x/cortex-xdr-3.x-documentation/data-management/broker-vm/manage-broker-vm/monitor-broker-vm-using-prometheus.md): Learn more on monitoring the Broker VM using Prometheus. - [Collect Broker VM Logs](https://cortex-docs.paloaltonetworks.com/cortex-xdr-3.x/cortex-xdr-3.x-documentation/data-management/broker-vm/manage-broker-vm/collect-broker-vm-logs.md): Learn more about collecting logs from a Broker VM to review them as part of an investigation. - [Upgrade Broker VM](https://cortex-docs.paloaltonetworks.com/cortex-xdr-3.x/cortex-xdr-3.x-documentation/data-management/broker-vm/manage-broker-vm/upgrade-broker-vm.md): Learn more about upgrading the Broker VM from the Cortex XDR management console. - [Update Broker VM applets independently](https://cortex-docs.paloaltonetworks.com/cortex-xdr-3.x/cortex-xdr-3.x-documentation/data-management/broker-vm/manage-broker-vm/update-broker-vm-applets-independently.md) - [Import Broker VM Configuration](https://cortex-docs.paloaltonetworks.com/cortex-xdr-3.x/cortex-xdr-3.x-documentation/data-management/broker-vm/manage-broker-vm/import-broker-vm-configuration.md): Learn more about importing one Broker VM configuration to another. - [Open Live Terminal](https://cortex-docs.paloaltonetworks.com/cortex-xdr-3.x/cortex-xdr-3.x-documentation/data-management/broker-vm/manage-broker-vm/open-live-terminal.md): Learn more about remotely connecting to a Cortex XDR Broker VM. - [Add Broker VM to cluster](https://cortex-docs.paloaltonetworks.com/cortex-xdr-3.x/cortex-xdr-3.x-documentation/data-management/broker-vm/manage-broker-vm/add-broker-vm-to-cluster.md): Learn more about adding a Broker VM to a high availability cluster. - [Switchover Primary Node in Cluster](https://cortex-docs.paloaltonetworks.com/cortex-xdr-3.x/cortex-xdr-3.x-documentation/data-management/broker-vm/manage-broker-vm/switchover-primary-node-in-cluster.md): Learning more about changing the role of the current Primary node in a HA cluster. - [Remove from Cluster](https://cortex-docs.paloaltonetworks.com/cortex-xdr-3.x/cortex-xdr-3.x-documentation/data-management/broker-vm/manage-broker-vm/remove-from-cluster.md): Learn more about removing a Broker VM node from a high availability cluster. - [Broker VM High Availability Cluster](https://cortex-docs.paloaltonetworks.com/cortex-xdr-3.x/cortex-xdr-3.x-documentation/data-management/broker-vm/broker-vm-high-availability-cluster.md): Learn more about creating Broker VMs in a High Availability cluster - [Configure High Availability Cluster](https://cortex-docs.paloaltonetworks.com/cortex-xdr-3.x/cortex-xdr-3.x-documentation/data-management/broker-vm/broker-vm-high-availability-cluster/configure-high-availability-cluster.md): Learn how to configure a High Availablity Cluster. - [Manage Broker VM clusters](https://cortex-docs.paloaltonetworks.com/cortex-xdr-3.x/cortex-xdr-3.x-documentation/data-management/broker-vm/broker-vm-high-availability-cluster/manage-broker-vm-clusters.md): Learn more about managing your broker VM clusters from the Clusters tab of the Broker VMs page. - [View cluster details](https://cortex-docs.paloaltonetworks.com/cortex-xdr-3.x/cortex-xdr-3.x-documentation/data-management/broker-vm/broker-vm-high-availability-cluster/manage-broker-vm-clusters/view-cluster-details.md): Learn more about viewing the details of any particular cluster. - [Edit cluster](https://cortex-docs.paloaltonetworks.com/cortex-xdr-3.x/cortex-xdr-3.x-documentation/data-management/broker-vm/broker-vm-high-availability-cluster/manage-broker-vm-clusters/edit-cluster.md): Learn how to edit a High Availability cluster. - [Add applet to cluster](https://cortex-docs.paloaltonetworks.com/cortex-xdr-3.x/cortex-xdr-3.x-documentation/data-management/broker-vm/broker-vm-high-availability-cluster/manage-broker-vm-clusters/add-applet-to-cluster.md): Learn more about adding an applet to a High Availability cluster. - [Add Broker VM to cluster](https://cortex-docs.paloaltonetworks.com/cortex-xdr-3.x/cortex-xdr-3.x-documentation/data-management/broker-vm/broker-vm-high-availability-cluster/manage-broker-vm-clusters/add-broker-vm-to-cluster.md): Learn more about adding a Broker VM to a high availability cluster. - [Remove cluster](https://cortex-docs.paloaltonetworks.com/cortex-xdr-3.x/cortex-xdr-3.x-documentation/data-management/broker-vm/broker-vm-high-availability-cluster/manage-broker-vm-clusters/remove-cluster.md): Learn more about removing a high availability cluster. - [Manage Broker VM data collector applets](https://cortex-docs.paloaltonetworks.com/cortex-xdr-3.x/cortex-xdr-3.x-documentation/data-management/broker-vm/manage-broker-vm-data-collector-applets.md): Learn more about managing your Broker VM data collector applets from the Broker VMs page. - [Broker VM notifications](https://cortex-docs.paloaltonetworks.com/cortex-xdr-3.x/cortex-xdr-3.x-documentation/data-management/broker-vm/broker-vm-notifications.md): Learn about the notifications that are relevant to Cortex XDR Broker VMs. - [Monitor Broker VM activity](https://cortex-docs.paloaltonetworks.com/cortex-xdr-3.x/cortex-xdr-3.x-documentation/data-management/broker-vm/monitor-broker-vm-activity.md): Learn more about the monitored Cortex XDR Broker VM activities. - [Troubleshoot Broker VM applet errors](https://cortex-docs.paloaltonetworks.com/cortex-xdr-3.x/cortex-xdr-3.x-documentation/data-management/broker-vm/troubleshoot-broker-vm-applet-errors.md): Learn more about how to verify the Broker VM applet application, connectivity, and processing errors and troubleshoot. - [XDR Collectors](https://cortex-docs.paloaltonetworks.com/cortex-xdr-3.x/cortex-xdr-3.x-documentation/data-management/xdr-collectors.md): Learn how XDR Collectors can be used for on-premise data collection on Windows and Linux machines. - [XDR Collector audit logs](https://cortex-docs.paloaltonetworks.com/cortex-xdr-3.x/cortex-xdr-3.x-documentation/data-management/xdr-collectors/xdr-collector-audit-logs.md): Learn more about XDR Collector audit logs. - [XDR Collector machine requirements and supported operating systems](https://cortex-docs.paloaltonetworks.com/cortex-xdr-3.x/cortex-xdr-3.x-documentation/data-management/xdr-collectors/xdr-collector-machine-requirements-and-supported-operating-systems.md): Learn about the supported operating systems and requirements for the collector machines used for the Cortex XDR Collectors. - [Resources required to enable access to XDR Collectors](https://cortex-docs.paloaltonetworks.com/cortex-xdr-3.x/cortex-xdr-3.x-documentation/data-management/xdr-collectors/resources-required-to-enable-access-to-xdr-collectors.md): Depending on your network environment settings, you should enable network access to the Cortex XDR Collectors resources. - [Manage XDR Collectors](https://cortex-docs.paloaltonetworks.com/cortex-xdr-3.x/cortex-xdr-3.x-documentation/data-management/xdr-collectors/manage-xdr-collectors.md): Manage Cortex XDR collectors. - [Configure the XDR Collector upgrade scheduler](https://cortex-docs.paloaltonetworks.com/cortex-xdr-3.x/cortex-xdr-3.x-documentation/data-management/xdr-collectors/manage-xdr-collectors/configure-the-xdr-collector-upgrade-scheduler.md): You can configure the Cortex XDR Collector upgrade scheduler and the number of parallel upgrades. - [Create an XDR Collector installation package](https://cortex-docs.paloaltonetworks.com/cortex-xdr-3.x/cortex-xdr-3.x-documentation/data-management/xdr-collectors/manage-xdr-collectors/create-an-xdr-collector-installation-package.md): Learn how to create an XDR Collector installation package for a Windows or Linux collector machine. - [Install the XDR Collector installation package for Windows](https://cortex-docs.paloaltonetworks.com/cortex-xdr-3.x/cortex-xdr-3.x-documentation/data-management/xdr-collectors/manage-xdr-collectors/install-the-xdr-collector-installation-package-for-windows.md): Learn about the Cortex XDR Collector installation options on Windows collector machines. - [Install the XDR Collector on Windows using the MSI](https://cortex-docs.paloaltonetworks.com/cortex-xdr-3.x/cortex-xdr-3.x-documentation/data-management/xdr-collectors/manage-xdr-collectors/install-the-xdr-collector-installation-package-for-windows/install-the-xdr-collector-on-windows-using-the-msi.md): Learn how to install the Cortex XDR Collector on Windows using the MSI. - [Install the XDR Collector on Windows using Msiexec](https://cortex-docs.paloaltonetworks.com/cortex-xdr-3.x/cortex-xdr-3.x-documentation/data-management/xdr-collectors/manage-xdr-collectors/install-the-xdr-collector-installation-package-for-windows/install-the-xdr-collector-on-windows-using-msiexec.md): Learn how to install the Cortex XDR Collectors on Windows using the Msiexec. - [Install the XDR Collector installation package for Linux](https://cortex-docs.paloaltonetworks.com/cortex-xdr-3.x/cortex-xdr-3.x-documentation/data-management/xdr-collectors/manage-xdr-collectors/install-the-xdr-collector-installation-package-for-linux.md): Learn how to install the Cortex XDR Collector on Linux collector machines. - [XDR Collectors installation resource for Windows and Linux](https://cortex-docs.paloaltonetworks.com/cortex-xdr-3.x/cortex-xdr-3.x-documentation/data-management/xdr-collectors/manage-xdr-collectors/xdr-collectors-installation-resource-for-windows-and-linux.md): Cortex XDR Collectors installation resource for Windows and Linux. - [Set an application proxy for XDR Collectors](https://cortex-docs.paloaltonetworks.com/cortex-xdr-3.x/cortex-xdr-3.x-documentation/data-management/xdr-collectors/manage-xdr-collectors/set-an-application-proxy-for-xdr-collectors.md): You can set an application-specific proxy for a Cortex XDR Collector without affecting the communication of other applications on the collector machine. - [Upgrade XDR Collectors](https://cortex-docs.paloaltonetworks.com/cortex-xdr-3.x/cortex-xdr-3.x-documentation/data-management/xdr-collectors/manage-xdr-collectors/upgrade-xdr-collectors.md): You can upgrade the Cortex XDR Collector software by using the appropriate method for the collector machine operating system. - [Uninstall the XDR Collector](https://cortex-docs.paloaltonetworks.com/cortex-xdr-3.x/cortex-xdr-3.x-documentation/data-management/xdr-collectors/manage-xdr-collectors/uninstall-the-xdr-collector.md): You can uninstall the Cortex XDR Collector from one or more Windows or Linux collector machines at any time. - [Set an alias for an XDR Collector machine](https://cortex-docs.paloaltonetworks.com/cortex-xdr-3.x/cortex-xdr-3.x-documentation/data-management/xdr-collectors/manage-xdr-collectors/set-an-alias-for-an-xdr-collector-machine.md): Configure an alias to identify one or more collector machines by a name that is different from the collector machine hostname. - [Define XDR Collector machine groups](https://cortex-docs.paloaltonetworks.com/cortex-xdr-3.x/cortex-xdr-3.x-documentation/data-management/xdr-collectors/define-xdr-collector-machine-groups.md): To easily apply policy rules and manage specific collector machines, you can define a collector machine group. - [About Cortex XDR Collector content updates](https://cortex-docs.paloaltonetworks.com/cortex-xdr-3.x/cortex-xdr-3.x-documentation/data-management/xdr-collectors/about-cortex-xdr-collector-content-updates.md): To quickly resolve any issues in policy, Palo Alto Networks can seamlessly deliver software packages called content updates. - [XDR Collector profiles](https://cortex-docs.paloaltonetworks.com/cortex-xdr-3.x/cortex-xdr-3.x-documentation/data-management/xdr-collectors/xdr-collector-profiles.md): Add an XDR collector profile to define the type of data to collect from a Linux or Windows platform. - [Add an XDR Collector Profile for Windows](https://cortex-docs.paloaltonetworks.com/cortex-xdr-3.x/cortex-xdr-3.x-documentation/data-management/xdr-collectors/add-an-xdr-collector-profile-for-windows.md): Add a Cortex XDR Collector profile, which defines the data that is collected from a Windows collector machine, and defines automatic XDR Collector upgrade settings. - [Ingest Logs from Windows DHCP using Elasticsearch Filebeat](https://cortex-docs.paloaltonetworks.com/cortex-xdr-3.x/cortex-xdr-3.x-documentation/data-management/xdr-collectors/add-an-xdr-collector-profile-for-windows/ingest-logs-from-windows-dhcp-using-elasticsearch-filebeat.md): Learn how to configure Cortex XDR to receive Windows DHCP logs. - [Ingest Windows DNS debug logs using Elasticsearch Filebeat](https://cortex-docs.paloaltonetworks.com/cortex-xdr-3.x/cortex-xdr-3.x-documentation/data-management/xdr-collectors/add-an-xdr-collector-profile-for-windows/ingest-windows-dns-debug-logs-using-elasticsearch-filebeat.md): Extend Cortex XDR visibility into Windows DNS Debug logs using Elasticsearch Filebeat with an XDR Collectors profile. - [Query Windows Event Log records](https://cortex-docs.paloaltonetworks.com/cortex-xdr-3.x/cortex-xdr-3.x-documentation/data-management/xdr-collectors/add-an-xdr-collector-profile-for-windows/query-windows-event-log-records.md) - [Add an XDR Collector profile for Linux](https://cortex-docs.paloaltonetworks.com/cortex-xdr-3.x/cortex-xdr-3.x-documentation/data-management/xdr-collectors/add-an-xdr-collector-profile-for-linux.md): Add a Cortex XDR Collector profile, which defines the data that is collected from a Linux collector machine, and defines automatic XDR Collector upgrade settings. - [Apply profiles to collection machine policies](https://cortex-docs.paloaltonetworks.com/cortex-xdr-3.x/cortex-xdr-3.x-documentation/data-management/xdr-collectors/apply-profiles-to-collection-machine-policies.md): Enable a Cortex XDR Collector profile by mapping it to a policy. - [XDR Collector datasets](https://cortex-docs.paloaltonetworks.com/cortex-xdr-3.x/cortex-xdr-3.x-documentation/data-management/xdr-collectors/xdr-collector-datasets.md): After Cortex XDR begins receiving data from your XDR Collectors configuration, the app automatically creates an XQL dataset. - [Data Ingestion](https://cortex-docs.paloaltonetworks.com/cortex-xdr-3.x/cortex-xdr-3.x-documentation/data-management/data-ingestion.md): Data can be ingested both from Palo Alto Networks products, and from third-party vendor products. - [Visibility of logs and alerts from external sources](https://cortex-docs.paloaltonetworks.com/cortex-xdr-3.x/cortex-xdr-3.x-documentation/data-management/data-ingestion/visibility-of-logs-and-alerts-from-external-sources.md): Cortex XDR provides visibility into your external logs. The availability of logs and alerts varies by the data source. - [Visibility of Cortex XDR audit and authentication logs](https://cortex-docs.paloaltonetworks.com/cortex-xdr-3.x/cortex-xdr-3.x-documentation/data-management/data-ingestion/visibility-of-cortex-xdr-audit-and-authentication-logs.md): Monitor Cortex XDR authentication and audit logs for detecting attacks on Cortex XDR. - [External data ingestion vendor support](https://cortex-docs.paloaltonetworks.com/cortex-xdr-3.x/cortex-xdr-3.x-documentation/data-management/data-ingestion/external-data-ingestion-vendor-support.md): To augment your Cortex XDR data, you can set up Cortex XDR to ingest data from a variety of external third-party sources. - [Palo Alto Networks integrations](https://cortex-docs.paloaltonetworks.com/cortex-xdr-3.x/cortex-xdr-3.x-documentation/data-management/data-ingestion/palo-alto-networks-integrations.md): Cortex XDR supports Palo Alto Networks data ingestion. - [About Palo Alto Networks integrations](https://cortex-docs.paloaltonetworks.com/cortex-xdr-3.x/cortex-xdr-3.x-documentation/data-management/data-ingestion/palo-alto-networks-integrations/about-palo-alto-networks-integrations.md): Stream data directly from other Palo Alto Networks products to Cortex XDR. - [Ingest data from Next-Generation Firewall](https://cortex-docs.paloaltonetworks.com/cortex-xdr-3.x/cortex-xdr-3.x-documentation/data-management/data-ingestion/palo-alto-networks-integrations/ingest-data-from-next-generation-firewall.md): Learn how to ingest detection data from Next-Generation Firewall and Panorama. - [Ingest Next-Generation Firewall logs using the Syslog collector](https://cortex-docs.paloaltonetworks.com/cortex-xdr-3.x/cortex-xdr-3.x-documentation/data-management/data-ingestion/palo-alto-networks-integrations/ingest-data-from-next-generation-firewall/ingest-next-generation-firewall-logs-using-the-syslog-collector.md): Use the Syslog collector to ingest NGFW logs in CEF format. This method is useful when your firewalls are located in a different region, or bandwidth issues are encountered due to large log size. - [Ingest data from Prisma Access](https://cortex-docs.paloaltonetworks.com/cortex-xdr-3.x/cortex-xdr-3.x-documentation/data-management/data-ingestion/palo-alto-networks-integrations/ingest-data-from-prisma-access.md): Learn how to ingest detection data from Prisma Access. - [Ingest logs from Prisma Access Browser](https://cortex-docs.paloaltonetworks.com/cortex-xdr-3.x/cortex-xdr-3.x-documentation/data-management/data-ingestion/palo-alto-networks-integrations/ingest-logs-from-prisma-access-browser.md): Ingest Prisma Browser logs into Cortex XDR. - [Ingest Alerts from Prisma Cloud Compute](https://cortex-docs.paloaltonetworks.com/cortex-xdr-3.x/cortex-xdr-3.x-documentation/data-management/data-ingestion/palo-alto-networks-integrations/ingest-alerts-from-prisma-cloud-compute.md): Configure Data Collection Settings to receive alerts from Prisma Cloud Compute. - [Ingest Alerts from Prisma Cloud](https://cortex-docs.paloaltonetworks.com/cortex-xdr-3.x/cortex-xdr-3.x-documentation/data-management/data-ingestion/palo-alto-networks-integrations/ingest-alerts-from-prisma-cloud.md): Configure Data Collection Settings in Cortex XDR to receive alerts from Prisma Cloud. - [Ingest detection data from Strata Logging Service](https://cortex-docs.paloaltonetworks.com/cortex-xdr-3.x/cortex-xdr-3.x-documentation/data-management/data-ingestion/palo-alto-networks-integrations/ingest-detection-data-from-strata-logging-service.md): Learn how to ingest detection data from Strata Logging Service. - [Ingest Alerts and Assets from PAN IoT Security (Deprecated)](https://cortex-docs.paloaltonetworks.com/cortex-xdr-3.x/cortex-xdr-3.x-documentation/data-management/data-ingestion/palo-alto-networks-integrations/ingest-alerts-and-assets-from-pan-iot-security.md): Ingest alerts and device data from IoT Security. - [Ingest alerts and assets from Device Security](https://cortex-docs.paloaltonetworks.com/cortex-xdr-3.x/cortex-xdr-3.x-documentation/data-management/data-ingestion/palo-alto-networks-integrations/ingest-alerts-and-assets-from-device-security.md) - [Collecting URL and File log types](https://cortex-docs.paloaltonetworks.com/cortex-xdr-3.x/cortex-xdr-3.x-documentation/data-management/data-ingestion/palo-alto-networks-integrations/collecting-url-and-file-log-types.md): Learn about the implications of turning off or on collection of URL and File logs. - [Detectors connected to URL and File log types](https://cortex-docs.paloaltonetworks.com/cortex-xdr-3.x/cortex-xdr-3.x-documentation/data-management/data-ingestion/palo-alto-networks-integrations/collecting-url-and-file-log-types/detectors-connected-to-url-and-file-log-types.md): A list of detectors connected to URL and File log types. - [External data ingestion](https://cortex-docs.paloaltonetworks.com/cortex-xdr-3.x/cortex-xdr-3.x-documentation/data-management/data-ingestion/external-data-ingestion.md): Cortex XDR supports external data ingestion for a variety of service types and vendors. - [External applications](https://cortex-docs.paloaltonetworks.com/cortex-xdr-3.x/cortex-xdr-3.x-documentation/data-management/data-ingestion/external-data-ingestion/external-applications.md): Learn more about integrating Slack and a Syslog Receiver to Cortex XDR. - [Ingest network connection logs](https://cortex-docs.paloaltonetworks.com/cortex-xdr-3.x/cortex-xdr-3.x-documentation/data-management/data-ingestion/external-data-ingestion/ingest-network-connection-logs.md): Cortex XDR can ingest network connection logs from different third-party sources. - [Ingest network flow logs from Amazon S3](https://cortex-docs.paloaltonetworks.com/cortex-xdr-3.x/cortex-xdr-3.x-documentation/data-management/data-ingestion/external-data-ingestion/ingest-network-connection-logs/ingest-network-flow-logs-from-amazon-s3.md): Take advantage of Cortex XDR investigation capabilities and set up network flow log ingestion for your Amazon S3 logs using an AWS CloudFormation Script. - [Create an assumed role](https://cortex-docs.paloaltonetworks.com/cortex-xdr-3.x/cortex-xdr-3.x-documentation/data-management/data-ingestion/external-data-ingestion/ingest-network-connection-logs/ingest-network-flow-logs-from-amazon-s3/create-an-assumed-role.md): Learn about creating an AWS Assumed Role for Cortex XDR. - [Configure data collection from Amazon S3 manually](https://cortex-docs.paloaltonetworks.com/cortex-xdr-3.x/cortex-xdr-3.x-documentation/data-management/data-ingestion/external-data-ingestion/ingest-network-connection-logs/ingest-network-flow-logs-from-amazon-s3/configure-data-collection-from-amazon-s3-manually.md): Set up network flow log ingestion for your Amazon S3 logs manually (without a script). - [Ingest Network Route 53 Logs from Amazon S3](https://cortex-docs.paloaltonetworks.com/cortex-xdr-3.x/cortex-xdr-3.x-documentation/data-management/data-ingestion/external-data-ingestion/ingest-network-connection-logs/ingest-network-route-53-logs-from-amazon-s3.md): Take advantage of Cortex XDR investigation capabilities and set up network Route 53 ingestion for your Amazon S3 logs using an AWS CloudFormation Script. - [Ingest logs from Check Point firewalls](https://cortex-docs.paloaltonetworks.com/cortex-xdr-3.x/cortex-xdr-3.x-documentation/data-management/data-ingestion/external-data-ingestion/ingest-network-connection-logs/ingest-logs-from-check-point-firewalls.md): To take advantage of Cortex XDR investigation and detection capabilities while using Check Point firewalls, forward your firewall logs to Cortex XDR. - [Ingest logs from Cisco ASA firewalls and AnyConnect](https://cortex-docs.paloaltonetworks.com/cortex-xdr-3.x/cortex-xdr-3.x-documentation/data-management/data-ingestion/external-data-ingestion/ingest-network-connection-logs/ingest-logs-from-cisco-asa-firewalls-and-anyconnect.md): Extend Cortex XDR visibility into logs from Cisco ASA firewalls and Cisco AnyConnect VPN. - [Ingest logs from Corelight Zeek](https://cortex-docs.paloaltonetworks.com/cortex-xdr-3.x/cortex-xdr-3.x-documentation/data-management/data-ingestion/external-data-ingestion/ingest-network-connection-logs/ingest-logs-from-corelight-zeek.md): Extend Cortex XDR visibility into logs from Corelight Zeek. - [Ingest logs from Fortinet Fortigate firewalls](https://cortex-docs.paloaltonetworks.com/cortex-xdr-3.x/cortex-xdr-3.x-documentation/data-management/data-ingestion/external-data-ingestion/ingest-network-connection-logs/ingest-logs-from-fortinet-fortigate-firewalls.md): Extend Cortex XDR visibility into logs from Fortinet Fortigate firewalls. - [Ingest Logs and Data from a GCP Pub/Sub](https://cortex-docs.paloaltonetworks.com/cortex-xdr-3.x/cortex-xdr-3.x-documentation/data-management/data-ingestion/external-data-ingestion/ingest-network-connection-logs/ingest-logs-and-data-from-a-gcp-pubsub.md): If you use the Pub/Sub messaging service from Global Cloud Platform (GCP), you can send logs and data from GCP to Cortex XDR. - [Ingest Logs from Microsoft Azure Event Hub](https://cortex-docs.paloaltonetworks.com/cortex-xdr-3.x/cortex-xdr-3.x-documentation/data-management/data-ingestion/external-data-ingestion/ingest-network-connection-logs/ingest-logs-from-microsoft-azure-event-hub.md): Ingest logs from Microsoft Azure Event Hub with an option to ingest audit logs to use in Cortex XDR authentication stories. - [Ingest network flow logs from Microsoft Azure Network Watcher](https://cortex-docs.paloaltonetworks.com/cortex-xdr-3.x/cortex-xdr-3.x-documentation/data-management/data-ingestion/external-data-ingestion/ingest-network-connection-logs/ingest-network-flow-logs-from-microsoft-azure-network-watcher.md): Ingest network security group (NSG) or Virtual network (VNet) flow logs from Microsoft Azure Network Watcher for use in Cortex XDR network stories. - [Ingest Logs and Data from Okta](https://cortex-docs.paloaltonetworks.com/cortex-xdr-3.x/cortex-xdr-3.x-documentation/data-management/data-ingestion/external-data-ingestion/ingest-network-connection-logs/ingest-logs-and-data-from-okta.md): Ingest authentication logs and data from Okta for use in Cortex XDR authentication stories. - [Ingest logs from Windows DHCP using Elasticsearch Filebeat](https://cortex-docs.paloaltonetworks.com/cortex-xdr-3.x/cortex-xdr-3.x-documentation/data-management/data-ingestion/external-data-ingestion/ingest-network-connection-logs/ingest-logs-from-windows-dhcp-using-elasticsearch-filebeat.md): Learn how to configure Cortex XDR to receive Windows DHCP logs. - [Ingest logs from Zscaler Internet Access](https://cortex-docs.paloaltonetworks.com/cortex-xdr-3.x/cortex-xdr-3.x-documentation/data-management/data-ingestion/external-data-ingestion/ingest-network-connection-logs/ingest-logs-from-zscaler-internet-access.md): Extend Cortex XDR visibility into logs from Zscaler Internet Access (ZIA). - [Ingest logs from Zscaler Private Access](https://cortex-docs.paloaltonetworks.com/cortex-xdr-3.x/cortex-xdr-3.x-documentation/data-management/data-ingestion/external-data-ingestion/ingest-network-connection-logs/ingest-logs-from-zscaler-private-access.md): Extend Cortex XDR visibility into logs from Zscaler Private Access (ZPA). - [Ingest authentication logs and data](https://cortex-docs.paloaltonetworks.com/cortex-xdr-3.x/cortex-xdr-3.x-documentation/data-management/data-ingestion/external-data-ingestion/ingest-authentication-logs-and-data.md): Ingest authentication logs from external authentication services—such as Okta and Azure AD—into authentication stories with Cortex XDR. - [Ingest audit logs from AWS Cloud Trail](https://cortex-docs.paloaltonetworks.com/cortex-xdr-3.x/cortex-xdr-3.x-documentation/data-management/data-ingestion/external-data-ingestion/ingest-authentication-logs-and-data/ingest-audit-logs-from-aws-cloud-trail.md): Take advantage of Cortex XDR investigation capabilities and set up audit log ingestion for your AWS CloudTrail logs. - [Ingest Logs and Data from a GCP Pub/Sub](https://cortex-docs.paloaltonetworks.com/cortex-xdr-3.x/cortex-xdr-3.x-documentation/data-management/data-ingestion/external-data-ingestion/ingest-authentication-logs-and-data/ingest-logs-and-data-from-a-gcp-pubsub.md): If you use the Pub/Sub messaging service from Global Cloud Platform (GCP), you can send logs and data from GCP to Cortex XDR. - [Ingest Logs and Data from Google Workspace](https://cortex-docs.paloaltonetworks.com/cortex-xdr-3.x/cortex-xdr-3.x-documentation/data-management/data-ingestion/external-data-ingestion/ingest-authentication-logs-and-data/ingest-logs-and-data-from-google-workspace.md): Ingest logs and data from Google Workspace for use in Cortex XDR. - [Ingest Logs from Microsoft Azure Event Hub](https://cortex-docs.paloaltonetworks.com/cortex-xdr-3.x/cortex-xdr-3.x-documentation/data-management/data-ingestion/external-data-ingestion/ingest-authentication-logs-and-data/ingest-logs-from-microsoft-azure-event-hub.md): Ingest logs from Microsoft Azure Event Hub with an option to ingest audit logs to use in Cortex XDR authentication stories. - [Ingest logs and data from Microsoft 365](https://cortex-docs.paloaltonetworks.com/cortex-xdr-3.x/cortex-xdr-3.x-documentation/data-management/data-ingestion/external-data-ingestion/ingest-authentication-logs-and-data/ingest-logs-and-data-from-microsoft-365.md): Learn more about collecting logs and data from Microsoft 365. - [Ingest Logs from Microsoft Office 365](https://cortex-docs.paloaltonetworks.com/cortex-xdr-3.x/cortex-xdr-3.x-documentation/data-management/data-ingestion/external-data-ingestion/ingest-authentication-logs-and-data/ingest-logs-from-microsoft-office-365.md): Ingest logs and data from Microsoft Office 365 Management Activity API and Microsoft Graph API for use in Cortex XDR. - [Ingest Logs and Data from Okta](https://cortex-docs.paloaltonetworks.com/cortex-xdr-3.x/cortex-xdr-3.x-documentation/data-management/data-ingestion/external-data-ingestion/ingest-authentication-logs-and-data/ingest-logs-and-data-from-okta.md): Ingest authentication logs and data from Okta for use in Cortex XDR authentication stories. - [Ingest Logs and Data from OneLogin](https://cortex-docs.paloaltonetworks.com/cortex-xdr-3.x/cortex-xdr-3.x-documentation/data-management/data-ingestion/external-data-ingestion/ingest-authentication-logs-and-data/ingest-logs-and-data-from-onelogin.md): Learn how to ingest different types of logs and data from OneLogin. - [Ingest authentication logs from PingFederate](https://cortex-docs.paloaltonetworks.com/cortex-xdr-3.x/cortex-xdr-3.x-documentation/data-management/data-ingestion/external-data-ingestion/ingest-authentication-logs-and-data/ingest-authentication-logs-from-pingfederate.md): Ingest authentication logs and data from PingFederate for use in Cortex XDR authentication stories. - [Ingest Authentication Logs and Data from PingOne](https://cortex-docs.paloaltonetworks.com/cortex-xdr-3.x/cortex-xdr-3.x-documentation/data-management/data-ingestion/external-data-ingestion/ingest-authentication-logs-and-data/ingest-authentication-logs-and-data-from-pingone.md): Ingest authentication logs and data from PingOne for Enterprise for use in Cortex XDR authentication stories. - [Ingest operation and system logs from cloud providers](https://cortex-docs.paloaltonetworks.com/cortex-xdr-3.x/cortex-xdr-3.x-documentation/data-management/data-ingestion/external-data-ingestion/ingest-operation-and-system-logs-from-cloud-providers.md): Learn how to ingest operation and system logs from supported cloud providers into Cortex XDR. - [Ingest generic logs from Amazon S3](https://cortex-docs.paloaltonetworks.com/cortex-xdr-3.x/cortex-xdr-3.x-documentation/data-management/data-ingestion/external-data-ingestion/ingest-operation-and-system-logs-from-cloud-providers/ingest-generic-logs-from-amazon-s3.md) - [Ingest logs from Amazon CloudWatch](https://cortex-docs.paloaltonetworks.com/cortex-xdr-3.x/cortex-xdr-3.x-documentation/data-management/data-ingestion/external-data-ingestion/ingest-operation-and-system-logs-from-cloud-providers/ingest-logs-from-amazon-cloudwatch.md): Take advantage of Cortex XDR investigation capabilities and set up generic or EKS log ingestion for your Amazon CloudWatch logs. - [Ingest Logs and Data from a GCP Pub/Sub](https://cortex-docs.paloaltonetworks.com/cortex-xdr-3.x/cortex-xdr-3.x-documentation/data-management/data-ingestion/external-data-ingestion/ingest-operation-and-system-logs-from-cloud-providers/ingest-logs-and-data-from-a-gcp-pubsub.md): If you use the Pub/Sub messaging service from Global Cloud Platform (GCP), you can send logs and data from GCP to Cortex XDR. - [Ingest logs from Google Kubernetes Engine](https://cortex-docs.paloaltonetworks.com/cortex-xdr-3.x/cortex-xdr-3.x-documentation/data-management/data-ingestion/external-data-ingestion/ingest-operation-and-system-logs-from-cloud-providers/ingest-logs-from-google-kubernetes-engine.md): Forward your Google Kubernetes Engine (GKE) logs directly to Cortex XDR using Elasticsearch Filebeat. - [Ingest Logs from Microsoft Azure Event Hub](https://cortex-docs.paloaltonetworks.com/cortex-xdr-3.x/cortex-xdr-3.x-documentation/data-management/data-ingestion/external-data-ingestion/ingest-operation-and-system-logs-from-cloud-providers/ingest-logs-from-microsoft-azure-event-hub.md): Ingest logs from Microsoft Azure Event Hub with an option to ingest audit logs to use in Cortex XDR authentication stories. - [Ingest Logs and Data from Okta](https://cortex-docs.paloaltonetworks.com/cortex-xdr-3.x/cortex-xdr-3.x-documentation/data-management/data-ingestion/external-data-ingestion/ingest-operation-and-system-logs-from-cloud-providers/ingest-logs-and-data-from-okta.md): Ingest authentication logs and data from Okta for use in Cortex XDR authentication stories. - [Ingest endpoint data](https://cortex-docs.paloaltonetworks.com/cortex-xdr-3.x/cortex-xdr-3.x-documentation/data-management/data-ingestion/external-data-ingestion/ingest-endpoint-data.md): Cortex XDR enables you to ingest endpoint data. - [Ingest cloud assets](https://cortex-docs.paloaltonetworks.com/cortex-xdr-3.x/cortex-xdr-3.x-documentation/data-management/data-ingestion/external-data-ingestion/ingest-cloud-assets.md): You can ingest cloud assets from different third-party sources using Cortex XDR. - [Ingest Cloud Assets from AWS](https://cortex-docs.paloaltonetworks.com/cortex-xdr-3.x/cortex-xdr-3.x-documentation/data-management/data-ingestion/external-data-ingestion/ingest-cloud-assets/ingest-cloud-assets-from-aws.md): Extend Cortex XDR visibility into cloud assets from AWS. - [Ingest Cloud Assets from Google Cloud Platform](https://cortex-docs.paloaltonetworks.com/cortex-xdr-3.x/cortex-xdr-3.x-documentation/data-management/data-ingestion/external-data-ingestion/ingest-cloud-assets/ingest-cloud-assets-from-google-cloud-platform.md): Extend Cortex XDR visibility into cloud assets from Google Cloud Platform. - [Ingest Cloud Assets from Microsoft Azure](https://cortex-docs.paloaltonetworks.com/cortex-xdr-3.x/cortex-xdr-3.x-documentation/data-management/data-ingestion/external-data-ingestion/ingest-cloud-assets/ingest-cloud-assets-from-microsoft-azure.md): Extend Cortex XDR visibility into cloud assets from Microsoft Azure. - [Additional log ingestion methods](https://cortex-docs.paloaltonetworks.com/cortex-xdr-3.x/cortex-xdr-3.x-documentation/data-management/data-ingestion/external-data-ingestion/additional-log-ingestion-methods.md): Cortex XDR supports custom log ingestion methods. - [Ingest logs from a Syslog receiver](https://cortex-docs.paloaltonetworks.com/cortex-xdr-3.x/cortex-xdr-3.x-documentation/data-management/data-ingestion/external-data-ingestion/additional-log-ingestion-methods/ingest-logs-from-a-syslog-receiver.md): To extend visibility, Cortex XDR can receive Syslog from additional vendors that use CEF or LEEF formatted over Syslog (TLS not supported). - [Ingest Apache Kafka events as datasets](https://cortex-docs.paloaltonetworks.com/cortex-xdr-3.x/cortex-xdr-3.x-documentation/data-management/data-ingestion/external-data-ingestion/additional-log-ingestion-methods/ingest-apache-kafka-events-as-datasets.md): Cortex XDR can receive logs and data from Apache Kafka directly to your log repository for query and visualization purposes. - [Ingest CSV files as datasets](https://cortex-docs.paloaltonetworks.com/cortex-xdr-3.x/cortex-xdr-3.x-documentation/data-management/data-ingestion/external-data-ingestion/additional-log-ingestion-methods/ingest-csv-files-as-datasets.md): Cortex XDR can receive CSV log files from a shared Windows directory, where the CSV log files must conform to specific guidelines. - [Ingest database data as datasets](https://cortex-docs.paloaltonetworks.com/cortex-xdr-3.x/cortex-xdr-3.x-documentation/data-management/data-ingestion/external-data-ingestion/additional-log-ingestion-methods/ingest-database-data-as-datasets.md): Cortex XDR can receive data from a client relational database directly to your log repository. - [Ingest logs in a network share as datasets](https://cortex-docs.paloaltonetworks.com/cortex-xdr-3.x/cortex-xdr-3.x-documentation/data-management/data-ingestion/external-data-ingestion/additional-log-ingestion-methods/ingest-logs-in-a-network-share-as-datasets.md): Cortex XDR can receive logs from files and folders in a network share directly to your log repository for query and visualization purposes. - [Ingest FTP files as datasets](https://cortex-docs.paloaltonetworks.com/cortex-xdr-3.x/cortex-xdr-3.x-documentation/data-management/data-ingestion/external-data-ingestion/additional-log-ingestion-methods/ingest-ftp-files-as-datasets.md): Cortex XDR can receive logs from files and folders via FTP, FTPS, and SFTP directly to your log repository for query and visualization purposes. - [Ingest NetFlow flow records as datasets](https://cortex-docs.paloaltonetworks.com/cortex-xdr-3.x/cortex-xdr-3.x-documentation/data-management/data-ingestion/external-data-ingestion/additional-log-ingestion-methods/ingest-netflow-flow-records-as-datasets.md): Cortex XDR can receive NetFlow flow records and IPFIX from a UDP port directly to your log repository for query and visualization purposes. - [Set up an HTTP Log Collector to Receive Logs](https://cortex-docs.paloaltonetworks.com/cortex-xdr-3.x/cortex-xdr-3.x-documentation/data-management/data-ingestion/external-data-ingestion/additional-log-ingestion-methods/set-up-an-http-log-collector-to-receive-logs.md): You can set up Cortex XDR to receive logs from third-party sources, and automatically parse and process these logs. - [Ingest logs from BeyondTrust Privilege Management Cloud](https://cortex-docs.paloaltonetworks.com/cortex-xdr-3.x/cortex-xdr-3.x-documentation/data-management/data-ingestion/external-data-ingestion/additional-log-ingestion-methods/ingest-logs-from-beyondtrust-privilege-management-cloud.md): Extend Cortex XDR visibility into logs from BeyondTrust Privilege Management Cloud. - [Ingest Logs and Data from Box](https://cortex-docs.paloaltonetworks.com/cortex-xdr-3.x/cortex-xdr-3.x-documentation/data-management/data-ingestion/external-data-ingestion/additional-log-ingestion-methods/ingest-logs-and-data-from-box.md): Ingest logs and data from Box enterprise accounts via the Box REST APIs. - [Ingest Logs and Data from Dropbox](https://cortex-docs.paloaltonetworks.com/cortex-xdr-3.x/cortex-xdr-3.x-documentation/data-management/data-ingestion/external-data-ingestion/additional-log-ingestion-methods/ingest-logs-and-data-from-dropbox.md): Ingest logs and data from Dropbox Business accounts via the Dropbox Business API. - [Ingest Logs from Elasticsearch Filebeat](https://cortex-docs.paloaltonetworks.com/cortex-xdr-3.x/cortex-xdr-3.x-documentation/data-management/data-ingestion/external-data-ingestion/additional-log-ingestion-methods/ingest-logs-from-elasticsearch-filebeat.md): Cortex XDR can ingest logs from Elasticsearch Filebeat, a file system logger that logs file activity on your endpoints and servers. - [Ingest logs from Forcepoint DLP](https://cortex-docs.paloaltonetworks.com/cortex-xdr-3.x/cortex-xdr-3.x-documentation/data-management/data-ingestion/external-data-ingestion/additional-log-ingestion-methods/ingest-logs-from-forcepoint-dlp.md): Extend Cortex XDR visibility into logs from Forcepoint DLP. - [Ingest Logs from Proofpoint Targeted Attack Protection](https://cortex-docs.paloaltonetworks.com/cortex-xdr-3.x/cortex-xdr-3.x-documentation/data-management/data-ingestion/external-data-ingestion/additional-log-ingestion-methods/ingest-logs-from-proofpoint-targeted-attack-protection.md): Ingest logs from Proofpoint Targeted Attack Protection (TAP). - [Ingest logs and data from Salesforce.com](https://cortex-docs.paloaltonetworks.com/cortex-xdr-3.x/cortex-xdr-3.x-documentation/data-management/data-ingestion/external-data-ingestion/additional-log-ingestion-methods/ingest-logs-and-data-from-salesforce.com.md): Use the Cortex XDR data collector to collect Audit Trail and Security Monitoring event logs from Salesforce.com. - [Ingest Data from ServiceNow CMDB](https://cortex-docs.paloaltonetworks.com/cortex-xdr-3.x/cortex-xdr-3.x-documentation/data-management/data-ingestion/external-data-ingestion/additional-log-ingestion-methods/ingest-data-from-servicenow-cmdb.md): Extend Cortex XDR visibility into data from ServiceNow CMDB. - [Ingest Report Data from Workday](https://cortex-docs.paloaltonetworks.com/cortex-xdr-3.x/cortex-xdr-3.x-documentation/data-management/data-ingestion/external-data-ingestion/additional-log-ingestion-methods/ingest-report-data-from-workday.md): Extend Cortex XDR visibility into reports data from Workday. - [Ingest external alerts](https://cortex-docs.paloaltonetworks.com/cortex-xdr-3.x/cortex-xdr-3.x-documentation/data-management/data-ingestion/external-data-ingestion/additional-log-ingestion-methods/ingest-external-alerts.md): For a more complete and detailed picture of the activity involved in an incident, Cortex XDR can ingest alerts from any external source. - [Overview of data ingestion metrics](https://cortex-docs.paloaltonetworks.com/cortex-xdr-3.x/cortex-xdr-3.x-documentation/data-management/data-ingestion/overview-of-data-ingestion-metrics.md): Learn more about the data ingestion health metrics in the metrics\_source dataset and the metrics\_view preset. - [Creating correlation rules to monitor data ingestion health](https://cortex-docs.paloaltonetworks.com/cortex-xdr-3.x/cortex-xdr-3.x-documentation/data-management/data-ingestion/creating-correlation-rules-to-monitor-data-ingestion-health.md): See examples of correlation rules for monitoring data ingestion health. - [Measuring data freshness](https://cortex-docs.paloaltonetworks.com/cortex-xdr-3.x/cortex-xdr-3.x-documentation/data-management/data-ingestion/measuring-data-freshness.md): Learn more about the data freshness metrics collected by Cortex XDR. - [Verifying collector connectivity](https://cortex-docs.paloaltonetworks.com/cortex-xdr-3.x/cortex-xdr-3.x-documentation/data-management/data-ingestion/verifying-collector-connectivity.md): Verify collector connectivity and troubleshoot collector errors. - [Dataset management](https://cortex-docs.paloaltonetworks.com/cortex-xdr-3.x/cortex-xdr-3.x-documentation/data-management/dataset-management.md): Learn more about managing your datasets and understanding your overall data storage, period based retention. - [What are datasets?](https://cortex-docs.paloaltonetworks.com/cortex-xdr-3.x/cortex-xdr-3.x-documentation/data-management/dataset-management/what-are-datasets.md): Learn how to import, delete, and interact with custom or third-party datasets in Cortex XDR. - [Lookup datasets](https://cortex-docs.paloaltonetworks.com/cortex-xdr-3.x/cortex-xdr-3.x-documentation/data-management/dataset-management/lookup-datasets.md): Learn more about lookup datasets to correlate data from a data source with events in your environment. - [Import a lookup dataset](https://cortex-docs.paloaltonetworks.com/cortex-xdr-3.x/cortex-xdr-3.x-documentation/data-management/dataset-management/lookup-datasets/import-a-lookup-dataset.md): Learn more about importing data from an external file to create or update a lookup dataset in Cortex XDR. - [Download JSON file of lookup dataset](https://cortex-docs.paloaltonetworks.com/cortex-xdr-3.x/cortex-xdr-3.x-documentation/data-management/dataset-management/lookup-datasets/download-json-file-of-lookup-dataset.md): Learn more about downloading a lookup dataset as a JSON file. - [Set time to live for lookup datasets](https://cortex-docs.paloaltonetworks.com/cortex-xdr-3.x/cortex-xdr-3.x-documentation/data-management/dataset-management/lookup-datasets/set-time-to-live-for-lookup-datasets.md): Learn more about setting the time to live (TTL) for lookup datasets in Cortex XDR. - [Monitor datasets and dataset views activity](https://cortex-docs.paloaltonetworks.com/cortex-xdr-3.x/cortex-xdr-3.x-documentation/data-management/dataset-management/monitor-datasets-and-dataset-views-activity.md): Learn more about the monitored Cortex XDR datasets and dataset views activities. - [Parsing Rules](https://cortex-docs.paloaltonetworks.com/cortex-xdr-3.x/cortex-xdr-3.x-documentation/data-management/parsing-rules.md): Learn more about Cortex XDR Parsing Rules. - [What are Parsing Rules?](https://cortex-docs.paloaltonetworks.com/cortex-xdr-3.x/cortex-xdr-3.x-documentation/data-management/parsing-rules/what-are-parsing-rules.md): Learn more about what are Parsing Rules and what they are used for. - [Parsing Rules editor views](https://cortex-docs.paloaltonetworks.com/cortex-xdr-3.x/cortex-xdr-3.x-documentation/data-management/parsing-rules/parsing-rules-editor-views.md): Learn about the Parsing Rules editor User Defined Rules, Default Rules, Both, and Simulate views. - [Parsing Rules file structure and syntax](https://cortex-docs.paloaltonetworks.com/cortex-xdr-3.x/cortex-xdr-3.x-documentation/data-management/parsing-rules/parsing-rules-file-structure-and-syntax.md): The Parsing Rules file consists of multiple sections of three types, which also represent the custom syntax specific to Parsing Rules. - [INGEST](https://cortex-docs.paloaltonetworks.com/cortex-xdr-3.x/cortex-xdr-3.x-documentation/data-management/parsing-rules/parsing-rules-file-structure-and-syntax/ingest.md): Understanding how to write an \\\[INGEST\\] section in a Parsing Rules file and the syntax to use. - [fields stage in INGEST](https://cortex-docs.paloaltonetworks.com/cortex-xdr-3.x/cortex-xdr-3.x-documentation/data-management/parsing-rules/parsing-rules-file-structure-and-syntax/ingest/fields-stage-in-ingest.md): Use 'fields' in Cortex XDR Parsing Rules. - [parse\_cef](https://cortex-docs.paloaltonetworks.com/cortex-xdr-3.x/cortex-xdr-3.x-documentation/data-management/parsing-rules/parsing-rules-file-structure-and-syntax/ingest/parse_cef.md) - [parse\_cisco](https://cortex-docs.paloaltonetworks.com/cortex-xdr-3.x/cortex-xdr-3.x-documentation/data-management/parsing-rules/parsing-rules-file-structure-and-syntax/ingest/parse_cisco.md): Learn more about the parse\_cisco() parsing rule function that parses a Cisco string to an object. - [parse\_json](https://cortex-docs.paloaltonetworks.com/cortex-xdr-3.x/cortex-xdr-3.x-documentation/data-management/parsing-rules/parsing-rules-file-structure-and-syntax/ingest/parse_json.md) - [COLLECT](https://cortex-docs.paloaltonetworks.com/cortex-xdr-3.x/cortex-xdr-3.x-documentation/data-management/parsing-rules/parsing-rules-file-structure-and-syntax/collect.md): Understand how to write a \\\[COLLECT\\] section in a Parsing Rules file, and the syntax to use. - [CONST](https://cortex-docs.paloaltonetworks.com/cortex-xdr-3.x/cortex-xdr-3.x-documentation/data-management/parsing-rules/parsing-rules-file-structure-and-syntax/const.md): Learn how to write a \\\[CONST\\] section in a Parsing Rules file and the syntax to use. - [RULE](https://cortex-docs.paloaltonetworks.com/cortex-xdr-3.x/cortex-xdr-3.x-documentation/data-management/parsing-rules/parsing-rules-file-structure-and-syntax/rule.md): Understanding how to write a \\\[RULE\\] section in a Parsing Rules file and the syntax to use. - [Create Parsing Rules](https://cortex-docs.paloaltonetworks.com/cortex-xdr-3.x/cortex-xdr-3.x-documentation/data-management/parsing-rules/create-parsing-rules.md): Cortex XDR includes an editor for creating 3rd party Parsing Rules. - [Troubleshooting Parsing rules errors](https://cortex-docs.paloaltonetworks.com/cortex-xdr-3.x/cortex-xdr-3.x-documentation/data-management/parsing-rules/troubleshooting-parsing-rules-errors.md): Learn how to easily identify and resolve parsing errors. - [Parsing Rules Raw Dataset](https://cortex-docs.paloaltonetworks.com/cortex-xdr-3.x/cortex-xdr-3.x-documentation/data-management/parsing-rules/parsing-rules-raw-dataset.md): Each vendor and product has its own raw dataset with its own default format that can be overridden in an INGEST section. - [Manage Event Forwarding](https://cortex-docs.paloaltonetworks.com/cortex-xdr-3.x/cortex-xdr-3.x-documentation/data-management/manage-event-forwarding.md): Save your ingested, parsed data in an external location by exporting your event logs to a temporary GCP storage bucket. - [Endpoints Event Forwarding - included/excluded fields by event type](https://cortex-docs.paloaltonetworks.com/cortex-xdr-3.x/cortex-xdr-3.x-documentation/data-management/manage-event-forwarding/endpoints-event-forwarding-includedexcluded-fields-by-event-type.md): Learn more about the included/excluded fields by event type for Endpoint Event Forwarding in Cortex XDR. - [Manage compute units](https://cortex-docs.paloaltonetworks.com/cortex-xdr-3.x/cortex-xdr-3.x-documentation/data-management/manage-compute-units.md): Learn more about managing and tracking your compute units usage for API and Cold Storage XQL queries. - [Compute units usage](https://cortex-docs.paloaltonetworks.com/cortex-xdr-3.x/cortex-xdr-3.x-documentation/data-management/manage-compute-units/compute-units-usage.md): Learn more about how to compute units (CU) works according to your license and available options after reaching your quota. - [Cortex XDR XQL](https://cortex-docs.paloaltonetworks.com/cortex-xdr-3.x/cortex-xdr-3.x-documentation/cortex-xdr-xql.md) - [Get started with XQL](https://cortex-docs.paloaltonetworks.com/cortex-xdr-3.x/cortex-xdr-3.x-documentation/cortex-xdr-xql/get-started-with-xql.md): XQL is the Palo Alto Networks Cortex Query Language used in Cortex XDR. - [XQL language features](https://cortex-docs.paloaltonetworks.com/cortex-xdr-3.x/cortex-xdr-3.x-documentation/cortex-xdr-xql/get-started-with-xql/xql-language-features.md): Learn more about the Cortex Query Language features to query for raw network and endpoint data. - [XQL Language Structure](https://cortex-docs.paloaltonetworks.com/cortex-xdr-3.x/cortex-xdr-3.x-documentation/cortex-xdr-xql/get-started-with-xql/xql-language-structure.md): Learn more about the Cortex Query Language structure when creating a query. - [Adding comments in queries](https://cortex-docs.paloaltonetworks.com/cortex-xdr-3.x/cortex-xdr-3.x-documentation/cortex-xdr-xql/get-started-with-xql/xql-language-structure/adding-comments-in-queries.md): Learn more about adding comments in Cortex Query Language queries. - [Supported operators](https://cortex-docs.paloaltonetworks.com/cortex-xdr-3.x/cortex-xdr-3.x-documentation/cortex-xdr-xql/get-started-with-xql/supported-operators.md): Cortex Query Language supports specific comparison, boolean, and set operators in Cortex XDR. - [Datasets and presets](https://cortex-docs.paloaltonetworks.com/cortex-xdr-3.x/cortex-xdr-3.x-documentation/cortex-xdr-xql/get-started-with-xql/datasets-and-presets.md): The Cortex Query Language supports built-in datasets, custom datasets, and presets. - [About examples](https://cortex-docs.paloaltonetworks.com/cortex-xdr-3.x/cortex-xdr-3.x-documentation/cortex-xdr-xql/get-started-with-xql/about-examples.md): Learn more about the Cortex Query Language (XQL) examples provided. - [JSON functions](https://cortex-docs.paloaltonetworks.com/cortex-xdr-3.x/cortex-xdr-3.x-documentation/cortex-xdr-xql/get-started-with-xql/json-functions.md): Learn more about how Cortex XDR treats JSON functions in the Cortex Query Language. - [How to filter for empty values in the results table](https://cortex-docs.paloaltonetworks.com/cortex-xdr-3.x/cortex-xdr-3.x-documentation/cortex-xdr-xql/get-started-with-xql/how-to-filter-for-empty-values-in-the-results-table.md): Learn how to filter for empty values in the results table in Cortex Query Language. - [Understanding string manipulation in XQL](https://cortex-docs.paloaltonetworks.com/cortex-xdr-3.x/cortex-xdr-3.x-documentation/cortex-xdr-xql/get-started-with-xql/understanding-string-manipulation-in-xql.md): Learn more about string manipulation in Cortex Query Language (XQL) using double and triple quotes. - [Build XQL queries](https://cortex-docs.paloaltonetworks.com/cortex-xdr-3.x/cortex-xdr-3.x-documentation/cortex-xdr-xql/build-xql-queries.md): Learn more about how to build Cortex Query Language (XQL) queries using the Query Builder. - [About the Query Builder](https://cortex-docs.paloaltonetworks.com/cortex-xdr-3.x/cortex-xdr-3.x-documentation/cortex-xdr-xql/build-xql-queries/about-the-query-builder.md): The Query Builder facilitates threat detection, incident expansion, and data analytics for suspected threats. - [How to build XQL queries](https://cortex-docs.paloaltonetworks.com/cortex-xdr-3.x/cortex-xdr-3.x-documentation/cortex-xdr-xql/build-xql-queries/how-to-build-xql-queries.md): Learn more about how to build XQL queries in the Query Builder. - [Get started with XQL queries](https://cortex-docs.paloaltonetworks.com/cortex-xdr-3.x/cortex-xdr-3.x-documentation/cortex-xdr-xql/build-xql-queries/how-to-build-xql-queries/get-started-with-xql-queries.md): Learn more about some important information before getting started with XQL queries. - [Useful XQL user interface features](https://cortex-docs.paloaltonetworks.com/cortex-xdr-3.x/cortex-xdr-3.x-documentation/cortex-xdr-xql/build-xql-queries/how-to-build-xql-queries/useful-xql-user-interface-features.md): Learn about useful XQL query features in the user interface. - [XQL Query best practices](https://cortex-docs.paloaltonetworks.com/cortex-xdr-3.x/cortex-xdr-3.x-documentation/cortex-xdr-xql/build-xql-queries/how-to-build-xql-queries/xql-query-best-practices.md): Learn about best practices for streamlining XQL queries. - [Expected results when querying fields](https://cortex-docs.paloaltonetworks.com/cortex-xdr-3.x/cortex-xdr-3.x-documentation/cortex-xdr-xql/build-xql-queries/how-to-build-xql-queries/expected-results-when-querying-fields.md): Learn what to expect in the query results when querying fields. - [Create XQL query](https://cortex-docs.paloaltonetworks.com/cortex-xdr-3.x/cortex-xdr-3.x-documentation/cortex-xdr-xql/build-xql-queries/how-to-build-xql-queries/create-xql-query.md): Learn how to create queries using the Cortex Query Language (XQL). - [Review XQL query results](https://cortex-docs.paloaltonetworks.com/cortex-xdr-3.x/cortex-xdr-3.x-documentation/cortex-xdr-xql/build-xql-queries/how-to-build-xql-queries/review-xql-query-results.md): Learn more about reviewing the results returned from an XQL query. - [Translate to XQL](https://cortex-docs.paloaltonetworks.com/cortex-xdr-3.x/cortex-xdr-3.x-documentation/cortex-xdr-xql/build-xql-queries/how-to-build-xql-queries/translate-to-xql.md): Learn how to translate your Splunk queries to XQL queries in Cortex XDR. - [Graph query results](https://cortex-docs.paloaltonetworks.com/cortex-xdr-3.x/cortex-xdr-3.x-documentation/cortex-xdr-xql/build-xql-queries/how-to-build-xql-queries/graph-query-results.md): Cortex XDR enables you to generate helpful visualizations of your XQL query results. - [XQL query entities](https://cortex-docs.paloaltonetworks.com/cortex-xdr-3.x/cortex-xdr-3.x-documentation/cortex-xdr-xql/build-xql-queries/xql-query-entities.md): Learn more about the Cortex Query Language (XQL) entities available in the Query Builder. - [Create authentication query](https://cortex-docs.paloaltonetworks.com/cortex-xdr-3.x/cortex-xdr-3.x-documentation/cortex-xdr-xql/build-xql-queries/xql-query-entities/create-authentication-query.md): Learn more about creating a query to investigate any authentication activity. - [Create event log query](https://cortex-docs.paloaltonetworks.com/cortex-xdr-3.x/cortex-xdr-3.x-documentation/cortex-xdr-xql/build-xql-queries/xql-query-entities/create-event-log-query.md): Learn more about creating a query to investigate Windows and Linux event log attributes and investigate event logs across endpoints. - [Create file query](https://cortex-docs.paloaltonetworks.com/cortex-xdr-3.x/cortex-xdr-3.x-documentation/cortex-xdr-xql/build-xql-queries/xql-query-entities/create-file-query.md): Learn more about creating a query to investigate the connections between file activity and endpoints. - [Create image load query](https://cortex-docs.paloaltonetworks.com/cortex-xdr-3.x/cortex-xdr-3.x-documentation/cortex-xdr-xql/build-xql-queries/xql-query-entities/create-image-load-query.md): Learn more about create a query to investigate the connections between image load activity, acting processes, and endpoints. - [Create network connections query](https://cortex-docs.paloaltonetworks.com/cortex-xdr-3.x/cortex-xdr-3.x-documentation/cortex-xdr-xql/build-xql-queries/xql-query-entities/create-network-connections-query.md): Learn more about creating a query to investigate the connections between firewall logs, endpoints, and network activity. - [Create network query](https://cortex-docs.paloaltonetworks.com/cortex-xdr-3.x/cortex-xdr-3.x-documentation/cortex-xdr-xql/build-xql-queries/xql-query-entities/create-network-query.md): Learn more about creating a query to investigate the connections between network activity, acting processes, and endpoints. - [Create process query](https://cortex-docs.paloaltonetworks.com/cortex-xdr-3.x/cortex-xdr-3.x-documentation/cortex-xdr-xql/build-xql-queries/xql-query-entities/create-process-query.md): Learn more about creating a query to investigate connections between processes, child processes, and endpoints. - [Create registry query](https://cortex-docs.paloaltonetworks.com/cortex-xdr-3.x/cortex-xdr-3.x-documentation/cortex-xdr-xql/build-xql-queries/xql-query-entities/create-registry-query.md): Learn more about creating a query to investigate connections between registry activity, processes, and endpoints. - [Query across all entities](https://cortex-docs.paloaltonetworks.com/cortex-xdr-3.x/cortex-xdr-3.x-documentation/cortex-xdr-xql/build-xql-queries/xql-query-entities/query-across-all-entities.md): From the Cortex XDR management console, you can search for endpoints and processes across all endpoint activity. - [Overview of the Query Center](https://cortex-docs.paloaltonetworks.com/cortex-xdr-3.x/cortex-xdr-3.x-documentation/cortex-xdr-xql/build-xql-queries/overview-of-the-query-center.md): View information about the In Progress and Completed queries that that were run on the tenant. - [Edit and rerun queries in Query Center](https://cortex-docs.paloaltonetworks.com/cortex-xdr-3.x/cortex-xdr-3.x-documentation/cortex-xdr-xql/build-xql-queries/overview-of-the-query-center/edit-and-rerun-queries-in-query-center.md): Learn more about viewing the results of a query, modifying a query, and rerunning queries from Query Center. - [Query Center reference information](https://cortex-docs.paloaltonetworks.com/cortex-xdr-3.x/cortex-xdr-3.x-documentation/cortex-xdr-xql/build-xql-queries/overview-of-the-query-center/edit-and-rerun-queries-in-query-center/query-center-reference-information.md): Descriptions of the fields in the Query Center table. - [Manage scheduled queries](https://cortex-docs.paloaltonetworks.com/cortex-xdr-3.x/cortex-xdr-3.x-documentation/cortex-xdr-xql/build-xql-queries/manage-scheduled-queries.md): Learn how to manage your scheduled and recurring queries. - [Scheduled Queries reference information](https://cortex-docs.paloaltonetworks.com/cortex-xdr-3.x/cortex-xdr-3.x-documentation/cortex-xdr-xql/build-xql-queries/manage-scheduled-queries/scheduled-queries-reference-information.md): Descriptions of the fields in the Scheduled Queries table. - [Manage your personal query library](https://cortex-docs.paloaltonetworks.com/cortex-xdr-3.x/cortex-xdr-3.x-documentation/cortex-xdr-xql/build-xql-queries/manage-your-personal-query-library.md): Cortex XDR provides as part of the Query Library a personal library for saving and managing your own queries. - [Stages](https://cortex-docs.paloaltonetworks.com/cortex-xdr-3.x/cortex-xdr-3.x-documentation/cortex-xdr-xql/stages.md): Learn more about the Cortex Query Language supported stages. - [alter](https://cortex-docs.paloaltonetworks.com/cortex-xdr-3.x/cortex-xdr-3.x-documentation/cortex-xdr-xql/stages/alter.md): Learn more about the Cortex Query Language alter stage. - [arrayexpand](https://cortex-docs.paloaltonetworks.com/cortex-xdr-3.x/cortex-xdr-3.x-documentation/cortex-xdr-xql/stages/arrayexpand.md): Learn more about the Cortex Query Language arrayexpand stage. - [bin](https://cortex-docs.paloaltonetworks.com/cortex-xdr-3.x/cortex-xdr-3.x-documentation/cortex-xdr-xql/stages/bin.md): Learn more about the Cortex Query Language bin stage to group events by quantity or time span. - [call](https://cortex-docs.paloaltonetworks.com/cortex-xdr-3.x/cortex-xdr-3.x-documentation/cortex-xdr-xql/stages/call.md): Learn more about the Cortex Query Language call stage to reference a predefined query from the Query Library. - [comp](https://cortex-docs.paloaltonetworks.com/cortex-xdr-3.x/cortex-xdr-3.x-documentation/cortex-xdr-xql/stages/comp.md): Learn more about the Cortex Query Language comp stage that precedes functions calculating statistics. - [config](https://cortex-docs.paloaltonetworks.com/cortex-xdr-3.x/cortex-xdr-3.x-documentation/cortex-xdr-xql/stages/config.md): Learn more about the Cortex Query Language config stage that configures the query behavior. - [case\_sensitive](https://cortex-docs.paloaltonetworks.com/cortex-xdr-3.x/cortex-xdr-3.x-documentation/cortex-xdr-xql/stages/config/case_sensitive.md): Learn more about the Cortex Query Language case\_sensitive config stage. - [timeframe](https://cortex-docs.paloaltonetworks.com/cortex-xdr-3.x/cortex-xdr-3.x-documentation/cortex-xdr-xql/stages/config/timeframe.md): Cortex Query Language timeframe configuration enables performing searches within a specific time frame from the query execution. - [max\_runtime\_minutes](https://cortex-docs.paloaltonetworks.com/cortex-xdr-3.x/cortex-xdr-3.x-documentation/cortex-xdr-xql/stages/config/max_runtime_minutes.md): Learn more about the Cortex Query Language max\_runtime\_minutes config stage. - [dedup](https://cortex-docs.paloaltonetworks.com/cortex-xdr-3.x/cortex-xdr-3.x-documentation/cortex-xdr-xql/stages/dedup.md): Learn more about the Cortex Query Language dedup stage that removes duplicate occurrences of field values. - [fields](https://cortex-docs.paloaltonetworks.com/cortex-xdr-3.x/cortex-xdr-3.x-documentation/cortex-xdr-xql/stages/fields.md): Learn more about the Cortex Query Language fields stage that defines the fields returned in the result set. - [filter](https://cortex-docs.paloaltonetworks.com/cortex-xdr-3.x/cortex-xdr-3.x-documentation/cortex-xdr-xql/stages/filter.md): Learn more about the Cortex Query Language filter stage that narrows down the displayed results. - [getrole](https://cortex-docs.paloaltonetworks.com/cortex-xdr-3.x/cortex-xdr-3.x-documentation/cortex-xdr-xql/stages/getrole.md): Learn more about the Cortex Query Language getrole stage that enriches events with specific roles associated with usernames or endpoints. - [iploc](https://cortex-docs.paloaltonetworks.com/cortex-xdr-3.x/cortex-xdr-3.x-documentation/cortex-xdr-xql/stages/iploc.md): Learn more about the Cortex Query Language iploc stage that associates IPv4 addresses of fields to a list of predefined attributes related to the geolocation. - [join](https://cortex-docs.paloaltonetworks.com/cortex-xdr-3.x/cortex-xdr-3.x-documentation/cortex-xdr-xql/stages/join.md): Learn more about the Cortex Query Language join stage that combines the results of two queries into a single result set. - [limit](https://cortex-docs.paloaltonetworks.com/cortex-xdr-3.x/cortex-xdr-3.x-documentation/cortex-xdr-xql/stages/limit.md): Learn more about the Cortex Query Language limit stage that sets the maximum number of records that can be returned in the result set. - [replacenull](https://cortex-docs.paloaltonetworks.com/cortex-xdr-3.x/cortex-xdr-3.x-documentation/cortex-xdr-xql/stages/replacenull.md): Learn more about the Cortex Query Language replacenull stage that replaces null field values with a text string. - [sort](https://cortex-docs.paloaltonetworks.com/cortex-xdr-3.x/cortex-xdr-3.x-documentation/cortex-xdr-xql/stages/sort.md): Learn more about the Cortex Query Language sort stage that identifies the sort order for records returned in the result set. - [Tag](https://cortex-docs.paloaltonetworks.com/cortex-xdr-3.x/cortex-xdr-3.x-documentation/cortex-xdr-xql/stages/tag.md): Learn more about the Cortex Query Language tag stage that adds a single tag or list of tags to the \\\_tag system field. - [target](https://cortex-docs.paloaltonetworks.com/cortex-xdr-3.x/cortex-xdr-3.x-documentation/cortex-xdr-xql/stages/target.md): Learn more about the Cortex Query Language target stage that saves query results to a dataset or lookup dataset. - [top](https://cortex-docs.paloaltonetworks.com/cortex-xdr-3.x/cortex-xdr-3.x-documentation/cortex-xdr-xql/stages/top.md): Learn more about the Cortex Query Language top stage that returns the approximate count of top elements for a field and percentage of the count results. - [transaction](https://cortex-docs.paloaltonetworks.com/cortex-xdr-3.x/cortex-xdr-3.x-documentation/cortex-xdr-xql/stages/transaction.md): Learn more about the Cortex Query Language transaction stage used to find transactions based on events that meet certain constraints. - [union](https://cortex-docs.paloaltonetworks.com/cortex-xdr-3.x/cortex-xdr-3.x-documentation/cortex-xdr-xql/stages/union.md): Learn more about the Cortex Query Language union stage that combines two result sets into a single result set. - [view](https://cortex-docs.paloaltonetworks.com/cortex-xdr-3.x/cortex-xdr-3.x-documentation/cortex-xdr-xql/stages/view.md): Learn more about the Cortex Query Language view stage that configures the display of the result set. - [windowcomp](https://cortex-docs.paloaltonetworks.com/cortex-xdr-3.x/cortex-xdr-3.x-documentation/cortex-xdr-xql/stages/windowcomp.md): Learn more about the Cortex Query Language windowcomp stage that precedes functions calculating statistics. - [Functions](https://cortex-docs.paloaltonetworks.com/cortex-xdr-3.x/cortex-xdr-3.x-documentation/cortex-xdr-xql/functions.md): Learn more the functions that can be used with Cortex Query Language (XQL) stages in Cortex XDR. - [add](https://cortex-docs.paloaltonetworks.com/cortex-xdr-3.x/cortex-xdr-3.x-documentation/cortex-xdr-xql/functions/add.md): Learn more about the Cortex Query Language add() function that adds two integers. - [approx\_count](https://cortex-docs.paloaltonetworks.com/cortex-xdr-3.x/cortex-xdr-3.x-documentation/cortex-xdr-xql/functions/approx_count.md): Learn more about the Cortex Query Language approx\_count approximate aggregate comp function. - [approx\_quantiles](https://cortex-docs.paloaltonetworks.com/cortex-xdr-3.x/cortex-xdr-3.x-documentation/cortex-xdr-xql/functions/approx_quantiles.md): Learn more about the Cortex Query Language approx\_quantiles approximate aggregate comp function. - [approx\_top](https://cortex-docs.paloaltonetworks.com/cortex-xdr-3.x/cortex-xdr-3.x-documentation/cortex-xdr-xql/functions/approx_top.md): Learn more about the Cortex Query Language approx\_top approximate aggregate comp function. - [array\_all](https://cortex-docs.paloaltonetworks.com/cortex-xdr-3.x/cortex-xdr-3.x-documentation/cortex-xdr-xql/functions/array_all.md): Learn more about the Cortex Query Language array\_all() function. - [array\_any](https://cortex-docs.paloaltonetworks.com/cortex-xdr-3.x/cortex-xdr-3.x-documentation/cortex-xdr-xql/functions/array_any.md): Learn more about the Cortex Query Language array\_any() function. - [arrayconcat](https://cortex-docs.paloaltonetworks.com/cortex-xdr-3.x/cortex-xdr-3.x-documentation/cortex-xdr-xql/functions/arrayconcat.md): Learn more about the Cortex Query Language arrayconcat() function that returns an array containing unique values found in the original array. - [arraycreate](https://cortex-docs.paloaltonetworks.com/cortex-xdr-3.x/cortex-xdr-3.x-documentation/cortex-xdr-xql/functions/arraycreate.md): Learn more about the Cortex Query Language arraycreate() function that returns an array based on the given parameters defined for the array elements. - [arraydistinct](https://cortex-docs.paloaltonetworks.com/cortex-xdr-3.x/cortex-xdr-3.x-documentation/cortex-xdr-xql/functions/arraydistinct.md): Learn more about the Cortex Query Language arraydistinct() function that returns an array containing unique values found in the original array. - [arrayfilter](https://cortex-docs.paloaltonetworks.com/cortex-xdr-3.x/cortex-xdr-3.x-documentation/cortex-xdr-xql/functions/arrayfilter.md): Learn more about the Cortex Query Language arrayfilter() function. - [arrayindex](https://cortex-docs.paloaltonetworks.com/cortex-xdr-3.x/cortex-xdr-3.x-documentation/cortex-xdr-xql/functions/arrayindex.md): Learn more about the Cortex Query Language arrayindex() function that returns the array element contained at the specified index. - [arrayindexof](https://cortex-docs.paloaltonetworks.com/cortex-xdr-3.x/cortex-xdr-3.x-documentation/cortex-xdr-xql/functions/arrayindexof.md): Learn more about the Cortex Query Language arrayindexof() function that returns the index value of an array. - [array\_length](https://cortex-docs.paloaltonetworks.com/cortex-xdr-3.x/cortex-xdr-3.x-documentation/cortex-xdr-xql/functions/array_length.md): Learn more about the Cortex Query Language array\_length() function that returns the length of an array. - [arraymap](https://cortex-docs.paloaltonetworks.com/cortex-xdr-3.x/cortex-xdr-3.x-documentation/cortex-xdr-xql/functions/arraymap.md): Learn more about the Cortex Query Language arraymap() function that applies a callable function to every element of an array. - [arraymerge](https://cortex-docs.paloaltonetworks.com/cortex-xdr-3.x/cortex-xdr-3.x-documentation/cortex-xdr-xql/functions/arraymerge.md): Learn more about the Cortex Query Language arraymerge() function that returns an array created from a merge of the inner json-string arrays. - [arrayrange](https://cortex-docs.paloaltonetworks.com/cortex-xdr-3.x/cortex-xdr-3.x-documentation/cortex-xdr-xql/functions/arrayrange.md): Learn more about the Cortex Query Language arrayrange() function that returns a portion of an array based on specified array indices. - [arraystring](https://cortex-docs.paloaltonetworks.com/cortex-xdr-3.x/cortex-xdr-3.x-documentation/cortex-xdr-xql/functions/arraystring.md): Learn more about the Cortex Query Language arraystring() function that returns a string from an array, where each array element is joined by a defined delimiter. - [avg](https://cortex-docs.paloaltonetworks.com/cortex-xdr-3.x/cortex-xdr-3.x-documentation/cortex-xdr-xql/functions/avg.md): Learn more about the Cortex Query Language avg used with both comp and windowcomp stages. - [coalesce](https://cortex-docs.paloaltonetworks.com/cortex-xdr-3.x/cortex-xdr-3.x-documentation/cortex-xdr-xql/functions/coalesce.md): Learn more about the Cortex Query Language coalesce() function that returns the first value that is not null from a defined list of fields. - [concat](https://cortex-docs.paloaltonetworks.com/cortex-xdr-3.x/cortex-xdr-3.x-documentation/cortex-xdr-xql/functions/concat.md): Learn more about the Cortex Query Language concat() function joins multiple strings into a single string. - [convert\_from\_base\_64](https://cortex-docs.paloaltonetworks.com/cortex-xdr-3.x/cortex-xdr-3.x-documentation/cortex-xdr-xql/functions/convert_from_base_64.md): Learn more about the Cortex Query Language convert\_from\_base\_64 function. - [count](https://cortex-docs.paloaltonetworks.com/cortex-xdr-3.x/cortex-xdr-3.x-documentation/cortex-xdr-xql/functions/count.md): Learn more about the Cortex Query Language count function used with both comp and windowcomp stages. - [count\_distinct](https://cortex-docs.paloaltonetworks.com/cortex-xdr-3.x/cortex-xdr-3.x-documentation/cortex-xdr-xql/functions/count_distinct.md): Learn more about the Cortex Query Language count\_distinct aggregate comp function that counts the number of unique values found for a field in the result set. - [current\_time](https://cortex-docs.paloaltonetworks.com/cortex-xdr-3.x/cortex-xdr-3.x-documentation/cortex-xdr-xql/functions/current_time.md): Learn more about the Cortex Query Language current\_time() function that returns the current time as a timestamp. - [date\_floor](https://cortex-docs.paloaltonetworks.com/cortex-xdr-3.x/cortex-xdr-3.x-documentation/cortex-xdr-xql/functions/date_floor.md): Learn more about the Cortex Query Language date\_floor() function. - [divide](https://cortex-docs.paloaltonetworks.com/cortex-xdr-3.x/cortex-xdr-3.x-documentation/cortex-xdr-xql/functions/divide.md): Learn more about the Cortex Query Language divide() function that divides two integers. - [earliest](https://cortex-docs.paloaltonetworks.com/cortex-xdr-3.x/cortex-xdr-3.x-documentation/cortex-xdr-xql/functions/earliest.md): Learn more about the Cortex Query Language earliest aggregate comp function that returns the earliest field value found with the matching criteria. - [extract\_time](https://cortex-docs.paloaltonetworks.com/cortex-xdr-3.x/cortex-xdr-3.x-documentation/cortex-xdr-xql/functions/extract_time.md): Learn more about the Cortex Query Language extract\_time() function that returns a specified portion of a timestamp. - [extract\_url\_host](https://cortex-docs.paloaltonetworks.com/cortex-xdr-3.x/cortex-xdr-3.x-documentation/cortex-xdr-xql/functions/extract_url_host.md): Learn more about the Cortex Query Language extract\_url\_host() function. - [extract\_url\_pub\_suffix](https://cortex-docs.paloaltonetworks.com/cortex-xdr-3.x/cortex-xdr-3.x-documentation/cortex-xdr-xql/functions/extract_url_pub_suffix.md): Learn more about the Cortex Query Language extract\_url\_pub\_suffix() function. - [extract\_url\_registered\_domain](https://cortex-docs.paloaltonetworks.com/cortex-xdr-3.x/cortex-xdr-3.x-documentation/cortex-xdr-xql/functions/extract_url_registered_domain.md): Learn more about the Cortex Query Language extract\_url\_registered\_domain() function. - [first](https://cortex-docs.paloaltonetworks.com/cortex-xdr-3.x/cortex-xdr-3.x-documentation/cortex-xdr-xql/functions/first.md): Learn more about the Cortex Query Language first aggregate comp function that returns the first field value found in the dataset with the matching criteria. - [first\_value](https://cortex-docs.paloaltonetworks.com/cortex-xdr-3.x/cortex-xdr-3.x-documentation/cortex-xdr-xql/functions/first_value.md): Learn more about the Cortex Query Language first\_value() navigation function that is used with a windowcomp stage. - [floor](https://cortex-docs.paloaltonetworks.com/cortex-xdr-3.x/cortex-xdr-3.x-documentation/cortex-xdr-xql/functions/floor.md): Learn more about the Cortex Query Language floor() function that rounds a field that contains a number down to the nearest whole integer. - [format\_string](https://cortex-docs.paloaltonetworks.com/cortex-xdr-3.x/cortex-xdr-3.x-documentation/cortex-xdr-xql/functions/format_string.md): Learn more about the Cortex Query Language format\_string() function. - [format\_timestamp](https://cortex-docs.paloaltonetworks.com/cortex-xdr-3.x/cortex-xdr-3.x-documentation/cortex-xdr-xql/functions/format_timestamp.md): Learn more about the Cortex Query Language format\_timestamp() function that returns a string after formatting a timestamp according to a specified string format. - [if](https://cortex-docs.paloaltonetworks.com/cortex-xdr-3.x/cortex-xdr-3.x-documentation/cortex-xdr-xql/functions/if.md): Learn more about the Cortex Query Language if() function that returns a result after evaluating a condition. - [incidr](https://cortex-docs.paloaltonetworks.com/cortex-xdr-3.x/cortex-xdr-3.x-documentation/cortex-xdr-xql/functions/incidr.md): Learn more about the Cortex Query Language incidr() function. - [incidr6](https://cortex-docs.paloaltonetworks.com/cortex-xdr-3.x/cortex-xdr-3.x-documentation/cortex-xdr-xql/functions/incidr6.md): Learn more about the Cortex Query Language incidr6() function. - [incidrlist](https://cortex-docs.paloaltonetworks.com/cortex-xdr-3.x/cortex-xdr-3.x-documentation/cortex-xdr-xql/functions/incidrlist.md): Learn more about the Cortex Query Language incidrlist() function. - [int\_to\_ip](https://cortex-docs.paloaltonetworks.com/cortex-xdr-3.x/cortex-xdr-3.x-documentation/cortex-xdr-xql/functions/int_to_ip.md): Learn more about the Cortex Query Language int\_to\_ip() function that safely converts a signed integer representation of an IPv4 address to a string equivalent. - [ip\_to\_int](https://cortex-docs.paloaltonetworks.com/cortex-xdr-3.x/cortex-xdr-3.x-documentation/cortex-xdr-xql/functions/ip_to_int.md): Learn more about the Cortex Query Language ip\_to\_int() function that safely converts a string representation of an IPv4 address to an integer equivalent. - [is\_ipv4](https://cortex-docs.paloaltonetworks.com/cortex-xdr-3.x/cortex-xdr-3.x-documentation/cortex-xdr-xql/functions/is_ipv4.md): Learn more about the Cortex Query Language is\_ipv4() function. - [is\_known\_private\_ipv4](https://cortex-docs.paloaltonetworks.com/cortex-xdr-3.x/cortex-xdr-3.x-documentation/cortex-xdr-xql/functions/is_known_private_ipv4.md): Learn more about the Cortex Query Language is\_known\_private\_ipv4() function. - [is\_ipv6](https://cortex-docs.paloaltonetworks.com/cortex-xdr-3.x/cortex-xdr-3.x-documentation/cortex-xdr-xql/functions/is_ipv6.md): Learn more about the Cortex Query Language is\_ipv6() function. - [is\_known\_private\_ipv6](https://cortex-docs.paloaltonetworks.com/cortex-xdr-3.x/cortex-xdr-3.x-documentation/cortex-xdr-xql/functions/is_known_private_ipv6.md): Learn more about the Cortex Query Language is\_known\_private\_ipv6() function. - [json\_extract](https://cortex-docs.paloaltonetworks.com/cortex-xdr-3.x/cortex-xdr-3.x-documentation/cortex-xdr-xql/functions/json_extract.md): Learn more about the Cortex Query Language json\_extract() function that accepts a string representing a JSON object, and returns a field value from that object. - [json\_extract\_array](https://cortex-docs.paloaltonetworks.com/cortex-xdr-3.x/cortex-xdr-3.x-documentation/cortex-xdr-xql/functions/json_extract_array.md): Learn more about the Cortex Query Language json\_extract\_array() function that accepts a string representing a JSON array, and returns an XQL-native array. - [json\_extract\_scalar](https://cortex-docs.paloaltonetworks.com/cortex-xdr-3.x/cortex-xdr-3.x-documentation/cortex-xdr-xql/functions/json_extract_scalar.md): Learn more about the Cortex Query Language json\_extract\_scalar() function. - [json\_extract\_scalar\_array](https://cortex-docs.paloaltonetworks.com/cortex-xdr-3.x/cortex-xdr-3.x-documentation/cortex-xdr-xql/functions/json_extract_scalar_array.md): Learn more about the Cortex Query Language json\_extract\_scalar\_array() function. - [lag](https://cortex-docs.paloaltonetworks.com/cortex-xdr-3.x/cortex-xdr-3.x-documentation/cortex-xdr-xql/functions/lag.md): Learn more about the Cortex Query Language lag() navigation function that is used with a windowcomp stage. - [last](https://cortex-docs.paloaltonetworks.com/cortex-xdr-3.x/cortex-xdr-3.x-documentation/cortex-xdr-xql/functions/last.md): Learn more about the Cortex Query Language last aggregate comp function that returns the last field value found in the dataset with the matching criteria. - [last\_value](https://cortex-docs.paloaltonetworks.com/cortex-xdr-3.x/cortex-xdr-3.x-documentation/cortex-xdr-xql/functions/last_value.md): Learn more about the Cortex Query Language last\_value() navigation function that is used with a windowcomp stage. - [latest](https://cortex-docs.paloaltonetworks.com/cortex-xdr-3.x/cortex-xdr-3.x-documentation/cortex-xdr-xql/functions/latest.md): Learn more about the Cortex Query Language latest aggregate comp function that returns the latest field value found with the matching criteria. - [len](https://cortex-docs.paloaltonetworks.com/cortex-xdr-3.x/cortex-xdr-3.x-documentation/cortex-xdr-xql/functions/len.md): Learn more about the Cortex Query Language len function that returns the number of characters contained in a string. - [list](https://cortex-docs.paloaltonetworks.com/cortex-xdr-3.x/cortex-xdr-3.x-documentation/cortex-xdr-xql/functions/list.md): Learn more about the Cortex Query Language list aggregate comp function that returns an array for up to 100 values for a field in the result set. - [lowercase](https://cortex-docs.paloaltonetworks.com/cortex-xdr-3.x/cortex-xdr-3.x-documentation/cortex-xdr-xql/functions/lowercase.md): Learn more about the Cortex Query Language lowercase() function that converts a string field to all lowercase letters. - [ltrim, rtrim, trim](https://cortex-docs.paloaltonetworks.com/cortex-xdr-3.x/cortex-xdr-3.x-documentation/cortex-xdr-xql/functions/ltrim-rtrim-trim.md): Learn more about the Cortex Query Language ltrim(), rtrim(), and trim() functions that remove trim\_characters from a string. - [max](https://cortex-docs.paloaltonetworks.com/cortex-xdr-3.x/cortex-xdr-3.x-documentation/cortex-xdr-xql/functions/max.md): Learn more about the Cortex Query Language max function used with both comp and windowcomp stages. - [median](https://cortex-docs.paloaltonetworks.com/cortex-xdr-3.x/cortex-xdr-3.x-documentation/cortex-xdr-xql/functions/median.md): Learn more about the Cortex Query Language median function used with both comp and windowcomp stages. - [min](https://cortex-docs.paloaltonetworks.com/cortex-xdr-3.x/cortex-xdr-3.x-documentation/cortex-xdr-xql/functions/min.md): Learn more about the Cortex Query Language min function used with both comp and windowcomp stages. - [multiply](https://cortex-docs.paloaltonetworks.com/cortex-xdr-3.x/cortex-xdr-3.x-documentation/cortex-xdr-xql/functions/multiply.md): Learn more about the Cortex Query Language multiply() function that multiplies two integers. - [object\_merge](https://cortex-docs.paloaltonetworks.com/cortex-xdr-3.x/cortex-xdr-3.x-documentation/cortex-xdr-xql/functions/object_merge.md): Learn more about the Cortex Query Language object\_merge() function. - [object\_create](https://cortex-docs.paloaltonetworks.com/cortex-xdr-3.x/cortex-xdr-3.x-documentation/cortex-xdr-xql/functions/object_create.md): Learn more about the Cortex Query Language object\_create() function. - [parse\_epoch](https://cortex-docs.paloaltonetworks.com/cortex-xdr-3.x/cortex-xdr-3.x-documentation/cortex-xdr-xql/functions/parse_epoch.md): Learn more about the Cortex Query Language parse\_epoch() function that returns a Unix epoch TIMESTAMP object. - [parse\_timestamp](https://cortex-docs.paloaltonetworks.com/cortex-xdr-3.x/cortex-xdr-3.x-documentation/cortex-xdr-xql/functions/parse_timestamp.md): Learn more about the Cortex Query Language parse\_timestamp() function that returns a TIMESTAMP object. - [pow](https://cortex-docs.paloaltonetworks.com/cortex-xdr-3.x/cortex-xdr-3.x-documentation/cortex-xdr-xql/functions/pow.md): Learn more about the Cortex Query Language pow() function that returns the value of a number raised to the power of another number. - [rank](https://cortex-docs.paloaltonetworks.com/cortex-xdr-3.x/cortex-xdr-3.x-documentation/cortex-xdr-xql/functions/rank.md): Learn more about the Cortex Query Language rank() numbering function that is used with a windowcomp stage. - [regexcapture](https://cortex-docs.paloaltonetworks.com/cortex-xdr-3.x/cortex-xdr-3.x-documentation/cortex-xdr-xql/functions/regexcapture.md): Learn more about the Cortex Query Language regexcapture() function used in Parsing Rules to extract data from fields using regular expression named groups from a given string. - [regextract](https://cortex-docs.paloaltonetworks.com/cortex-xdr-3.x/cortex-xdr-3.x-documentation/cortex-xdr-xql/functions/regextract.md): Learn more about the Cortex Query Language regextract() function that uses regular expressions to assemble an array of matching substrings from a string. - [replace](https://cortex-docs.paloaltonetworks.com/cortex-xdr-3.x/cortex-xdr-3.x-documentation/cortex-xdr-xql/functions/replace.md): Learn more about the Cortex Query Language replace() function that performs a substring replacement. - [replex](https://cortex-docs.paloaltonetworks.com/cortex-xdr-3.x/cortex-xdr-3.x-documentation/cortex-xdr-xql/functions/replex.md): Learn more about the Cortex Query Language replex() function that uses a regular expression to identify and replace substrings. - [round](https://cortex-docs.paloaltonetworks.com/cortex-xdr-3.x/cortex-xdr-3.x-documentation/cortex-xdr-xql/functions/round.md): Learn more about the Cortex Query Language round() function that returns the input value rounded to the nearest integer. - [row\_number](https://cortex-docs.paloaltonetworks.com/cortex-xdr-3.x/cortex-xdr-3.x-documentation/cortex-xdr-xql/functions/row_number.md): Learn more about the Cortex Query Language row\_number() numbering function that is used with a windowcomp stage. - [split](https://cortex-docs.paloaltonetworks.com/cortex-xdr-3.x/cortex-xdr-3.x-documentation/cortex-xdr-xql/functions/split.md): Learn more about the Cortex Query Language split() function that splits a string and returns an array of string parts. - [stddev\_population](https://cortex-docs.paloaltonetworks.com/cortex-xdr-3.x/cortex-xdr-3.x-documentation/cortex-xdr-xql/functions/stddev_population.md): Learn more about the Cortex Query Language stddev\_population() function used with both comp and windowcomp stages. - [stddev\_sample](https://cortex-docs.paloaltonetworks.com/cortex-xdr-3.x/cortex-xdr-3.x-documentation/cortex-xdr-xql/functions/stddev_sample.md): Learn more about the Cortex Query Language stddev\_sample() function used with both comp and windowcomp stages. - [string\_count](https://cortex-docs.paloaltonetworks.com/cortex-xdr-3.x/cortex-xdr-3.x-documentation/cortex-xdr-xql/functions/string_count.md): Learn more about the Cortex Query Language string\_count() function that returns the number of times a substring appears in a string. - [subtract](https://cortex-docs.paloaltonetworks.com/cortex-xdr-3.x/cortex-xdr-3.x-documentation/cortex-xdr-xql/functions/subtract.md): Learn more about the Cortex Query Language subtract() function that subtracts two integers. - [sum](https://cortex-docs.paloaltonetworks.com/cortex-xdr-3.x/cortex-xdr-3.x-documentation/cortex-xdr-xql/functions/sum.md): Cortex Query Language sum function used with both comp and windowcomp stages. - [time\_frame\_end](https://cortex-docs.paloaltonetworks.com/cortex-xdr-3.x/cortex-xdr-3.x-documentation/cortex-xdr-xql/functions/time_frame_end.md): Learn more about the Cortex Query Language time\_frame\_end() function that returns the end time of the time range specified for the query. - [timestamp\_diff](https://cortex-docs.paloaltonetworks.com/cortex-xdr-3.x/cortex-xdr-3.x-documentation/cortex-xdr-xql/functions/timestamp_diff.md): Learn more about the Cortex Query Language timestamp\_diff() function that returns the difference between two timestamp objects. - [timestamp\_seconds](https://cortex-docs.paloaltonetworks.com/cortex-xdr-3.x/cortex-xdr-3.x-documentation/cortex-xdr-xql/functions/timestamp_seconds.md): Learn more about the Cortex Query Language timestamp\_seconds() function. - [to\_boolean](https://cortex-docs.paloaltonetworks.com/cortex-xdr-3.x/cortex-xdr-3.x-documentation/cortex-xdr-xql/functions/to_boolean.md): Learn more about the Cortex Query Language to\_boolean() function that converts a string to a boolean. - [to\_epoch](https://cortex-docs.paloaltonetworks.com/cortex-xdr-3.x/cortex-xdr-3.x-documentation/cortex-xdr-xql/functions/to_epoch.md): Learn more about the Cortex Query Language to\_epoch() function that converts a timestamp value for a field or function to the Unix epoch timestamp format. - [to\_float](https://cortex-docs.paloaltonetworks.com/cortex-xdr-3.x/cortex-xdr-3.x-documentation/cortex-xdr-xql/functions/to_float.md): Learn more about the Cortex Query Language to\_float() function that converts a string to a floating point number. - [to\_integer](https://cortex-docs.paloaltonetworks.com/cortex-xdr-3.x/cortex-xdr-3.x-documentation/cortex-xdr-xql/functions/to_integer.md): Learn more about the Cortex Query Language to\_integer() function that converts a string field to an integer. - [to\_json\_string](https://cortex-docs.paloaltonetworks.com/cortex-xdr-3.x/cortex-xdr-3.x-documentation/cortex-xdr-xql/functions/to_json_string.md): Learn more about the Cortex Query Language to\_json\_string() function that accepts all data types and returns its contents as a JSON formatted string. - [to\_number](https://cortex-docs.paloaltonetworks.com/cortex-xdr-3.x/cortex-xdr-3.x-documentation/cortex-xdr-xql/functions/to_number.md): Learn more about the Cortex Query Language to\_number() function that converts a string to a number. - [to\_string](https://cortex-docs.paloaltonetworks.com/cortex-xdr-3.x/cortex-xdr-3.x-documentation/cortex-xdr-xql/functions/to_string.md): Learn more about the Cortex Query Language to\_string function that converts a number value to a string. - [to\_timestamp](https://cortex-docs.paloaltonetworks.com/cortex-xdr-3.x/cortex-xdr-3.x-documentation/cortex-xdr-xql/functions/to_timestamp.md): Learn more about the Cortex Query Language to\_timestamp() function that converts an integer to a timestamp. - [uppercase](https://cortex-docs.paloaltonetworks.com/cortex-xdr-3.x/cortex-xdr-3.x-documentation/cortex-xdr-xql/functions/uppercase.md): Learn more about the Cortex Query Language uppercase() function that converts a string field to all uppercase letters. - [values](https://cortex-docs.paloaltonetworks.com/cortex-xdr-3.x/cortex-xdr-3.x-documentation/cortex-xdr-xql/functions/values.md): Cortex Query Language comp values aggregate returns an array for all the values seen for the field in the result set. - [var](https://cortex-docs.paloaltonetworks.com/cortex-xdr-3.x/cortex-xdr-3.x-documentation/cortex-xdr-xql/functions/var.md): Learn more about the Cortex Query Language var aggregate comp function that returns the variance value of a field in the result set. - [Multi-tenant](https://cortex-docs.paloaltonetworks.com/cortex-xdr-3.x/cortex-xdr-3.x-documentation/multi-tenant.md) - [What is Cortex XDR multi-tenant?](https://cortex-docs.paloaltonetworks.com/cortex-xdr-3.x/cortex-xdr-3.x-documentation/multi-tenant/what-is-cortex-xdr-multi-tenant.md): Learn about Cortex multi-tenant deployments that provide data segregation while enabling you to manage multiple tenants from a single console. - [MSSP multi-tenant](https://cortex-docs.paloaltonetworks.com/cortex-xdr-3.x/cortex-xdr-3.x-documentation/multi-tenant/what-is-cortex-xdr-multi-tenant/mssp-multi-tenant.md): MSSP multi-tenancy allows managed security service providers to ensure strict data segregation along with the flexibility to monitor alerts across tenants and dynamically allocate licenses. - [Enterprise multi-tenant](https://cortex-docs.paloaltonetworks.com/cortex-xdr-3.x/cortex-xdr-3.x-documentation/multi-tenant/what-is-cortex-xdr-multi-tenant/enterprise-multi-tenant.md) - [Multi-tenant central licensing management](https://cortex-docs.paloaltonetworks.com/cortex-xdr-3.x/cortex-xdr-3.x-documentation/multi-tenant/multi-tenant-central-licensing-management.md) - [Onboard Cortex multi-tenant](https://cortex-docs.paloaltonetworks.com/cortex-xdr-3.x/cortex-xdr-3.x-documentation/multi-tenant/onboard-cortex-multi-tenant.md): Learn how to activate and manage tenants. - [Onboarding checklist for multi-tenant central licensing deployments](https://cortex-docs.paloaltonetworks.com/cortex-xdr-3.x/cortex-xdr-3.x-documentation/multi-tenant/onboard-cortex-multi-tenant/onboarding-checklist-for-multi-tenant-central-licensing-deployments.md): Onboard MSSP/Enterprise multi-tenant central licensing deployments. - [Step 1. Activate Cortex XDR (main account)](https://cortex-docs.paloaltonetworks.com/cortex-xdr-3.x/cortex-xdr-3.x-documentation/multi-tenant/onboard-cortex-multi-tenant/onboarding-checklist-for-multi-tenant-central-licensing-deployments/step-1.-activate-cortex-xdr-main-account.md): Learn how to activate Cortex XDR in Cortex Gateway. - [Step 2. Create a child tenant](https://cortex-docs.paloaltonetworks.com/cortex-xdr-3.x/cortex-xdr-3.x-documentation/multi-tenant/onboard-cortex-multi-tenant/onboarding-checklist-for-multi-tenant-central-licensing-deployments/step-2.-create-a-child-tenant.md): Create child tenants in the Cortex Gateway. - [Onboarding checklist for multi-tenant customer-owned license deployments](https://cortex-docs.paloaltonetworks.com/cortex-xdr-3.x/cortex-xdr-3.x-documentation/multi-tenant/onboard-cortex-multi-tenant/onboarding-checklist-for-multi-tenant-customer-owned-license-deployments.md): Onboard MSSP/Enterprise multi-tenant customer-owned license deployments. - [Step 1. Activate Cortex Cortex XDR (parent and child tenants)](https://cortex-docs.paloaltonetworks.com/cortex-xdr-3.x/cortex-xdr-3.x-documentation/multi-tenant/onboard-cortex-multi-tenant/onboarding-checklist-for-multi-tenant-customer-owned-license-deployments/step-1.-activate-cortex-cortex-xdr-parent-and-child-tenants.md): Learn how to activate Cortex XDR from Cortex Gateway. - [Step 2. Define access configurations and role permissions](https://cortex-docs.paloaltonetworks.com/cortex-xdr-3.x/cortex-xdr-3.x-documentation/multi-tenant/onboard-cortex-multi-tenant/onboarding-checklist-for-multi-tenant-customer-owned-license-deployments/step-2.-define-access-configurations-and-role-permissions.md): Define the correct access configuration and role permissions for multi-tenant customer-owned license deployment. - [Step 3. Pair a parent tenant with child tenant](https://cortex-docs.paloaltonetworks.com/cortex-xdr-3.x/cortex-xdr-3.x-documentation/multi-tenant/onboard-cortex-multi-tenant/onboarding-checklist-for-multi-tenant-customer-owned-license-deployments/step-3.-pair-a-parent-tenant-with-child-tenant.md): In multi-tenant customer-owned license deployments, you must manually pair the parent tenant with each child tenant. - [Dynamic license allocation](https://cortex-docs.paloaltonetworks.com/cortex-xdr-3.x/cortex-xdr-3.x-documentation/multi-tenant/dynamic-license-allocation.md): In a multi-tenant central licensing management environment, you can dynamically edit child tenant allocations, add child tenants, and delete child tenants with the license pool automatically updated. - [Child tenant management](https://cortex-docs.paloaltonetworks.com/cortex-xdr-3.x/cortex-xdr-3.x-documentation/multi-tenant/child-tenant-management.md): Track, manage, and investigate child tenant data from the parent tenant. - [Manage a child tenant](https://cortex-docs.paloaltonetworks.com/cortex-xdr-3.x/cortex-xdr-3.x-documentation/multi-tenant/child-tenant-management/manage-a-child-tenant.md): From the Cortex XDR management console you can view and investigate child tenant data and initiate security actions. - [Track your tenant management](https://cortex-docs.paloaltonetworks.com/cortex-xdr-3.x/cortex-xdr-3.x-documentation/multi-tenant/child-tenant-management/track-your-tenant-management.md): You can view the details of your tenants at any time. - [Investigate child tenant data](https://cortex-docs.paloaltonetworks.com/cortex-xdr-3.x/cortex-xdr-3.x-documentation/multi-tenant/child-tenant-management/investigate-child-tenant-data.md): In multi-tenant environments, you can view, track, and investigate data across your Cortex XDR child tenants. - [Create and allocate configurations](https://cortex-docs.paloaltonetworks.com/cortex-xdr-3.x/cortex-xdr-3.x-documentation/multi-tenant/child-tenant-management/create-and-allocate-configurations.md): From the Cortex XDR management console, you can create and allocate configurations for child tenants. - [Create a security managed action](https://cortex-docs.paloaltonetworks.com/cortex-xdr-3.x/cortex-xdr-3.x-documentation/multi-tenant/child-tenant-management/create-a-security-managed-action.md): Create a security type action to perform on behalf of your child tenants. - [About managed threat hunting](https://cortex-docs.paloaltonetworks.com/cortex-xdr-3.x/cortex-xdr-3.x-documentation/multi-tenant/about-managed-threat-hunting.md): Understand how Managed Threat Hunting can help your organization. - [Set up Managed Threat Hunting](https://cortex-docs.paloaltonetworks.com/cortex-xdr-3.x/cortex-xdr-3.x-documentation/multi-tenant/about-managed-threat-hunting/set-up-managed-threat-hunting.md): Get started with the Managed Threat Hunting service, an add-on security service provided with Cortex XDR. - [Investigate Managed Threat Hunting reports](https://cortex-docs.paloaltonetworks.com/cortex-xdr-3.x/cortex-xdr-3.x-documentation/multi-tenant/about-managed-threat-hunting/investigate-managed-threat-hunting-reports.md): Investigate your Managed Threat Hunting reports. - [Reference](https://cortex-docs.paloaltonetworks.com/cortex-xdr-3.x/cortex-xdr-3.x-documentation/reference.md) - [RBAC permissions](https://cortex-docs.paloaltonetworks.com/cortex-xdr-3.x/cortex-xdr-3.x-documentation/reference/rbac-permissions.md): Learn more about the RBAC permissions specifically about role permissions by component and the default Palo Alto Networks roles. - [Role permissions by components](https://cortex-docs.paloaltonetworks.com/cortex-xdr-3.x/cortex-xdr-3.x-documentation/reference/rbac-permissions/role-permissions-by-components.md): Learn how to manage role permissions in Cortex XDR. - [Default PANW roles](https://cortex-docs.paloaltonetworks.com/cortex-xdr-3.x/cortex-xdr-3.x-documentation/reference/rbac-permissions/default-panw-roles.md): Learn more about the default Palo Alto Networks user roles included in Cortex XDR. - [Account Admin](https://cortex-docs.paloaltonetworks.com/cortex-xdr-3.x/cortex-xdr-3.x-documentation/reference/rbac-permissions/default-panw-roles/account-admin.md): Learn more about the Cortex XDR predefined user role called Account Admin. - [Deployment Admin](https://cortex-docs.paloaltonetworks.com/cortex-xdr-3.x/cortex-xdr-3.x-documentation/reference/rbac-permissions/default-panw-roles/deployment-admin.md): Learn more about the Cortex XDR predefined user role called Deployment Admin. - [Instance Administrator](https://cortex-docs.paloaltonetworks.com/cortex-xdr-3.x/cortex-xdr-3.x-documentation/reference/rbac-permissions/default-panw-roles/instance-administrator.md): Learn more about the Cortex XDR predefined user role called Instance Administrator. - [Investigation Admin](https://cortex-docs.paloaltonetworks.com/cortex-xdr-3.x/cortex-xdr-3.x-documentation/reference/rbac-permissions/default-panw-roles/investigation-admin.md): Learn more about the Cortex XDR predefined user role called Investigation Admin. - [Investigator](https://cortex-docs.paloaltonetworks.com/cortex-xdr-3.x/cortex-xdr-3.x-documentation/reference/rbac-permissions/default-panw-roles/investigator.md): Learn more about the Cortex XDR predefined user role called Investigator. - [IT Admin](https://cortex-docs.paloaltonetworks.com/cortex-xdr-3.x/cortex-xdr-3.x-documentation/reference/rbac-permissions/default-panw-roles/it-admin.md): Learn more about the Cortex XDR predefined user role called IT Admin. - [Privileged Investigator](https://cortex-docs.paloaltonetworks.com/cortex-xdr-3.x/cortex-xdr-3.x-documentation/reference/rbac-permissions/default-panw-roles/privileged-investigator.md): Learn more about the Cortex XDR predefined user role called Privileged Investigator. - [Privileged IT Admin](https://cortex-docs.paloaltonetworks.com/cortex-xdr-3.x/cortex-xdr-3.x-documentation/reference/rbac-permissions/default-panw-roles/privileged-it-admin.md): Learn more about the Cortex XDR predefined user role called Privileged IT Admin. - [Privileged Responder](https://cortex-docs.paloaltonetworks.com/cortex-xdr-3.x/cortex-xdr-3.x-documentation/reference/rbac-permissions/default-panw-roles/privileged-responder.md): Learn more about the Cortex XDR predefined user role called Privileged Responder. - [Privileged Security Admin](https://cortex-docs.paloaltonetworks.com/cortex-xdr-3.x/cortex-xdr-3.x-documentation/reference/rbac-permissions/default-panw-roles/privileged-security-admin.md): Learn more about the predefined user role called Privileged Security Admin. - [Responder](https://cortex-docs.paloaltonetworks.com/cortex-xdr-3.x/cortex-xdr-3.x-documentation/reference/rbac-permissions/default-panw-roles/responder.md): Learn more about the Cortex XDR predefined user role called Responder. - [Scoped Endpoint Admin](https://cortex-docs.paloaltonetworks.com/cortex-xdr-3.x/cortex-xdr-3.x-documentation/reference/rbac-permissions/default-panw-roles/scoped-endpoint-admin.md): Learn more about the Cortex XDR predefined user role called Scoped Endpoint Admin. - [Security Admin](https://cortex-docs.paloaltonetworks.com/cortex-xdr-3.x/cortex-xdr-3.x-documentation/reference/rbac-permissions/default-panw-roles/security-admin.md): Learn more about the Cortex XDR predefined user role called Security Admin. - [Viewer](https://cortex-docs.paloaltonetworks.com/cortex-xdr-3.x/cortex-xdr-3.x-documentation/reference/rbac-permissions/default-panw-roles/viewer.md): Learn more about the Cortex XDR predefined user role called Viewer. - [Microsoft Windows security auditing setup](https://cortex-docs.paloaltonetworks.com/cortex-xdr-3.x/cortex-xdr-3.x-documentation/reference/microsoft-windows-security-auditing-setup.md) - [Enable security auditing event IDs](https://cortex-docs.paloaltonetworks.com/cortex-xdr-3.x/cortex-xdr-3.x-documentation/reference/microsoft-windows-security-auditing-setup/enable-security-auditing-event-ids.md) - [Enable security auditing event IDs with GPO](https://cortex-docs.paloaltonetworks.com/cortex-xdr-3.x/cortex-xdr-3.x-documentation/reference/microsoft-windows-security-auditing-setup/enable-security-auditing-event-ids/enable-security-auditing-event-ids-with-gpo.md) - [Set up local machine security auditing without GPO](https://cortex-docs.paloaltonetworks.com/cortex-xdr-3.x/cortex-xdr-3.x-documentation/reference/microsoft-windows-security-auditing-setup/enable-security-auditing-event-ids/set-up-local-machine-security-auditing-without-gpo.md) - [Additional setup for Active Directory Certificate Services (ADCS) events](https://cortex-docs.paloaltonetworks.com/cortex-xdr-3.x/cortex-xdr-3.x-documentation/reference/microsoft-windows-security-auditing-setup/enable-security-auditing-event-ids/additional-setup-for-active-directory-certificate-services-adcs-events.md) - [Enable auditing access to AD domain objects - 4662](https://cortex-docs.paloaltonetworks.com/cortex-xdr-3.x/cortex-xdr-3.x-documentation/reference/microsoft-windows-security-auditing-setup/enable-security-auditing-event-ids/enable-auditing-access-to-ad-domain-objects-4662.md) - [Enable additional event logs using Event Viewer](https://cortex-docs.paloaltonetworks.com/cortex-xdr-3.x/cortex-xdr-3.x-documentation/reference/microsoft-windows-security-auditing-setup/enable-additional-event-logs-using-event-viewer.md) - [Enable LDAP server events logging (1644)](https://cortex-docs.paloaltonetworks.com/cortex-xdr-3.x/cortex-xdr-3.x-documentation/reference/microsoft-windows-security-auditing-setup/enable-ldap-server-events-logging-1644.md) - [Enable LDAP server events logging using RegEdit](https://cortex-docs.paloaltonetworks.com/cortex-xdr-3.x/cortex-xdr-3.x-documentation/reference/microsoft-windows-security-auditing-setup/enable-ldap-server-events-logging-1644/enable-ldap-server-events-logging-using-regedit.md) - [Enable LDAP server events logging using GPO](https://cortex-docs.paloaltonetworks.com/cortex-xdr-3.x/cortex-xdr-3.x-documentation/reference/microsoft-windows-security-auditing-setup/enable-ldap-server-events-logging-1644/enable-ldap-server-events-logging-using-gpo.md) - [Validate log collection for LDAP Server events](https://cortex-docs.paloaltonetworks.com/cortex-xdr-3.x/cortex-xdr-3.x-documentation/reference/microsoft-windows-security-auditing-setup/enable-ldap-server-events-logging-1644/validate-log-collection-for-ldap-server-events.md) - [Cortex secure deployment practices](https://cortex-docs.paloaltonetworks.com/cortex-xdr-3.x/cortex-xdr-3.x-documentation/reference/cortex-secure-deployment-practices.md) ## Upgrade to Cortex XDR 5 - [What's New in Cortex XDR 5](https://cortex-docs.paloaltonetworks.com/upgrade-to-cortex-xdr-5/whats-new-in-cortex-xdr-5.md) - [Integrated Cloud Posture capabilities](https://cortex-docs.paloaltonetworks.com/upgrade-to-cortex-xdr-5/integrated-cloud-posture-capabilities.md) - [Improved incident management workflow with cases and issues](https://cortex-docs.paloaltonetworks.com/upgrade-to-cortex-xdr-5/improved-incident-management-workflow-with-cases-and-issues.md) - [Navigation bar and menu enhancements](https://cortex-docs.paloaltonetworks.com/upgrade-to-cortex-xdr-5/navigation-bar-and-menu-enhancements.md) - [New unified Asset Inventory and cloud data sources](https://cortex-docs.paloaltonetworks.com/upgrade-to-cortex-xdr-5/new-unified-asset-inventory-and-cloud-data-sources.md) - [Built-in automations](https://cortex-docs.paloaltonetworks.com/upgrade-to-cortex-xdr-5/built-in-automations.md) - [Scope-Based Access Control (SBAC) changes and enhancements](https://cortex-docs.paloaltonetworks.com/upgrade-to-cortex-xdr-5/scope-based-access-control-sbac-changes-and-enhancements.md) - [Additional features and enhancements](https://cortex-docs.paloaltonetworks.com/upgrade-to-cortex-xdr-5/additional-features-and-enhancements.md) - [Early upgrade with flexible scheduling](https://cortex-docs.paloaltonetworks.com/upgrade-to-cortex-xdr-5/early-upgrade-with-flexible-scheduling.md) ## Cortex CLOUD Runtime Security - [Navigate the Cortex Cloud Runtime Security docs](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/get-started/readme.md): Start here for a visual overview of the main Runtime Security documentation areas. - [What is Cortex Cloud?](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/get-started/readme-1.md): Explore Cortex Cloud, unifying application security, cloud posture, runtime security, and SOC operations. - [Key features](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/get-started/readme-1/key-features.md): Discover Cortex Cloud features for visibility, risk assessment, compliance, attack path analysis, and remediation. - [What is Cortex Cloud Runtime Security?](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/get-started/what-is-cortex-cloud-runtime-security.md): Learn about Cortex Cloud and the key integrated capabilities. - [Agentic AI in Cortex Cloud](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/get-started/agentic-ai-in-cortex-cloud.md): Use the Cortex Agentic Assistant to investigate cases, perform threat hunting, and create scripts. Embed and run LLM prompts in playbooks. View AI case summaries. - [Agentic Assistant use cases](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/get-started/agentic-ai-in-cortex-cloud/agentic-assistant-use-cases.md): Recommended prompts to automate your SOC using the Cortex Agentic Assistant - [Agentic Assistant security](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/get-started/agentic-ai-in-cortex-cloud/agentic-assistant-security.md): Learn about how the Agentic Assistant is built using responsible AI principles. - [Supported web browsers](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/get-started/supported-web-browsers.md): Review supported web browsers and minimum versions for reliable Cortex Cloud access and performance. - [Use the interface](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/get-started/use-the-interface.md): Learn to navigate Cortex Cloud’s Command Center, Asset Inventory, dashboards, and Cases for cloud security. - [In-product support ticket creation](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/get-started/in-product-support-case-creation.md): Open a support ticket directly in Cortex Cloud and record your console to capture your issues and have the ticket handled efficiently. - [Understand your user persona](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/get-started/understand-your-user-persona.md): Understand Cortex Cloud’s cloud security engineer persona, responsibilities, and workflows for prioritizing and remediating risk. - [Understand license plans](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/get-started/understand-license-plans.md): Understand Cortex Cloud license plans, protected workload metering, add-ons, usage, and capacity overflow rules. - [Data retention](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/get-started/understand-license-plans/data-retention.md): Learn more about the default retention periods for all Cortex Cloud licenses and the available retention add-ons. - [Fair Usage policy for Cortex Cloud](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/get-started/fair-usage-policy-for-cortex-cloud.md): Understand Cortex Cloud’s Fair Usage Policy for data ingestion, connected sources, and API usage. - [Learn how to onboard and configure Cortex Cloud Runtime Security](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/onboard-and-configure/onboard-and-configure-cortex-cloud.md): Learn about the deployment preparation and procedures to onboard and configure Cortex Cloud. - [Plan and prepare](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/onboard-and-configure/plan-and-prepare.md): Learn more about deployment considerations and onboarding steps. - [Prepare for deployment](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/onboard-and-configure/plan-and-prepare/prepare-for-deployment.md): Learn more about deployment considerations and onboarding steps. - [Deployment steps and checklist](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/onboard-and-configure/deployment-steps-and-checklist.md): Review the steps to onboard and configure Cortex Cloud. - [Activate Cortex Cloud](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/onboard-and-configure/deployment-steps-and-checklist/activate-cortex-cloud.md): Learn how to activate your tenant. - [Cortex Cloud supported regions](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/onboard-and-configure/deployment-steps-and-checklist/activate-cortex-cloud/cortex-cloud-supported-regions.md): Explore Cortex Cloud hosting regions and data residency locations across the Americas, EMEA, and Asia-Pacific. - [Enable access to required PANW resources](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/onboard-and-configure/deployment-steps-and-checklist/activate-cortex-cloud/enable-access-to-required-panw-resources.md): Configure firewall access to required Cortex Cloud resources, FQDNs, IP addresses, ports, and App-IDs. - [Regional egress resources](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/onboard-and-configure/deployment-steps-and-checklist/activate-cortex-cloud/enable-access-to-required-panw-resources/regional-egress-resources.md): Allow regional Cortex Cloud egress traffic for tenant communication, EDR, Live Terminal, APIs, and Broker VM. - [Engines IP addresses (outbound)](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/onboard-and-configure/deployment-steps-and-checklist/activate-cortex-cloud/enable-access-to-required-panw-resources/engines-ip-addresses-outbound.md): Find Cortex Cloud engine outbound IP addresses for allowing automation playbook and script access to internal resources. - [Inbound source resources](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/onboard-and-configure/deployment-steps-and-checklist/activate-cortex-cloud/enable-access-to-required-panw-resources/inbound-source-resources.md): Allow Cortex Cloud inbound source IP addresses for Broker VM, syslog, infrastructure communication, and data collection. - [FedRAMP and the US Federal Government required resources](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/onboard-and-configure/deployment-steps-and-checklist/activate-cortex-cloud/enable-access-to-required-panw-resources/fedramp-and-the-us-federal-government-required-resources.md): Configure required Cortex Cloud resource access for FedRAMP and US federal government environments. - [Upgrade from Prisma Cloud to Cortex Cloud](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/onboard-and-configure/deployment-steps-and-checklist/upgrade-from-prisma-cloud-to-cortex-cloud.md): Upgrade from Prisma Cloud to Cortex Cloud and migrate supported configurations, content, and integrations. - [About the Upgrade Helper](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/onboard-and-configure/deployment-steps-and-checklist/upgrade-from-prisma-cloud-to-cortex-cloud/about-the-upgrade-helper.md): Understand the Cortex Cloud Upgrade Helper and its role in migrating Prisma Cloud configurations. - [Link Cortex Cloud to Prisma Cloud](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/onboard-and-configure/deployment-steps-and-checklist/upgrade-from-prisma-cloud-to-cortex-cloud/link-cortex-cloud-to-prisma-cloud.md): Link your Cortex Cloud tenant to Prisma Cloud before migrating configurations with Upgrade Helper. - [Copy content](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/onboard-and-configure/deployment-steps-and-checklist/upgrade-from-prisma-cloud-to-cortex-cloud/copy-content.md): Copy supported Prisma Cloud content and configurations into Cortex Cloud during an Upgrade Helper migration. - [Copy Global configurations](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/onboard-and-configure/deployment-steps-and-checklist/upgrade-from-prisma-cloud-to-cortex-cloud/copy-content/copy-global-configurations.md): Copy global Prisma Cloud configurations to Cortex Cloud during migration with Upgrade Helper. - [Copy CSPM configurations](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/onboard-and-configure/deployment-steps-and-checklist/upgrade-from-prisma-cloud-to-cortex-cloud/copy-content/copy-cspm-configurations.md): Copy Prisma Cloud CSPM configurations into Cortex Cloud using Upgrade Helper. - [Copy CWP configurations](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/onboard-and-configure/deployment-steps-and-checklist/upgrade-from-prisma-cloud-to-cortex-cloud/copy-content/copy-cwp-configurations.md): Copy Prisma Cloud CWP configurations into Cortex Cloud using Upgrade Helper. - [Copy Cortex Cloud Application Security configurations](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/onboard-and-configure/deployment-steps-and-checklist/upgrade-from-prisma-cloud-to-cortex-cloud/copy-content/copy-cortex-cloud-application-security-configurations.md): Copy Cortex Cloud Application Security configurations from Prisma Cloud with Upgrade Helper. - [Migrate Cortex CLI](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/onboard-and-configure/deployment-steps-and-checklist/upgrade-from-prisma-cloud-to-cortex-cloud/migrate-cortex-cli.md): Migrate Cortex CLI workflows and configurations from Prisma Cloud to Cortex Cloud. - [Set up users, groups, and roles](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/onboard-and-configure/deployment-steps-and-checklist/set-up-users-and-roles.md): Learn how to set up users and roles in Cortex Cloud. - [User group management](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/onboard-and-configure/deployment-steps-and-checklist/set-up-users-and-roles/user-group-management.md): Manage user groups in Cortex Cloud to organize users and assign access consistently. - [Assign user roles and groups](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/onboard-and-configure/deployment-steps-and-checklist/set-up-users-and-roles/assign-user-roles-and-groups.md): Assign roles and group memberships to users. - [Manage API keys](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/onboard-and-configure/deployment-steps-and-checklist/manage-api-keys.md): Create, manage, and revoke Cortex Cloud API keys for secure programmatic access. - [Set up authentication](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/onboard-and-configure/deployment-steps-and-checklist/set-up-authentication.md): Authenticate Cortex Cloud users using SAML 2.0 or Customer Support Portal (CSP). - [Authenticate users through the Customer Support Portal](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/onboard-and-configure/deployment-steps-and-checklist/set-up-authentication/authenticate-users-through-the-customer-support-portal.md): Authenticate users through the Customer Support Portal. - [Authenticate users using SSO](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/onboard-and-configure/deployment-steps-and-checklist/set-up-authentication/authenticate-users-using-sso.md): Configure SAML single sign-on for Cortex Cloud users. - [Set up Okta as the Identity Provider Using SAML 2.0](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/onboard-and-configure/deployment-steps-and-checklist/set-up-authentication/set-up-okta-as-the-identity-provider-using-saml-2.0.md): Configure Okta as a SAML 2.0 identity provider. - [Set up Microsoft Entra ID as the Identity Provider Using SAML 2.0](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/onboard-and-configure/deployment-steps-and-checklist/set-up-authentication/set-up-microsoft-entra-id-as-the-identity-provider-using-saml-2.0.md): Configure Microsoft Entra ID as a SAML 2.0 identity provider. - [Cloud service provider (CSP) onboarding](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/onboard-and-configure/deployment-steps-and-checklist/cloud-service-provider-csp-onboarding.md): Learn about onboarding your cloud service provider to Cortex Cloud. - [Amazon Web Services cloud onboarding](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/onboard-and-configure/deployment-steps-and-checklist/cloud-service-provider-csp-onboarding/amazon-web-services-cloud-onboarding.md): Follow the AWS onboarding wizard, and Cortex Cloud creates a custom authentication template to be deployed in AWS. - [AWS security capabilities and deployment planning](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/onboard-and-configure/deployment-steps-and-checklist/cloud-service-provider-csp-onboarding/amazon-web-services-cloud-onboarding/aws-security-capabilities-and-deployment-planning.md) - [AWS resource inventory](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/onboard-and-configure/deployment-steps-and-checklist/cloud-service-provider-csp-onboarding/amazon-web-services-cloud-onboarding/aws-resource-inventory.md) - [AWS security model and authentication](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/onboard-and-configure/deployment-steps-and-checklist/cloud-service-provider-csp-onboarding/amazon-web-services-cloud-onboarding/aws-security-model-and-authentication.md) - [Cortex Cloud and AWS audit log collection architecture](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/onboard-and-configure/deployment-steps-and-checklist/cloud-service-provider-csp-onboarding/amazon-web-services-cloud-onboarding/cortex-cloud-and-aws-audit-log-collection-architecture.md) - [Onboard Amazon Web Services](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/onboard-and-configure/deployment-steps-and-checklist/cloud-service-provider-csp-onboarding/amazon-web-services-cloud-onboarding/onboard-amazon-web-services.md): Follow the AWS onboarding wizard, and Cortex Cloud creates a custom authentication template to be executed in AWS. - [Prerequisites for onboarding AWS](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/onboard-and-configure/deployment-steps-and-checklist/cloud-service-provider-csp-onboarding/amazon-web-services-cloud-onboarding/prerequisites-for-onboarding-aws.md): Before you begin onboarding AWS, you must review the following prerequisites. - [How to onboard Amazon Web Services](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/onboard-and-configure/deployment-steps-and-checklist/cloud-service-provider-csp-onboarding/amazon-web-services-cloud-onboarding/how-to-onboard-amazon-web-services.md): Follow the AWS onboarding wizard and Cortex Cloud creates a custom authentication template to be deployed in AWS CloudFormation. - [Deploy the authentication template in AWS](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/onboard-and-configure/deployment-steps-and-checklist/cloud-service-provider-csp-onboarding/amazon-web-services-cloud-onboarding/deploy-the-authentication-template-in-aws.md): Learn how to deploy the Terraform or CloudFormation authentication template in Amazon Web Services. - [Post-deployment: Custom (BYOB) and Control Tower audit log collection](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/onboard-and-configure/deployment-steps-and-checklist/cloud-service-provider-csp-onboarding/amazon-web-services-cloud-onboarding/post-deployment-custom-byob-audit-log-collection.md) - [Grant cross-account KMS key access for Control Tower BYOB log collection](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/onboard-and-configure/deployment-steps-and-checklist/cloud-service-provider-csp-onboarding/amazon-web-services-cloud-onboarding/grant-cross-account-kms-key-access-for-control-tower-byob-log-collection.md): Learn how to configure cross-account AWS KMS key permissions for Cortex Control Tower BYOB log collection. Step-by-step guide to updating KMS key policies. - [AWS post-deployment verification](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/onboard-and-configure/deployment-steps-and-checklist/cloud-service-provider-csp-onboarding/amazon-web-services-cloud-onboarding/aws-post-deployment-verification.md): After you have completed the AWS onboarding wizard and you have deployed the authentication template in AWS (using CloudFormation or Terraform), verify that the deployment succeeded. - [AWS provider permissions](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/onboard-and-configure/deployment-steps-and-checklist/cloud-service-provider-csp-onboarding/amazon-web-services-cloud-onboarding/amazon-web-services-aws-provider-permissions.md): List of Amazon Web Services (AWS) permissions for use during Cortex Cloud onboarding to enable continuous monitoring in your cloud environment. - [Microsoft Azure cloud onboarding](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/onboard-and-configure/deployment-steps-and-checklist/cloud-service-provider-csp-onboarding/microsoft-azure-cloud-onboarding.md): Onboard Microsoft Azure cloud accounts to Cortex Cloud for security visibility and monitoring. - [Onboard Microsoft Azure](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/onboard-and-configure/deployment-steps-and-checklist/cloud-service-provider-csp-onboarding/microsoft-azure-cloud-onboarding/onboard-microsoft-azure.md): Follow the Azure onboarding wizard, and Cortex creates a custom authentication template to be executed in Azure. - [Prerequisites for onboarding Azure](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/onboard-and-configure/deployment-steps-and-checklist/cloud-service-provider-csp-onboarding/microsoft-azure-cloud-onboarding/prerequisites-for-onboarding-azure.md): Before you begin onboarding Microsoft Azure, you must review the following prerequisites. - [How to onboard Microsoft Azure](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/onboard-and-configure/deployment-steps-and-checklist/cloud-service-provider-csp-onboarding/microsoft-azure-cloud-onboarding/how-to-onboard-microsoft-azure.md): Follow the Azure onboarding wizard, and Cortex creates a custom authentication template to be executed in Azure. - [Finalize Microsoft Azure onboarding by executing the authentication template](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/onboard-and-configure/deployment-steps-and-checklist/cloud-service-provider-csp-onboarding/microsoft-azure-cloud-onboarding/finalize-microsoft-azure-onboarding-by-executing-the-authentication-template.md): Learn how to execute the authentication template file in Microsoft Azure for subscriptions, tenants, and management groups. We provide instructions both for applying the Terraform template's configura - [Microsoft Azure offboarding overview](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/onboard-and-configure/deployment-steps-and-checklist/cloud-service-provider-csp-onboarding/microsoft-azure-cloud-onboarding/microsoft-azure-offboarding-overview.md): This section contains the technical procedures required to safely decommission and offboard your Cortex Cloud resources in Microsoft Azure. - [Offboard Terraform-based Azure deployments (all scopes)](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/onboard-and-configure/deployment-steps-and-checklist/cloud-service-provider-csp-onboarding/microsoft-azure-cloud-onboarding/microsoft-azure-offboarding-overview/offboard-terraform-based-azure-deployments-all-scopes.md): How to offboard all Terraform-based Microsoft Azure scopes from Cortex Cloud: A step-by-step technical guide to safely running Terraform destroy and cleaning up policy-deployed resources. - [Offboard Azure subscription (ARM)](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/onboard-and-configure/deployment-steps-and-checklist/cloud-service-provider-csp-onboarding/microsoft-azure-cloud-onboarding/microsoft-azure-offboarding-overview/offboard-azure-subscription-arm.md): How to offboard a Microsoft Azure subscription scope that was onboarded using ARM: A step-by-step technical guide to safely running the interactive offboarding script and cleaning up all resources. - [Offboard Azure management group or tenant scope (ARM)](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/onboard-and-configure/deployment-steps-and-checklist/cloud-service-provider-csp-onboarding/microsoft-azure-cloud-onboarding/microsoft-azure-offboarding-overview/offboard-azure-management-group-or-tenant-scope-arm.md): How to offboard Microsoft Azure management group or tenant scopes from Cortex Cloud: A step-by-step technical guide to safely removing all Azure resources deployed by Cortex onboarding templates. - [Offboard Azure tenant with Entra ID only](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/onboard-and-configure/deployment-steps-and-checklist/cloud-service-provider-csp-onboarding/microsoft-azure-cloud-onboarding/microsoft-azure-offboarding-overview/offboard-azure-tenant-with-entra-id-only.md): How to offboard a Microsoft Azure tenant onboarded with the Entra ID only option from Cortex Cloud: A step-by-step technical guide to safely removing deployed resources. - [Microsoft Azure provider permissions](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/onboard-and-configure/deployment-steps-and-checklist/cloud-service-provider-csp-onboarding/microsoft-azure-cloud-onboarding/microsoft-azure-provider-permissions.md): List of Microsoft Azure provider permissions for Cortex Cloud. - [Google Cloud Platform cloud onboarding](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/onboard-and-configure/deployment-steps-and-checklist/cloud-service-provider-csp-onboarding/google-cloud-platform-cloud-onboarding.md): Onboard Google Cloud Platform projects to Cortex Cloud for cloud security monitoring and governance. - [Onboard Google Cloud Platform](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/onboard-and-configure/deployment-steps-and-checklist/cloud-service-provider-csp-onboarding/google-cloud-platform-cloud-onboarding/onboard-google-cloud-platform.md): Follow the GCP onboarding wizard, and Cortex creates a custom authentication template to be executed in GCP. - [Prerequisites for onboarding GCP](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/onboard-and-configure/deployment-steps-and-checklist/cloud-service-provider-csp-onboarding/google-cloud-platform-cloud-onboarding/prerequisites-for-onboarding-gcp.md): Before you begin onboarding GCP, you must review the following prerequisites. - [Required APIs](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/onboard-and-configure/deployment-steps-and-checklist/cloud-service-provider-csp-onboarding/google-cloud-platform-cloud-onboarding/prerequisites-for-onboarding-gcp/required-apis.md) - [How to onboard Google Cloud Platform](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/onboard-and-configure/deployment-steps-and-checklist/cloud-service-provider-csp-onboarding/google-cloud-platform-cloud-onboarding/how-to-onboard-google-cloud-platform.md): Follow the GCP onboarding wizard, and Cortex Cloud creates a custom authentication template to be applied in GCP. - [Deploy the Terraform authentication template in GCP](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/onboard-and-configure/deployment-steps-and-checklist/cloud-service-provider-csp-onboarding/google-cloud-platform-cloud-onboarding/deploy-the-terraform-authentication-template-in-gcp.md): Learn how to deploy the Terraform authentication template in Google Cloud Console. - [Connect Google Workspace with your GCP cloud instance](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/onboard-and-configure/deployment-steps-and-checklist/cloud-service-provider-csp-onboarding/google-cloud-platform-cloud-onboarding/connect-google-workspace-with-your-gcp-cloud-instance.md): Connect Google Workspace with a Google Cloud Platform instance in Cortex Cloud. - [Monitor GCP resources inside service perimeters](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/onboard-and-configure/deployment-steps-and-checklist/cloud-service-provider-csp-onboarding/google-cloud-platform-cloud-onboarding/monitor-gcp-resources-inside-service-perimeters.md): Learn how to grant authorization to Cortex Cloud to scan within your GCP service perimeter. - [Google Cloud Platform (GCP) provider permissions](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/onboard-and-configure/deployment-steps-and-checklist/cloud-service-provider-csp-onboarding/google-cloud-platform-cloud-onboarding/google-cloud-platform-gcp-provider-permissions.md): List of Google Cloud Platform (GCP) permissions for use during Cortex Cloud onboarding to enable continuous monitoring in your cloud environment. - [Oracle Cloud Infrastructure cloud onboarding](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/onboard-and-configure/deployment-steps-and-checklist/cloud-service-provider-csp-onboarding/oracle-cloud-infrastructure-cloud-onboarding.md): Follow the Oracle Cloud Infrastructure onboarding wizard and Cortex Cloud creates a custom Terraform authentication template to be deployed in Oracle Cloud Infrastructure. - [Onboard Oracle Cloud Infrastructure](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/onboard-and-configure/deployment-steps-and-checklist/cloud-service-provider-csp-onboarding/oracle-cloud-infrastructure-cloud-onboarding/onboard-oracle-cloud-infrastructure.md): Follow the OCI onboarding wizard, and Cortex creates a custom authentication template to be executed in OCI. - [Prerequisites for onboarding OCI](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/onboard-and-configure/deployment-steps-and-checklist/cloud-service-provider-csp-onboarding/oracle-cloud-infrastructure-cloud-onboarding/prerequisites-for-onboarding-oci.md): Before you begin onboarding Oracle Cloud Infrastructure, you must review the following prerequisites. - [How to onboard Oracle Cloud Infrastructure](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/onboard-and-configure/deployment-steps-and-checklist/cloud-service-provider-csp-onboarding/oracle-cloud-infrastructure-cloud-onboarding/how-to-onboard-oracle-cloud-infrastructure.md): Follow the OCI onboarding wizard and Cortex Cloud creates a custom authentication template to be applied in OCI. - [Deploy the Terraform authentication template in OCI](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/onboard-and-configure/deployment-steps-and-checklist/cloud-service-provider-csp-onboarding/oracle-cloud-infrastructure-cloud-onboarding/deploy-the-terraform-authentication-template-in-oci.md): Learn how to deploy the Terraform authentication template in Oracle Cloud Infrastructure. - [Oracle Cloud Infrastructure (OCI) provider permissions](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/onboard-and-configure/deployment-steps-and-checklist/cloud-service-provider-csp-onboarding/oracle-cloud-infrastructure-cloud-onboarding/oracle-cloud-infrastructure-oci-provider-permissions.md): List of Oracle Cloud Infrastructure provider permissions for use during Cortex Cloud onboarding to enable continuous monitoring in your cloud environment. - [Alibaba Cloud cloud onboarding](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/onboard-and-configure/deployment-steps-and-checklist/cloud-service-provider-csp-onboarding/alibaba-cloud-cloud-onboarding.md): Follow the Alibaba Cloud onboarding wizard and Cortex Cloud creates a custom Terraform authentication template to be deployed in Alibaba Cloud. - [Alibaba security capabilities and deployment planning](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/onboard-and-configure/deployment-steps-and-checklist/cloud-service-provider-csp-onboarding/alibaba-cloud-cloud-onboarding/alibaba-security-capabilities-and-deployment-planning.md): Plan Alibaba Cloud onboarding by reviewing Cortex Cloud security capabilities and deployment requirements. - [Alibaba Cloud resource inventory](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/onboard-and-configure/deployment-steps-and-checklist/cloud-service-provider-csp-onboarding/alibaba-cloud-cloud-onboarding/alibaba-cloud-resource-inventory.md): Understand how Cortex Cloud discovers and inventories Alibaba Cloud resources for security visibility. - [Alibaba Cloud security model and authentication](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/onboard-and-configure/deployment-steps-and-checklist/cloud-service-provider-csp-onboarding/alibaba-cloud-cloud-onboarding/alibaba-cloud-security-model-and-authentication.md): Review Alibaba Cloud security models and authentication requirements for Cortex Cloud onboarding. - [Onboard Alibaba Cloud](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/onboard-and-configure/deployment-steps-and-checklist/cloud-service-provider-csp-onboarding/alibaba-cloud-cloud-onboarding/onboard-alibaba-cloud.md): Follow the Alibaba Cloud onboarding wizard and Cortex Cloud creates a custom CloudFormation authentication template to be deployed in Alibaba Cloud. - [Prerequisites for onboarding Alibaba Cloud](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/onboard-and-configure/deployment-steps-and-checklist/cloud-service-provider-csp-onboarding/alibaba-cloud-cloud-onboarding/prerequisites-for-onboarding-alibaba-cloud.md): Before you begin onboarding Alibaba Cloud, you must review the following prerequisites. - [How to onboard Alibaba Cloud](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/onboard-and-configure/deployment-steps-and-checklist/cloud-service-provider-csp-onboarding/alibaba-cloud-cloud-onboarding/how-to-onboard-alibaba-cloud.md): Onboard Alibaba Cloud accounts to Cortex Cloud for cloud security monitoring and governance. - [Alibaba Cloud post-deployment verification](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/onboard-and-configure/deployment-steps-and-checklist/cloud-service-provider-csp-onboarding/alibaba-cloud-cloud-onboarding/alibaba-cloud-post-deployment-verification.md): After you have completed the Alibaba Cloud onboarding wizard and you have deployed the authentication template in Alibaba Cloud, verify that the deployment succeeded. - [Alibaba Cloud provider permissions](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/onboard-and-configure/deployment-steps-and-checklist/cloud-service-provider-csp-onboarding/alibaba-cloud-cloud-onboarding/alibaba-cloud-provider-permissions.md): List of Alibaba Cloud permissions for use during Cortex Cloud onboarding to enable continuous monitoring in your cloud environment. - [Outpost onboarding](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/onboard-and-configure/deployment-steps-and-checklist/cloud-service-provider-csp-onboarding/outpost-onboarding.md): Learn about outposts, which are a dedicated set of infrastructure resources that extends the reach of Cortex Cloud into your environment. - [Outpost fundamentals and planning](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/onboard-and-configure/deployment-steps-and-checklist/cloud-service-provider-csp-onboarding/outpost-onboarding/outpost-fundamentals-and-planning.md): An outpost enables you to have security scans performed on infrastructure in a cloud account owned by you. Learn about outpost fundamentals and what to consider when planning your outpost. - [Outpost creation workflow](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/onboard-and-configure/deployment-steps-and-checklist/cloud-service-provider-csp-onboarding/outpost-onboarding/outpost-creation-workflow.md): Learn about the creation process for an outposts, which facilitate security scanning performed on infrastructure in a cloud account owned by you. - [Working with standard outposts](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/onboard-and-configure/deployment-steps-and-checklist/cloud-service-provider-csp-onboarding/outpost-onboarding/working-with-standard-outposts.md): Standard outposts are the recommended way to create dedicated set of infrastructure resources that extends the reach of Cortex Cloud into your environment. - [Create a standard outpost](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/onboard-and-configure/deployment-steps-and-checklist/cloud-service-provider-csp-onboarding/outpost-onboarding/working-with-standard-outposts/create-a-standard-outpost.md): Instructions for creating a standard outpost while onboarding your CSP. - [Working with Bringing your own Azure app (BYOA) outposts](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/onboard-and-configure/deployment-steps-and-checklist/cloud-service-provider-csp-onboarding/outpost-onboarding/working-with-bringing-your-own-azure-app-byoa-outposts.md): Using advanced settings while creating your outpost, you can deploy a Cortex Cloud Azure outpost using your own pre-created Entra ID app registration. - [Task 1: Meet the prerequisites for Azure BYOA outposts](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/onboard-and-configure/deployment-steps-and-checklist/cloud-service-provider-csp-onboarding/outpost-onboarding/working-with-bringing-your-own-azure-app-byoa-outposts/task-1-meet-the-prerequisites-for-azure-byoa-outposts.md): You can customize your own Azure outpost by bringing your own app (BYOA). This page lists the prerequisites that must be met before customizing your outpost in this way. - [Task 2: Create the app registration for the Azure BYOA outpost](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/onboard-and-configure/deployment-steps-and-checklist/cloud-service-provider-csp-onboarding/outpost-onboarding/working-with-bringing-your-own-azure-app-byoa-outposts/task-2-create-the-app-registration-for-the-azure-byoa-outpost.md): You can customize your own outpost for Azure by bringing your own app (BYOA). This page describes the steps for creating the app registration. - [Task 3: Deploy the Azure BYOA outpost](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/onboard-and-configure/deployment-steps-and-checklist/cloud-service-provider-csp-onboarding/outpost-onboarding/working-with-bringing-your-own-azure-app-byoa-outposts/task-3-deploy-the-azure-byoa-outpost.md): You can customize your own outpost by bringing your own app (BYOA). This page describes the steps for deploying the Azure BYOA outpost. - [Task 4: Verify the BYOA outpost deployment](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/onboard-and-configure/deployment-steps-and-checklist/cloud-service-provider-csp-onboarding/outpost-onboarding/working-with-bringing-your-own-azure-app-byoa-outposts/task-4-verify-the-byoa-outpost-deployment.md): You can customize your own Azure outpost by bringing your own app (BYOA). This page describes the steps for verifying your BYOA outpost deployment. - [The shell script for Azure app registration](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/onboard-and-configure/deployment-steps-and-checklist/cloud-service-provider-csp-onboarding/outpost-onboarding/working-with-bringing-your-own-azure-app-byoa-outposts/the-shell-script-for-azure-app-registration.md): You can run this helper shell script to set up your resources and retrieve their IDs for use while creating your Azure BYOA outpost. This page provides technical, "read-me style" details about the scr - [Outpost troubleshooting](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/onboard-and-configure/deployment-steps-and-checklist/cloud-service-provider-csp-onboarding/outpost-onboarding/outpost-troubleshooting.md): Check here for solutions to issues that might occur while configuring, deploying, and operating outposts. - [Outpost Cloud Service Provider (CSP) permissions](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/onboard-and-configure/deployment-steps-and-checklist/cloud-service-provider-csp-onboarding/outpost-onboarding/outpost-cloud-service-provider-csp-permissions.md): This page lists and explains the various roles and permissions needed for working with resources for outposts by CSP. - [Amazon Web Services (AWS) outpost permissions](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/onboard-and-configure/deployment-steps-and-checklist/cloud-service-provider-csp-onboarding/outpost-onboarding/outpost-cloud-service-provider-csp-permissions/amazon-web-services-aws-outpost-permissions.md): List of Amazon Web Services (AWS) permissions for use during Cortex Cloud outpost onboarding to enable continuous monitoring in your cloud environment. - [Microsoft Azure outpost permissions](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/onboard-and-configure/deployment-steps-and-checklist/cloud-service-provider-csp-onboarding/outpost-onboarding/outpost-cloud-service-provider-csp-permissions/microsoft-azure-outpost-permissions.md): List of Microsoft Azure provider outpost permissions for Cortex Cloud. - [Google Cloud Platform (GCP) outpost permissions](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/onboard-and-configure/deployment-steps-and-checklist/cloud-service-provider-csp-onboarding/outpost-onboarding/outpost-cloud-service-provider-csp-permissions/google-cloud-platform-gcp-outpost-permissions.md): List of Google Cloud Platform (GCP) permissions for use during Cortex Cloud onboarding outposts to enable continuous monitoring in your cloud environment. - [Introduction to Terraform for Cloud service provider (CSP) onboarding](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/onboard-and-configure/deployment-steps-and-checklist/cloud-service-provider-csp-onboarding/introduction-to-terraform-for-cloud-service-provider-csp-onboarding.md): Learn how to onboard Cloud Service Providers (CSPs) using Terraform. Discover step-by-step workflows for initial provisioning, updates, and Cloud Shell deployment. - [Manually connect a cloud instance](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/onboard-and-configure/deployment-steps-and-checklist/cloud-service-provider-csp-onboarding/manually-connect-a-cloud-instance.md): Manually connect a cloud instance to Cortex Cloud when automated onboarding is unavailable. - [Manage cloud instances](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/onboard-and-configure/deployment-steps-and-checklist/cloud-service-provider-csp-onboarding/manage-cloud-instances.md): Learn how to manage, edit, and troubleshoot cloud instances in Cortex Cloud. Monitor connector health, view security capabilities, and investigate errors. - [Pending cloud instances](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/onboard-and-configure/deployment-steps-and-checklist/cloud-service-provider-csp-onboarding/pending-cloud-instances.md): Review and resolve pending cloud instances during Cortex Cloud onboarding. - [Edit your onboarded CSP configuration](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/onboard-and-configure/deployment-steps-and-checklist/cloud-service-provider-csp-onboarding/edit-your-onboarded-csp-configuration.md): Edit the configuration of an onboarded cloud service provider in Cortex Cloud. - [Update cloud permissions after Cortex Cloud release updates](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/onboard-and-configure/deployment-steps-and-checklist/cloud-service-provider-csp-onboarding/update-cloud-permissions-after-cortex-release-updates.md): Manage permission updates for your cloud instances following new feature releases or bug fixes. - [Troubleshoot errors on cloud instances](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/onboard-and-configure/deployment-steps-and-checklist/cloud-service-provider-csp-onboarding/troubleshoot-errors-on-cloud-instances.md): You can troubleshoot errors on cloud instances by drilling down on an instance from the Data Sources & Integrations page. - [Cloud service provider permissions](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/onboard-and-configure/deployment-steps-and-checklist/cloud-service-provider-csp-onboarding/cloud-service-provider-permissions.md): Grant the correct cloud service provider permissions for Cortex Cloud. - [Onboard the Kubernetes Connector](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/onboard-and-configure/deployment-steps-and-checklist/onboard-the-kubernetes-connector.md): Onboard the Cortex Kubernetes Connector to collect Kubernetes security data and enable protection. - [What's new in Kubernetes Connector?](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/onboard-and-configure/deployment-steps-and-checklist/onboard-the-kubernetes-connector/whats-new-in-kubernetes-connector.md): Review new features, enhancements, and updates for the Cortex Kubernetes Connector. - [Supported Kubernetes distributions](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/onboard-and-configure/deployment-steps-and-checklist/onboard-the-kubernetes-connector/supported-kubernetes-distributions.md): Check which Kubernetes distributions Cortex Kubernetes Connector supports before deployment. - [FedRAMP overview](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/onboard-and-configure/deployment-steps-and-checklist/fedramp-overview.md): Learn how Cortex Cloud supports FedRAMP requirements and US federal government environments. - [Cortex Cloud federal compliance](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/onboard-and-configure/deployment-steps-and-checklist/fedramp-overview/cortex-cloud-federal-compliance.md): Review Cortex Cloud federal compliance capabilities and requirements for government deployments. - [Onoarding & configuration](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/onboard-and-configure/deployment-steps-and-checklist/fedramp-overview/onoarding-and-configuration.md): Configure Cortex Cloud onboarding and deployment settings for your environment. - [Limitations & supported regions](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/onboard-and-configure/deployment-steps-and-checklist/fedramp-overview/limitations-and-supported-regions.md): Review supported regions and known limitations for Cortex Cloud deployment and onboarding. - [Post-deployment steps](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/onboard-and-configure/post-deployment-steps.md): Complete recommended Cortex Cloud configuration and validation tasks after deployment. - [Set up your environment](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/onboard-and-configure/post-deployment-steps/set-up-your-environment.md): Learn more about setting up the Cortex Cloud environment based on your preferences. - [Configure server settings](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/onboard-and-configure/post-deployment-steps/set-up-your-environment/configure-server-settings.md): Configure Cortex Cloud server settings to align tenant behavior with operational requirements. - [Configure security settings](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/onboard-and-configure/post-deployment-steps/set-up-your-environment/configure-security-settings.md): Configure Cortex Cloud security settings to protect your tenant and enforce security controls. - [Data and log forwarding](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/onboard-and-configure/post-deployment-steps/set-up-your-environment/data-and-log-forwarding.md): Configure data and log forwarding from Cortex Cloud to external services and destinations. - [Forward logs and data from Cortex Cloud to external services](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/onboard-and-configure/post-deployment-steps/set-up-your-environment/data-and-log-forwarding/forward-logs-and-data-from-cortex-cloud-to-external-services.md): Forward Cortex Cloud logs and data to external services for monitoring, analysis, and retention. - [Configure external applications for forwarding](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/onboard-and-configure/post-deployment-steps/set-up-your-environment/data-and-log-forwarding/forward-logs-and-data-from-cortex-cloud-to-external-services/configure-external-applications-for-forwarding.md): Configure external applications to receive Cortex Cloud logs, data, and notifications. - [Forward notifications to Amazon SQS](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/onboard-and-configure/post-deployment-steps/set-up-your-environment/data-and-log-forwarding/forward-logs-and-data-from-cortex-cloud-to-external-services/configure-external-applications-for-forwarding/forward-notifications-to-amazon-sqs.md): Forward Cortex Cloud notifications to Amazon SQS for downstream processing and automation. - [Forward notifications to Amazon S3](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/onboard-and-configure/post-deployment-steps/set-up-your-environment/data-and-log-forwarding/forward-logs-and-data-from-cortex-cloud-to-external-services/configure-external-applications-for-forwarding/forward-notifications-to-amazon-s3.md): Forward Cortex Cloud notifications to Amazon S3 for storage, analysis, and retention. - [Forward notifications to Splunk](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/onboard-and-configure/post-deployment-steps/set-up-your-environment/data-and-log-forwarding/forward-logs-and-data-from-cortex-cloud-to-external-services/configure-external-applications-for-forwarding/forward-notifications-to-splunk.md): Forward Cortex Cloud notifications to Splunk for centralized security monitoring and analysis. - [Forward notifications to webhook](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/onboard-and-configure/post-deployment-steps/set-up-your-environment/data-and-log-forwarding/forward-logs-and-data-from-cortex-cloud-to-external-services/configure-external-applications-for-forwarding/forward-notifications-to-webhook.md): Forward Cortex Cloud notifications to a webhook endpoint for external workflow automation. - [Integrate a syslog receiver](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/onboard-and-configure/post-deployment-steps/set-up-your-environment/data-and-log-forwarding/forward-logs-and-data-from-cortex-cloud-to-external-services/configure-external-applications-for-forwarding/integrate-a-syslog-receiver.md): Integrate a syslog receiver with Cortex Cloud to collect forwarded logs and events. - [Integrate Slack for outbound notifications](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/onboard-and-configure/post-deployment-steps/set-up-your-environment/data-and-log-forwarding/forward-logs-and-data-from-cortex-cloud-to-external-services/configure-external-applications-for-forwarding/integrate-slack-for-outbound-notifications.md): Integrate Slack with Cortex Cloud to deliver outbound security notifications to channels. - [Configure notification forwarding](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/onboard-and-configure/post-deployment-steps/set-up-your-environment/data-and-log-forwarding/forward-logs-and-data-from-cortex-cloud-to-external-services/configure-notification-forwarding.md): Configure Cortex Cloud notification forwarding for supported external destinations and services. - [Set up email notifications for tenant updates](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/onboard-and-configure/post-deployment-steps/set-up-your-environment/data-and-log-forwarding/forward-logs-and-data-from-cortex-cloud-to-external-services/set-up-email-notifications-for-tenant-updates.md): Set up email notifications for Cortex Cloud tenant updates and operational announcements. - [Monitor administrative activity](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/onboard-and-configure/post-deployment-steps/set-up-your-environment/data-and-log-forwarding/forward-logs-and-data-from-cortex-cloud-to-external-services/monitor-administrative-activity.md): Monitor Cortex Cloud administrative and investigative activity with management audit logs and notifications. - [Data and log notification formats](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/onboard-and-configure/post-deployment-steps/set-up-your-environment/data-and-log-forwarding/data-and-log-notification-formats.md): Understand Cortex Cloud data and log notification formats for external integrations. - [Management audit log messages](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/onboard-and-configure/post-deployment-steps/set-up-your-environment/data-and-log-forwarding/data-and-log-notification-formats/management-audit-log-messages.md): Review management audit log messages generated by Cortex Cloud administrative activity. - [Issue notification format](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/onboard-and-configure/post-deployment-steps/set-up-your-environment/data-and-log-forwarding/data-and-log-notification-formats/issue-notification-format.md): Understand the Cortex Cloud issue notification format for external integrations and processing. - [Agent Audit log notification format](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/onboard-and-configure/post-deployment-steps/set-up-your-environment/data-and-log-forwarding/data-and-log-notification-formats/agent-audit-log-notification-format.md): Review the Cortex Agent Audit log notification format for external event processing. - [Management Audit log notification format](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/onboard-and-configure/post-deployment-steps/set-up-your-environment/data-and-log-forwarding/data-and-log-notification-formats/management-audit-log-notification-format.md): Review the Cortex Cloud Management Audit log notification format for external event processing. - [Log format for IOC and BIOC issues](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/onboard-and-configure/post-deployment-steps/set-up-your-environment/data-and-log-forwarding/data-and-log-notification-formats/log-format-for-ioc-and-bioc-issues.md): Understand Cortex Cloud log formats for IOC and BIOC security issues. - [Analytics log format](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/onboard-and-configure/post-deployment-steps/set-up-your-environment/data-and-log-forwarding/data-and-log-notification-formats/analytics-log-format.md): Understand the Cortex Cloud analytics log format for external integrations and analysis. - [Cortex MCP server](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/onboard-and-configure/post-deployment-steps/cortex-mcp-server.md): The Cortex MCP server enables you to leverage Cortex's powerful capabilities directly through natural language. - [Install the Cortex MCP server](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/onboard-and-configure/post-deployment-steps/cortex-mcp-server/install-the-cortex-mcp-server.md): Install the Cortex MCP server to connect AI clients with Cortex Cloud capabilities. - [Configure the MCP client](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/onboard-and-configure/post-deployment-steps/cortex-mcp-server/configure-the-mcp-client.md): Configure an MCP client to connect securely with the Cortex MCP server. - [Use the Cortex MCP server](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/onboard-and-configure/post-deployment-steps/cortex-mcp-server/use-the-cortex-mcp-server.md): Use the Cortex MCP server to access Cortex Cloud capabilities from compatible AI clients. - [Create custom Cortex MCP server tools](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/onboard-and-configure/post-deployment-steps/cortex-mcp-server/create-custom-cortex-mcp-server-tools.md): Create custom tools for the Cortex MCP server to extend AI client capabilities. - [Manage user roles and access management](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/onboard-and-configure/post-deployment-steps/manage-user-roles-and-access-management.md): Learn how to manage access for users, user roles, user groups, and Single Sign-On (SSO) for users on a specific Cortex Cloud tenant. - [Manage user roles](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/onboard-and-configure/post-deployment-steps/manage-user-roles-and-access-management/manage-user-roles.md): Manage Cortex Cloud user roles and define permissions for tenant access. - [Manage user access](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/onboard-and-configure/post-deployment-steps/manage-user-roles-and-access-management/manage-user-access.md): Manage Cortex Cloud user access by assigning roles and controlling tenant permissions. - [User access reference information](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/onboard-and-configure/post-deployment-steps/manage-user-roles-and-access-management/manage-user-access/user-access-reference-information.md): Reference Cortex Cloud user access concepts, permissions, roles, and scope controls. - [Manage user scope](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/onboard-and-configure/post-deployment-steps/manage-user-roles-and-access-management/manage-user-scope.md): Manage user scope in Cortex Cloud to limit access to the appropriate data and resources. - [Manage access to objects](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/onboard-and-configure/post-deployment-steps/manage-user-roles-and-access-management/manage-access-to-objects.md): Control Cortex Cloud access to objects using role-based permissions and scope settings. - [Manage access to custom dashboards](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/onboard-and-configure/post-deployment-steps/manage-user-roles-and-access-management/manage-access-to-objects/manage-access-to-custom-dashboards.md): Manage access to custom dashboards in Cortex Cloud using roles and permissions. - [Manage access to report templates](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/onboard-and-configure/post-deployment-steps/manage-user-roles-and-access-management/manage-access-to-objects/manage-access-to-report-templates.md): Manage access to Cortex Cloud report templates using roles and permissions. - [Manage access to playbooks and scripts](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/onboard-and-configure/post-deployment-steps/manage-user-roles-and-access-management/manage-access-to-objects/manage-access-to-playbooks-and-scripts.md): Manage access to Cortex Cloud playbooks and scripts using roles and permissions. - [Manage access to saved queries](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/onboard-and-configure/post-deployment-steps/manage-user-roles-and-access-management/manage-access-to-objects/manage-access-to-saved-queries.md): Manage access to Cortex Cloud saved queries using roles and permissions. - [Configure the Cortex Agentic Assistant](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/onboard-and-configure/post-deployment-steps/configure-the-cortex-agentic-assistant.md): Configure the Cortex Agentic Assistant to support secure AI-assisted security operations. - [Agentic Assistant components and concepts](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/onboard-and-configure/post-deployment-steps/configure-the-cortex-agentic-assistant/agentic-assistant-components-and-concepts.md): Learn about the key components and concepts, such as agents and actions in the Cortex Agentic Assistant - [Agentic Assistant Hub](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/onboard-and-configure/post-deployment-steps/configure-the-cortex-agentic-assistant/agents-hub.md): Learn about personal and system agents in in the Agentic Assistant Hub - [Manage actions](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/onboard-and-configure/post-deployment-steps/configure-the-cortex-agentic-assistant/agents-hub/manage-actions.md): Manage Cortex Cloud actions that automate security tasks and operational workflows. - [Register actions](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/onboard-and-configure/post-deployment-steps/configure-the-cortex-agentic-assistant/agents-hub/register-actions.md): Register actions in Cortex Cloud for use in automated workflows and agents. - [Manage agents](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/onboard-and-configure/post-deployment-steps/configure-the-cortex-agentic-assistant/agents-hub/manage-agents.md): Manage Cortex Cloud agents that coordinate actions and automated security workflows. - [Build agents](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/onboard-and-configure/post-deployment-steps/configure-the-cortex-agentic-assistant/agents-hub/build-agents.md): Build Cortex Cloud agents to automate security operations with actions and tools. - [Manage knowledge sources (preview)](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/onboard-and-configure/post-deployment-steps/configure-the-cortex-agentic-assistant/agents-hub/manage-knowledge-sources-preview.md): Enhance AI agent capabilities by leveraging the Knowledge Center (preview) to provide agents with your business-specific source of truth and built-in Cortex (system) knowledge. - [Expand agent capabilities with MCP integrations](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/onboard-and-configure/post-deployment-steps/configure-the-cortex-agentic-assistant/agents-hub/expand-agent-capabilities-with-mcp-integrations.md): Expand Cortex Cloud agent capabilities with Model Context Protocol integrations. - [Agentic Assistant role-based access control](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/onboard-and-configure/post-deployment-steps/configure-the-cortex-agentic-assistant/agentic-assistant-role-based-access-control.md): Configure permissions to access Cortex Agentic Assistant features. - [XQL query management](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/onboard-and-configure/post-deployment-steps/xql-query-management.md): Administrators can set controls on running XQL queries. - [Dashboards and reports](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/onboard-and-configure/post-deployment-steps/dashboards-and-reports.md): Create and manage Cortex Cloud dashboards and reports for security visibility and analysis. - [Endpoint protection](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/endpoint-security/endpoint-protection.md): This topic provides an overview of traditional endpoint protection versus the protection of endpoints using Cortex Cloud. - [Malware protection](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/endpoint-security/endpoint-protection/malware-protection.md): Cortex Cloud prevents malware attacks and provides protection on endpoints based on the different operating systems. - [Exploit protection](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/endpoint-security/endpoint-protection/exploit-protection.md): Cortex Cloud prevents exploit attempts and provides protection on endpoints based on the different operating systems. - [File analysis and protection flow](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/endpoint-security/endpoint-protection/file-analysis-and-protection-flow.md): The Cortex XDR agent utilizes advanced multi-method protection and prevention techniques to protect from both known and unknown malware and software exploits. - [Endpoint protection capabilities](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/endpoint-security/endpoint-protection/endpoint-protection-capabilities.md): The endpoint protection capabilities vary depending on the platform (operating system) that is used on each of your endpoints. - [Endpoint protection modules](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/endpoint-security/endpoint-protection/endpoint-protection-modules.md): Security modules are activated for your endpoints depending on the chosen security profile and the operating system on the endpoint. - [Processes protected by exploit security policy](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/endpoint-security/endpoint-protection/processes-protected-by-exploit-security-policy.md): Application processes that run on your endpoint are protected by the exploit security policy. - [File Integrity Monitoring (FIM)](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/endpoint-security/endpoint-protection/file-integrity-monitoring-fim.md): Learn about File Integrity Monitoring (FIM) capabilities in Cortex Cloud. - [CaaS Workloads](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/endpoint-security/endpoint-protection/caas-workloads.md) - [WildFire analysis concepts](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/endpoint-security/endpoint-protection/wildfire-analysis-concepts.md): Learn about the analysis concepts used by Wildfire. - [Guidelines for keeping Cortex XDR agents and content updated](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/endpoint-security/endpoint-protection/guidelines-for-keeping-cortex-xdr-agents-and-content-updated.md): Learn more about how to control Cortex XDR agent and content upgrades. - [About content updates](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/endpoint-security/endpoint-protection/about-content-updates.md): To increase security coverage and quickly resolve any issues in policy, Palo Alto Networks can seamlessly deliver software packages called content updates. - [Endpoint data collection](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/endpoint-security/endpoint-protection/endpoint-data-collection.md): To aid in endpoint detection and issue investigation, the Cortex XDR agent collects endpoint information when an issue is generated. - [Install and manage endpoints](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/endpoint-security/install-and-manage-endpoints.md): Learn how to set up profiles, policies and other settings for endpoint protection, how to install Cortex XDR agent on endpoints, and how to manage them after installation. - [Set up endpoint protection](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/endpoint-security/install-and-manage-endpoints/set-up-endpoint-protection.md) - [Set up endpoint profiles and exception rules](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/endpoint-security/install-and-manage-endpoints/set-up-endpoint-protection/set-up-endpoint-profiles-and-exception-rules.md) - [Set up malware prevention profiles](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/endpoint-security/install-and-manage-endpoints/set-up-endpoint-protection/set-up-endpoint-profiles-and-exception-rules/set-up-malware-prevention-profiles.md) - [Set up exploit prevention profiles](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/endpoint-security/install-and-manage-endpoints/set-up-endpoint-protection/set-up-endpoint-profiles-and-exception-rules/set-up-exploit-prevention-profiles.md) - [Set up agent settings profiles](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/endpoint-security/install-and-manage-endpoints/set-up-endpoint-protection/set-up-endpoint-profiles-and-exception-rules/set-up-agent-settings-profiles.md) - [Set up restrictions prevention profiles](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/endpoint-security/install-and-manage-endpoints/set-up-endpoint-protection/set-up-endpoint-profiles-and-exception-rules/set-up-restrictions-prevention-profiles.md) - [Set up exception profiles and rules](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/endpoint-security/install-and-manage-endpoints/set-up-endpoint-protection/set-up-endpoint-profiles-and-exception-rules/set-up-exception-profiles-and-rules.md) - [Exception configuration](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/endpoint-security/install-and-manage-endpoints/set-up-endpoint-protection/set-up-endpoint-profiles-and-exception-rules/set-up-exception-profiles-and-rules/exception-configuration.md) - [Issue exclusions](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/endpoint-security/install-and-manage-endpoints/set-up-endpoint-protection/set-up-endpoint-profiles-and-exception-rules/set-up-exception-profiles-and-rules/issue-exclusions.md) - [Add an issue exclusion rule](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/endpoint-security/install-and-manage-endpoints/set-up-endpoint-protection/set-up-endpoint-profiles-and-exception-rules/set-up-exception-profiles-and-rules/issue-exclusions/add-an-issue-exclusion-rule.md) - [Add an IOC or BIOC rule exception](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/endpoint-security/install-and-manage-endpoints/set-up-endpoint-protection/set-up-endpoint-profiles-and-exception-rules/set-up-exception-profiles-and-rules/add-an-ioc-or-bioc-rule-exception.md) - [Add a disable prevention rule for endpoints](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/endpoint-security/install-and-manage-endpoints/set-up-endpoint-protection/set-up-endpoint-profiles-and-exception-rules/set-up-exception-profiles-and-rules/add-a-disable-prevention-rule-for-endpoints.md) - [Add a disable injection and prevention rule](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/endpoint-security/install-and-manage-endpoints/set-up-endpoint-protection/set-up-endpoint-profiles-and-exception-rules/set-up-exception-profiles-and-rules/add-a-disable-injection-and-prevention-rule.md) - [Add a support exception rule for endpoints](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/endpoint-security/install-and-manage-endpoints/set-up-endpoint-protection/set-up-endpoint-profiles-and-exception-rules/set-up-exception-profiles-and-rules/add-a-support-exception-rule-for-endpoints.md) - [Add a legacy exception rule for endpoints](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/endpoint-security/install-and-manage-endpoints/set-up-endpoint-protection/set-up-endpoint-profiles-and-exception-rules/set-up-exception-profiles-and-rules/add-a-legacy-exception-rule-for-endpoints.md) - [Add a new exceptions security profile](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/endpoint-security/install-and-manage-endpoints/set-up-endpoint-protection/set-up-endpoint-profiles-and-exception-rules/set-up-exception-profiles-and-rules/add-a-legacy-exception-rule-for-endpoints/add-a-new-exceptions-security-profile.md) - [Add a global endpoint policy exception](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/endpoint-security/install-and-manage-endpoints/set-up-endpoint-protection/set-up-endpoint-profiles-and-exception-rules/set-up-exception-profiles-and-rules/add-a-legacy-exception-rule-for-endpoints/add-a-global-endpoint-policy-exception.md) - [Set up Identity profiles](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/endpoint-security/install-and-manage-endpoints/set-up-endpoint-protection/set-up-endpoint-profiles-and-exception-rules/set-up-identity-profiles.md) - [Define endpoint groups](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/endpoint-security/install-and-manage-endpoints/set-up-endpoint-protection/define-endpoint-groups.md) - [Configure global agent settings](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/endpoint-security/install-and-manage-endpoints/set-up-endpoint-protection/configure-global-agent-settings.md) - [Apply profiles to endpoints](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/endpoint-security/install-and-manage-endpoints/set-up-endpoint-protection/apply-profiles-to-endpoints.md) - [Create an agent installation package](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/endpoint-security/install-and-manage-endpoints/set-up-endpoint-protection/create-an-agent-installation-package.md) - [Manage an agent installation package](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/endpoint-security/install-and-manage-endpoints/set-up-endpoint-protection/create-an-agent-installation-package/manage-an-agent-installation-package.md) - [Harden endpoint security](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/endpoint-security/install-and-manage-endpoints/harden-endpoint-security.md) - [Device control](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/endpoint-security/install-and-manage-endpoints/harden-endpoint-security/device-control.md) - [Host firewall](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/endpoint-security/install-and-manage-endpoints/harden-endpoint-security/host-firewall.md) - [Host firewall for Windows](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/endpoint-security/install-and-manage-endpoints/harden-endpoint-security/host-firewall/host-firewall-for-windows.md) - [Host firewall for macos](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/endpoint-security/install-and-manage-endpoints/harden-endpoint-security/host-firewall/host-firewall-for-macos.md) - [Disk encryption](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/endpoint-security/install-and-manage-endpoints/harden-endpoint-security/disk-encryption.md) - [Host Inventory](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/endpoint-security/install-and-manage-endpoints/harden-endpoint-security/host-inventory.md) - [Set a Cortex XDR agent Critical Environment version](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/endpoint-security/install-and-manage-endpoints/harden-endpoint-security/set-a-cortex-xdr-agent-critical-environment-version.md) - [Manage endpoint protection](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/endpoint-security/install-and-manage-endpoints/manage-endpoint-protection.md) - [Move agents between managing servers](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/endpoint-security/install-and-manage-endpoints/manage-endpoint-protection/move-agents-between-managing-servers.md) - [Manage endpoint tags](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/endpoint-security/install-and-manage-endpoints/manage-endpoint-protection/manage-endpoint-tags.md) - [Create an endpoint tag](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/endpoint-security/install-and-manage-endpoints/manage-endpoint-protection/manage-endpoint-tags/create-an-endpoint-tag.md) - [Remove an endpoint tag](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/endpoint-security/install-and-manage-endpoints/manage-endpoint-protection/manage-endpoint-tags/remove-an-endpoint-tag.md) - [Track your endpoint tags](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/endpoint-security/install-and-manage-endpoints/manage-endpoint-protection/manage-endpoint-tags/track-your-endpoint-tags.md) - [Permanently remove Endpoint tags from the system](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/endpoint-security/install-and-manage-endpoints/manage-endpoint-protection/manage-endpoint-tags/permanently-remove-endpoint-tags-from-the-system.md) - [Set an alias for an endpoint](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/endpoint-security/install-and-manage-endpoints/manage-endpoint-protection/manage-endpoint-tags/set-an-alias-for-an-endpoint.md) - [Manage endpoint prevention profiles](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/endpoint-security/install-and-manage-endpoints/manage-endpoint-protection/manage-endpoint-prevention-profiles.md) - [Create a new prevention policy rule for serverless function](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/endpoint-security/install-and-manage-endpoints/manage-endpoint-protection/create-a-new-prevention-policy-rule-for-serverless-function.md) - [View information about your endpoint prevention profiles](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/endpoint-security/install-and-manage-endpoints/manage-endpoint-protection/view-information-about-your-endpoint-prevention-profiles.md) - [Upgrade Cortex XDR agents](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/endpoint-security/install-and-manage-endpoints/manage-endpoint-protection/upgrade-cortex-xdr-agents.md) - [Restart agent](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/endpoint-security/install-and-manage-endpoints/manage-endpoint-protection/restart-agent.md) - [Uninstall the Cortex XDR agent](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/endpoint-security/install-and-manage-endpoints/manage-endpoint-protection/uninstall-the-cortex-xdr-agent.md) - [Clear agent database](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/endpoint-security/install-and-manage-endpoints/manage-endpoint-protection/clear-agent-database.md) - [Delete Cortex XDR agents](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/endpoint-security/install-and-manage-endpoints/manage-endpoint-protection/delete-cortex-xdr-agents.md) - [Manage agent tokens](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/endpoint-security/install-and-manage-endpoints/manage-endpoint-protection/manage-agent-tokens.md) - [Retrieve support file password](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/endpoint-security/install-and-manage-endpoints/manage-endpoint-protection/retrieve-support-file-password.md) - [Send push notifications to iOS](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/endpoint-security/install-and-manage-endpoints/manage-endpoint-protection/send-push-notifications-to-ios.md) - [Monitor agent operational status](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/endpoint-security/install-and-manage-endpoints/manage-endpoint-protection/monitor-agent-operational-status.md) - [Monitor agent activity](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/endpoint-security/install-and-manage-endpoints/manage-endpoint-protection/monitor-agent-activity.md) - [Monitor agent upgrade status](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/endpoint-security/install-and-manage-endpoints/manage-endpoint-protection/monitor-agent-upgrade-status.md) - [Endpoint DLP](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/endpoint-security/endpoint-dlp.md) - [Cortex Data Loss Prevention (DLP) module overview](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/endpoint-security/endpoint-dlp/cortex-data-loss-prevention-dlp-module-overview.md): Learn about Cortex Data Loss Prevention (DLP) module, which provides a solution to prevent sensitive data exfiltration. - [Archive file classification](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/endpoint-security/endpoint-dlp/cortex-data-loss-prevention-dlp-module-overview/archive-file-classification.md) - [True-file type detection](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/endpoint-security/endpoint-dlp/cortex-data-loss-prevention-dlp-module-overview/true-file-type-detection.md) - [Personas workflow for DLP](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/endpoint-security/endpoint-dlp/personas-workflow-for-dlp.md): The data security administrator and data security viewer are responsible for identifying DLP requirements for creating data-in-motion rules and investigating issues and cases. - [Best Practices](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/endpoint-security/endpoint-dlp/best-practices.md) - [Configure DLP end-to-end](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/endpoint-security/endpoint-dlp/configure-dlp-end-to-end.md) - [DLP status in all endpoints](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/endpoint-security/endpoint-dlp/dlp-status-in-all-endpoints.md) - [Cortex DLP threat detection and issues](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/endpoint-security/endpoint-dlp/cortex-dlp-threat-detection-and-issues.md) - [Extended Threat Intelligence](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/threat-management/extended-threat-intelligence.md): Research threats, investigate indicators, and apply intelligence across Cortex Cloud Runtime Security workflows. - [XTI Threat Intel Library](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/threat-management/extended-threat-intelligence/xti-threat-intel-library.md): Research curated threat actors, malware families, vulnerabilities, and reports from Unit 42. - [XTI Indicators](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/threat-management/extended-threat-intelligence/xti-indicators.md): Investigate, manage, and enrich threat indicators, including domains, IP addresses, URLs, and file hashes. - [Threat intel context in cases and issues](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/threat-management/extended-threat-intelligence/threat-intel-context-in-cases-and-issues.md): Analyze indicator intelligence and Behavioral Threat Analysis (BTA) findings in cases and issues. - [XTI indicator rules](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/threat-management/extended-threat-intelligence/xti-indicator-rules.md): Create rules that detect known threat indicators and generate issues from matching data. - [Threat intel investigation through XQL](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/threat-management/extended-threat-intelligence/threat-intel-investigation-through-xql.md): Query XTI indicators, threat objects, and their relationships using Cortex Query Language. - [Threat Intel Dashboard](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/threat-management/extended-threat-intelligence/threat-intel-dashboard.md): Visualize threat intelligence data to monitor distribution, ingestion health, and emerging trends. - [Using XTI with Threat Intel Agent](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/threat-management/extended-threat-intelligence/using-xti-with-threat-intel-agent.md): Use the Threat Intel Agent to list, enrich, and update XTI indicators. - [Using XTI in playbooks](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/threat-management/extended-threat-intelligence/using-xti-in-playbooks.md): Automate XTI indicator triage, enrichment, and response with supported playbook commands. - [Detection rules](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/threat-management/detection-rules.md): Learn about IOC, BIOC, and correlation rules for detecting threats and generating issues. - [What are detection rules?](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/threat-management/detection-rules/what-are-detection-rules.md): Understand detection rule types that identify threats and generate issues in Cortex Cloud. - [What's an IOC?](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/threat-management/detection-rules/what-are-detection-rules/whats-an-ioc.md): Learn how IOC rules detect known malicious or suspicious artifacts in your environment. - [IOC rule details](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/threat-management/detection-rules/what-are-detection-rules/whats-an-ioc/ioc-rule-details.md): Review IOC rule fields, match status, and issue-generation details. - [Create an IOC rule](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/threat-management/detection-rules/what-are-detection-rules/whats-an-ioc/create-an-ioc-rule.md): Create an IOC rule to detect known malicious or suspicious artifacts. - [What's a BIOC?](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/threat-management/detection-rules/what-are-detection-rules/whats-a-bioc.md): Learn how BIOC rules detect suspicious behavior across endpoint and network activity. - [BIOC rule details](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/threat-management/detection-rules/what-are-detection-rules/whats-a-bioc/bioc-rule-details.md): Review BIOC rule fields, exceptions, and status for user-defined and global rules. - [Create a BIOC rule](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/threat-management/detection-rules/what-are-detection-rules/whats-a-bioc/create-a-bioc-rule.md): Create a BIOC rule to detect suspicious behavior in your environment. - [Manage Global BIOC Rules](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/threat-management/detection-rules/what-are-detection-rules/whats-a-bioc/manage-global-bioc-rules.md): View and manage Palo Alto Networks global BIOC rules in your tenant. - [What's a correlation rule?](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/threat-management/detection-rules/what-are-detection-rules/whats-a-correlation-rule.md): Learn how correlation rules use XQL to identify relationships across security events. - [Correlation rule details](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/threat-management/detection-rules/what-are-detection-rules/whats-a-correlation-rule/correlation-rule-details.md): Review correlation rule fields, schedules, errors, and XQL query settings. - [Create a correlation rule](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/threat-management/detection-rules/what-are-detection-rules/whats-a-correlation-rule/create-a-correlation-rule.md): Create a correlation rule using XQL to identify related security events. - [Field replacement syntax in correlation rules](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/threat-management/detection-rules/what-are-detection-rules/whats-a-correlation-rule/field-replacement-syntax-in-correlation-rules.md): Use field replacement syntax to insert event values into correlation rule results. - [Manage correlation rules](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/threat-management/detection-rules/what-are-detection-rules/whats-a-correlation-rule/manage-correlation-rules.md): View, edit, enable, disable, import, export, and delete correlation rules. - [Monitor correlation rules](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/threat-management/detection-rules/what-are-detection-rules/whats-a-correlation-rule/monitor-correlation-rules.md): Monitor correlation rule executions, issues, and processing status. - [Troubleshoot server errors in scheduled correlation rules](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/threat-management/detection-rules/what-are-detection-rules/whats-a-correlation-rule/troubleshoot-server-errors-in-scheduled-correlation-rules.md): Resolve server errors that affect scheduled correlation rule execution. - [Manage IOC and BIOC rules](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/threat-management/detection-rules/what-are-detection-rules/manage-ioc-and-bioc-rules.md): View, edit, enable, disable, and delete IOC and BIOC rules. - [Analytics](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/threat-management/analytics.md): Learn how Analytics detects anomalous activity and generates security issues. - [Analytics overview](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/threat-management/analytics/analytics-overview.md): Cortex Cloud uses an Analytics engine to examine logs and data from your sensors. - [Analytics engine](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/threat-management/analytics/analytics-engine.md): Learn how the Analytics engine builds behavior baselines and detects anomalies. - [Analytics sensors](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/threat-management/analytics/analytics-sensors.md): Review the sensors and data sources that provide Analytics detection data. - [Coverage of MITRE Attack tactics](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/threat-management/analytics/coverage-of-mitre-attack-tactics.md): Explore the MITRE ATT\&CK tactics that Analytics can detect. - [Review MITRE ATT\&CK framework coverage](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/threat-management/analytics/review-mitre-att-and-ck-framework-coverage.md): Review Cortex Cloud detection coverage across the MITRE ATT\&CK framework. - [Analytics detection time intervals](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/threat-management/analytics/analytics-detection-time-intervals.md): Understand detector time intervals used to baseline and identify suspicious activity. - [Analytics issues and Analytics BIOCs](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/threat-management/analytics/analytics-issues-and-analytics-biocs.md): Learn how Analytics issues and BIOCs identify anomalous and suspicious activity. - [View and manage Analytics rules](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/threat-management/analytics/view-and-manage-analytics-rules.md): View, filter, and manage XDR Analytics and Analytics BIOC rules. - [Identity Analytics](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/threat-management/analytics/identity-analytics.md): Investigate suspicious user activity with Identity Analytics profiles, issues, and BIOCs. - [AI Detection & Response in Cortex Cloud](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/threat-management/analytics/ai-detection-and-response-in-cortex-cloud.md): Detect, investigate, and respond to AI-specific security threats in Cortex Cloud. - [Data sources and supported services](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/threat-management/analytics/ai-detection-and-response-in-cortex-cloud/data-sources-and-supported-services.md): Review data sources and AI services supported by AI Detection & Response. - [Collect prompt logs](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/threat-management/analytics/ai-detection-and-response-in-cortex-cloud/collect-prompt-logs.md): Collect prompt logs to detect and investigate AI-related security threats. - [Prompt log collection in AWS](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/threat-management/analytics/ai-detection-and-response-in-cortex-cloud/collect-prompt-logs/prompt-log-collection-in-aws.md): Configure prompt log collection for supported AWS AI services. - [Enable prompt log collection in Azure](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/threat-management/analytics/ai-detection-and-response-in-cortex-cloud/collect-prompt-logs/enable-prompt-log-collection-in-azure.md): Enable prompt log collection from supported Azure AI services. - [Configure the Azure Event Hub collection in Cortex Cloud](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/threat-management/analytics/ai-detection-and-response-in-cortex-cloud/collect-prompt-logs/enable-prompt-log-collection-in-azure/configure-the-azure-event-hub-collection-in-cortex-cloud.md): Configure Azure Event Hub collection for AI Detection & Response prompt logs. - [Set up prompt logging](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/threat-management/analytics/ai-detection-and-response-in-cortex-cloud/collect-prompt-logs/enable-prompt-log-collection-in-azure/set-up-prompt-logging.md): Set up Azure AI service prompt logging for AI Detection & Response. - [Log HTTP data](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/threat-management/analytics/ai-detection-and-response-in-cortex-cloud/collect-prompt-logs/enable-prompt-log-collection-in-azure/log-http-data.md): Configure HTTP data logging for Azure prompt log collection. - [Configure diagnostic settings:](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/threat-management/analytics/ai-detection-and-response-in-cortex-cloud/collect-prompt-logs/enable-prompt-log-collection-in-azure/configure-diagnostic-settings.md): Configure Azure diagnostic settings to send prompt logs to Event Hub. - [Identity Threat Detection and Response (ITDR)](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/threat-management/identity-threat-module-itdr.md): Detect identity threats, manage posture, and enforce directory protections. - [Get started with ITDR](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/threat-management/identity-threat-module-itdr/get-started-with-itdr.md): Activate ITDR and configure Identity Profiles for Domain Controller protection. - [Manage role based access control (RBAC) in ITDR](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/threat-management/identity-threat-module-itdr/manage-role-based-access-control-rbac-in-itdr.md): Assign ITDR permissions for Conditional Access and Identity Security Runtime features. - [Monitor user risk exposure](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/threat-management/identity-threat-module-itdr/monitor-user-risk-exposure.md): Use the Risk Management dashboard to assess identity threat exposure. - [Investigate user risk](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/threat-management/identity-threat-module-itdr/investigate-user-risk.md): Investigate user identity activity, risk scores, and related security issues. - [Manage user asset roles](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/threat-management/identity-threat-module-itdr/asset-roles.md): Classify users into asset roles and fine-tune role memberships. - [Improve Active Directory posture with AD-SPM](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/threat-management/identity-threat-module-itdr/active-directory-security-posture-management.md): Detect Active Directory misconfigurations and remediate identity security risks. - [Enforce dynamic access control with CAP](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/threat-management/identity-threat-module-itdr/conditional-access-policy.md): Create risk-based access rules that allow, block, or require MFA. - [Prevent malicious LDAP queries](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/threat-management/identity-threat-module-itdr/prevent-malicious-ldap-queries.md): Detect and block LDAP reconnaissance against Active Directory domain controllers. - [Overview](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/web-and-api-security-waas/overview.md): Protect APIs and web applications through discovery, posture management, and threat detection. - [Personas workflow](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/web-and-api-security-waas/personas-workflow.md): Cortex API security distributes responsibilities across SOC analysts, security practitioners, and workload owners. - [Secure your API landscape](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/web-and-api-security-waas/secure-your-api-landscape.md): Integrate API gateways to monitor API traffic, assess risks, and enforce security. - [Gain visibility and assess risk of API endpoints](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/web-and-api-security-waas/secure-your-api-landscape/gain-visibility-and-assess-risk-of-api-endpoints.md): Discover API endpoints, assess risk, and investigate endpoint details across your environment. - [Monitor and investigate API threats](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/web-and-api-security-waas/secure-your-api-landscape/monitor-and-investigate-api-threats.md): Detect, investigate, and respond to API threats with SOC analyst workflows. - [Configure API security from end to end](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/web-and-api-security-waas/secure-your-api-landscape/configure-api-security-from-end-to-end.md): Secure your API landscape through third-party integrations and agent-based protection policies. - [API specification inventory](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/web-and-api-security-waas/secure-your-api-landscape/api-specification-inventory.md): Import OpenAPI specifications, assess vulnerabilities, and validate live API traffic. - [Asset management](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/asset-managment/asset-management.md): View and manage assets across your environment from a unified inventory. - [Asset inventory overview](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/asset-managment/asset-inventory-overview.md): Learn about the core concepts, features, and lifecycle of assets within the Asset Inventory. - [All assets](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/asset-managment/all-assets.md): Learn about the All Assets page, under Asset Inventory. - [All cloud assets](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/asset-managment/all-cloud-assets.md): Learn about the All Cloud Assets page to view and assess your cloud footprint. - [Discovery Engine](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/asset-managment/all-cloud-assets/discovery-engine.md): Discover cloud resources and keep the unified asset inventory current. - [Asset hierarchy](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/asset-managment/all-cloud-assets/asset-hierarchy.md): Use cloud hierarchy paths to filter assets, groups, and scoped access. - [Asset classes](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/asset-managment/asset-classes.md): Accelerating remediation: Automated fix suggestions and manual remediation guidance enable developers to resolve code weaknesses directly in the source repository without context-switching to external - [AI assets](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/asset-managment/asset-classes/ai-assets.md): Review AI assets, relationships, data exposure, and security risks. - [API assets](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/asset-managment/asset-classes/api-assets.md): Inspect API endpoints and specifications, including traffic, authentication, and risk details. - [Application assets](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/asset-managment/asset-classes/application-assets.md): Manage business applications, connected assets, and security risk across the SDLC. - [Code and CI/CD assets](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/asset-managment/asset-classes/code-and-ci-cd-assets.md): Track code and CI/CD assets to secure your software supply chain. - [IaC resources assets](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/asset-managment/asset-classes/code-and-ci-cd-assets/iac-resources-assets.md): View Infrastructure-as-Code resources and their related configuration risks. - [Repository assets](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/asset-managment/asset-classes/code-and-ci-cd-assets/repository-assets.md): Track source repositories and their code security posture. - [VCS organization assets](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/asset-managment/asset-classes/code-and-ci-cd-assets/vcs-organization-assets.md): View version control organizations and their related repositories. - [CI/CD pipeline assets](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/asset-managment/asset-classes/code-and-ci-cd-assets/ci-cd-pipeline-assets.md): Track automated pipelines that build, test, and deploy software. - [CI/CD instances assets](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/asset-managment/asset-classes/code-and-ci-cd-assets/ci-cd-instances-assets.md): View CI/CD platform instances that run your delivery pipelines. - [Software package assets](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/asset-managment/asset-classes/code-and-ci-cd-assets/software-package-assets.md): Track software packages, vulnerabilities, licenses, and operational risks. - [Compute assets](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/asset-managment/asset-classes/compute-assets.md): View compute resources across cloud, container, serverless, and endpoint environments. - [Container image assets](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/asset-managment/asset-classes/compute-assets/container-image-assets.md): Inspect immutable container images and their security findings. - [Serverless functions assets](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/asset-managment/asset-classes/compute-assets/serverless-functions-assets.md): Monitor serverless functions for vulnerabilities, malware, secrets, and configuration risks. - [VM images assets](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/asset-managment/asset-classes/compute-assets/vm-images-assets.md): Track machine images used by your virtualized infrastructure. - [Data assets](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/asset-managment/asset-classes/data-assets.md): Discover and manage data assets across your cloud environment. - [Device assets](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/asset-managment/asset-classes/device-assets.md): View managed endpoint devices and their security status. - [External Surface assets](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/asset-managment/asset-classes/external-surface-assets.md): View internet-facing assets attributed to your organization. - [Website assets](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/asset-managment/asset-classes/external-surface-assets/website-assets.md): Inspect externally discovered websites and their technology and security details. - [Service assets](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/asset-managment/asset-classes/external-surface-assets/service-assets.md): Track exposed internet services, classifications, and inferred vulnerabilities. - [Domain assets](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/asset-managment/asset-classes/external-surface-assets/domain-assets.md): View domains and subdomains attributed to your organization. - [Certificate assets](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/asset-managment/asset-classes/external-surface-assets/certificate-assets.md): Monitor certificates for expiration, cryptographic health, and configuration issues. - [External Surface attribution evidence](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/asset-managment/asset-classes/external-surface-assets/external-surface-attribution-evidence.md): Review evidence supporting external asset attribution to your organization. - [Identity assets](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/asset-managment/asset-classes/identity-assets.md): View identity assets and their access relationships across your environment. - [Network assets](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/asset-managment/asset-classes/network-assets.md): View network assets and their connectivity and exposure context. - [Security services assets](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/asset-managment/asset-classes/security-services-assets.md): Track security services and their configurations across cloud environments. - [Asset groups](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/asset-managment/asset-groups.md): Group assets based on shared attributes to address them collectively, simplify filtering, and enable strict access control boundaries. - [Manage Risk Scores](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/asset-managment/manage-asset-scores.md): View and investigate User Scores and Host Scores using the Risk Scores page to identify high-risk assets and detect compromised accounts or malicious activities. - [Asset configurations](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/asset-managment/asset-configurations.md): Configure network context, application criteria, and asset roles. - [Network configuration](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/asset-managment/asset-configurations/network-configuration.md): Configure your internal network parameters, trusted networks, and external IP ranges to help Cortex Cloud identify and map your network assets. - [Application criteria](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/asset-managment/asset-configurations/application-criteria.md): Create applications manually or maintain them automatically with dynamic criteria. - [Asset Roles](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/asset-managment/asset-configurations/asset-roles.md): View asset roles and the number of assets that are associated with each role. Learn how to manage asset roles for users and endpoints. - [Manage Asset Roles for Endpoints](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/asset-managment/asset-configurations/asset-roles/manage-asset-roles-for-endpoints.md): Include or exclude endpoints from detected asset roles. - [Manage Asset Roles for Users](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/asset-managment/asset-configurations/asset-roles/manage-asset-roles-for-users.md): Include or exclude users from detected asset roles. - [Honey user](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/asset-managment/asset-configurations/asset-roles/manage-asset-roles-for-users/honey-user.md): Configure decoy user accounts that alert on suspicious access. - [Overview of cases](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cases-and-issues/overview-of-cases.md): Understand cases, their lifecycle, scope, impact, and ownership. - [What are cases?](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cases-and-issues/overview-of-cases/what-are-cases.md): Learn how cases group related security issues for investigation and response. - [Resolving cases with AI](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cases-and-issues/overview-of-cases/resolving-cases-with-ai.md): Use AI assistance to investigate and resolve security cases faster. - [Case lifecycle](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cases-and-issues/overview-of-cases/case-lifecycle.md): Understand the stages and status changes in a case lifecycle. - [Case thresholds](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cases-and-issues/overview-of-cases/case-thresholds.md): Configure thresholds that determine when Cortex Cloud creates or updates cases. - [Case scope and impact](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cases-and-issues/overview-of-cases/case-scope-and-impact.md): Understand how case scope and impact reflect affected entities and risk. - [Case and issue domains](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cases-and-issues/overview-of-cases/case-and-issue-domains.md): Understand domains used to classify cases and issues. - [Overview of case teams and roles](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cases-and-issues/overview-of-cases/overview-of-case-teams-and-roles.md): Learn how teams and roles organize investigation access and responsibilities. - [Case concepts](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cases-and-issues/case-concepts.md): Learn the core concepts that define cases, issues, and investigation context. - [Issues, findings, and events](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cases-and-issues/case-concepts/issues-findings-and-events.md): Understand how issues, findings, and events contribute to case investigations. - [Case grouping](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cases-and-issues/case-concepts/case-grouping.md): Learn how Cortex Cloud groups related issues into cases. - [Case scoring](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cases-and-issues/case-concepts/case-scoring.md): Understand how case scores prioritize investigations by risk and severity. - [What is Causality?](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cases-and-issues/case-concepts/what-is-causality.md): Understand causality relationships that connect events, assets, and security issues. - [Analyze and resolve cases](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cases-and-issues/analyze-and-resolve-cases.md): Learn how to analyze and resolve cases. - [Review all cases](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cases-and-issues/analyze-and-resolve-cases/review-all-cases.md): View, filter, and prioritize cases across your environment. - [Start case analysis](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cases-and-issues/analyze-and-resolve-cases/start-case-analysis.md): Begin a case investigation and assess its initial context. - [Agentic Assistant- Case Investigation agent](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cases-and-issues/analyze-and-resolve-cases/start-case-analysis/agentic-assistant-case-investigation-agent.md): Use the Case Investigation agent to accelerate AI-assisted case analysis. - [Establish case context](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cases-and-issues/analyze-and-resolve-cases/establish-case-context.md): Build investigation context from case details, risk, and related activity. - [AI-generated case summaries](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cases-and-issues/analyze-and-resolve-cases/establish-case-context/ai-generated-case-summaries.md): Use AI-generated summaries to understand case details and priorities quickly. - [Assess case severity and score](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cases-and-issues/analyze-and-resolve-cases/establish-case-context/assess-case-severity-and-score.md): Review and adjust case severity and score during an investigation. - [Update case attributes](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cases-and-issues/analyze-and-resolve-cases/establish-case-context/update-case-attributes.md): Update case fields to keep investigation details accurate. - [Analyze case details](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cases-and-issues/analyze-and-resolve-cases/analyze-case-details.md): Review case evidence, relationships, and activity to guide your investigation. - [Grouping graph](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cases-and-issues/analyze-and-resolve-cases/analyze-case-details/grouping-graph.md): Explore relationships among issues grouped within a case. - [Evidence](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cases-and-issues/analyze-and-resolve-cases/analyze-case-details/evidence.md): Review evidence that supports the case investigation. - [Issue feed](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cases-and-issues/analyze-and-resolve-cases/analyze-case-details/issue-feed.md): Track issues and updates associated with a case. - [Associated assets and artifacts](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cases-and-issues/analyze-and-resolve-cases/analyze-case-details/associated-assets-and-artifacts.md): Review assets and artifacts associated with a case. - [MITRE ATT\&CK tactics and techniques](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cases-and-issues/analyze-and-resolve-cases/analyze-case-details/mitre-att-and-ck-tactics-and-techniques.md): Map case activity to relevant MITRE ATT\&CK tactics and techniques. - [Compliance standards and controls](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cases-and-issues/analyze-and-resolve-cases/analyze-case-details/compliance-standards-and-controls.md): Review compliance standards and controls related to a case. - [Case timeline](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cases-and-issues/analyze-and-resolve-cases/analyze-case-details/case-timeline.md): Review a chronological view of case activity and updates. - [Detailed view](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cases-and-issues/analyze-and-resolve-cases/analyze-case-details/detailed-view.md): Open detailed case information for deeper analysis. - [Resolve the case](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cases-and-issues/analyze-and-resolve-cases/resolve-the-case.md): Complete case resolution and document the investigation outcome. - [Resolution Center](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cases-and-issues/analyze-and-resolve-cases/resolve-the-case/resolution-center.md): Use Resolution Center to manage and complete case resolution. - [Collaborative notes and comments](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cases-and-issues/analyze-and-resolve-cases/resolve-the-case/collaborative-notes-and-comments.md): Add notes and comments to collaborate during a case investigation. - [How to resolve a case](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cases-and-issues/analyze-and-resolve-cases/resolve-the-case/resolve-a-case.md): Follow the steps to resolve a case and record its outcome. - [Resolution reasons for cases and issues](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cases-and-issues/analyze-and-resolve-cases/resolve-the-case/resolution-reasons-for-cases-and-issues.md): Select resolution reasons for cases and issues. - [Monitor and track resolution times](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cases-and-issues/analyze-and-resolve-cases/resolve-the-case/monitor-and-track-resolution-times.md): Monitor case resolution times against configured service-level objectives. - [Additional case actions](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cases-and-issues/analyze-and-resolve-cases/additional-case-actions.md): Perform additional actions to create, merge, assign, and manage cases. - [Create a case](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cases-and-issues/analyze-and-resolve-cases/additional-case-actions/create-a-case.md): Create a case to investigate related security activity. - [Merge a case](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cases-and-issues/analyze-and-resolve-cases/additional-case-actions/merge-a-case.md): Merge related cases into a single investigation. - [Assign a case team and restrict access](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cases-and-issues/analyze-and-resolve-cases/additional-case-actions/assign-a-case-team-and-restrict-access.md): Assign teams and control access to sensitive cases. - [Playbook examples](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cases-and-issues/analyze-and-resolve-cases/additional-case-actions/assign-a-case-team-and-restrict-access/playbook-examples.md): Explore playbook examples for case teams and access restrictions. - [Investigation and response](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cases-and-issues/investigation-and-response.md): Investigate threats and respond using cases, automation, and endpoint actions. - [Investigate issues](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cases-and-issues/investigation-and-response/investigate-issues.md): Cortex Cloud generates issues to bring your attention to security risks in your framework. - [Overview of the Issues page](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cases-and-issues/investigation-and-response/investigate-issues/overview-of-the-issues-page.md): Learn how to review and manage security issues. - [Issue card](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cases-and-issues/investigation-and-response/investigate-issues/issue-card.md): Understand the information and actions available on an issue card. - [Resolution actions](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cases-and-issues/investigation-and-response/investigate-issues/resolution-actions.md): Resolve issues using available resolution actions. - [Link or unlink issues from a case](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cases-and-issues/investigation-and-response/investigate-issues/link-or-unlink-issues-from-a-case.md): Manage issue associations within a case investigation. - [Run an automation on an issue](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cases-and-issues/investigation-and-response/investigate-issues/run-an-automation-on-an-issue.md): Run an automation to investigate or remediate an issue. - [Use the War Room in an investigation](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cases-and-issues/investigation-and-response/investigate-issues/use-the-war-room-in-an-investigation.md): Use the War Room to coordinate and document an investigation. - [Use the Work Plan in an investigation](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cases-and-issues/investigation-and-response/investigate-issues/use-the-work-plan-in-an-investigation.md): Use a Work Plan to organize investigation tasks and progress. - [Issue syncing](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cases-and-issues/investigation-and-response/investigate-issues/issue-syncing.md): Configure issue synchronization with external systems. - [Issue deduplication](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cases-and-issues/investigation-and-response/investigate-issues/issue-deduplication.md): Understand how Cortex Cloud identifies and deduplicates similar issues. - [Causality view](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cases-and-issues/investigation-and-response/investigate-issues/causality-view.md): Explore the causal relationships behind a security issue. - [Cloud causality view](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cases-and-issues/investigation-and-response/investigate-issues/causality-view/cloud-causality-view.md): Investigate causal relationships for cloud security issues. - [Cloud causality view for audit log issues](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cases-and-issues/investigation-and-response/investigate-issues/causality-view/cloud-causality-view-for-audit-log-issues.md): Investigate cloud attacks faster with entity context directly in the Cloud causality view. - [SaaS causality view](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cases-and-issues/investigation-and-response/investigate-issues/causality-view/saas-causality-view.md): Investigate causal relationships for SaaS security issues. - [Network causality view](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cases-and-issues/investigation-and-response/investigate-issues/causality-view/network-causality-view.md): Investigate causal relationships for network security issues. - [Timeline](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cases-and-issues/investigation-and-response/investigate-issues/causality-view/timeline.md): Review the sequence of events that contributed to an issue. - [Causality icons key](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cases-and-issues/investigation-and-response/investigate-issues/causality-view/causality-icons-key.md): Identify icons used in causality views. - [Issue investigation actions](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cases-and-issues/investigation-and-response/investigate-issues/issue-investigation-actions.md): Perform actions that enrich, update, and investigate issues. - [Copy issues](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cases-and-issues/investigation-and-response/investigate-issues/issue-investigation-actions/copy-issues.md): Copy issue details for analysis or sharing. - [Update issue fields](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cases-and-issues/investigation-and-response/investigate-issues/issue-investigation-actions/update-issue-fields.md): Update issue fields to maintain accurate investigation context. - [Create profile exceptions](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cases-and-issues/investigation-and-response/investigate-issues/issue-investigation-actions/create-profile-exceptions.md): Create profile exceptions for trusted or expected activity. - [Investigate contributing events](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cases-and-issues/investigation-and-response/investigate-issues/issue-investigation-actions/investigate-contributing-events.md): Review events that contributed to an issue. - [Create a featured field](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cases-and-issues/investigation-and-response/investigate-issues/issue-investigation-actions/create-a-featured-field.md): Create a featured field to surface important issue details. - [View generating BIOC or IOC rule](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cases-and-issues/investigation-and-response/investigate-issues/issue-investigation-actions/view-generating-bioc-or-ioc-rule.md): View the BIOC or IOC rule that generated an issue. - [Add a file path to a malware profile allow list](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cases-and-issues/investigation-and-response/investigate-issues/issue-investigation-actions/add-a-file-path-to-a-malware-profile-allow-list.md): Add trusted file paths to a malware profile allow list. - [Retrieve additional issue details](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cases-and-issues/investigation-and-response/investigate-issues/issue-investigation-actions/retrieve-additional-issue-details.md): Retrieve additional details to support issue investigation. - [Export issue details to a file](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cases-and-issues/investigation-and-response/investigate-issues/issue-investigation-actions/export-issue-details-to-a-file.md): Export issue details for external analysis or record keeping. - [Exclude an issue](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cases-and-issues/investigation-and-response/investigate-issues/issue-investigation-actions/exclude-an-issue.md): Exclude an issue from future investigation workflows. - [Query case and issue data](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cases-and-issues/investigation-and-response/investigate-issues/issue-investigation-actions/query-case-and-issue-data.md): Query case and issue data for investigation and reporting. - [Review findings](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cases-and-issues/investigation-and-response/review-findings.md): Review findings for an asset to gain insights into an asset’s posture status. - [Findings card](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cases-and-issues/investigation-and-response/review-findings/findings-card.md): Understand the information and actions available on a findings card. - [Investigate artifacts and assets](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cases-and-issues/investigation-and-response/investigate-artifacts-and-assets.md): You can investigate specific artifacts and assets on dedicated views related to IP address, Network Assets, and File and Process Hash information. - [Investigate an IP address](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cases-and-issues/investigation-and-response/investigate-artifacts-and-assets/investigate-an-ip-address.md): Investigate IP address activity and related security context. - [Investigate an asset](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cases-and-issues/investigation-and-response/investigate-artifacts-and-assets/investigate-an-asset.md): Investigate an asset and its related security activity. - [Investigate a file and process hash](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cases-and-issues/investigation-and-response/investigate-artifacts-and-assets/investigate-a-file-and-process-hash.md): Investigate file and process hashes for malicious activity. - [Investigate a user](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cases-and-issues/investigation-and-response/investigate-artifacts-and-assets/investigate-a-user.md): Investigate user activity and related security context. - [Investigate endpoints](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cases-and-issues/investigation-and-response/investigate-endpoints.md): Investigate endpoints and take response actions when needed. - [Overview of the Action Center](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cases-and-issues/investigation-and-response/investigate-endpoints/overview-of-the-action-center.md): Learn how to initiate and monitor endpoint response actions. - [Initiate and monitor endpoint actions](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cases-and-issues/investigation-and-response/investigate-endpoints/overview-of-the-action-center/initiate-and-monitor-endpoint-actions.md): Initiate endpoint actions and monitor their progress. - [Action Center reference information](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cases-and-issues/investigation-and-response/investigate-endpoints/overview-of-the-action-center/action-center-reference-information.md): Review available Action Center fields, statuses, and actions. - [Manage endpoints](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cases-and-issues/investigation-and-response/investigate-endpoints/manage-endpoints.md): View and manage endpoints in your environment. - [Retrieve files from an endpoint](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cases-and-issues/investigation-and-response/investigate-endpoints/retrieve-files-from-an-endpoint.md): Retrieve files from an endpoint for investigation. - [Retrieve support logs from an endpoint](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cases-and-issues/investigation-and-response/investigate-endpoints/retrieve-support-logs-from-an-endpoint.md): Collect endpoint support logs for troubleshooting. - [Scan an endpoint for malware](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cases-and-issues/investigation-and-response/investigate-endpoints/scan-an-endpoint-for-malware.md): Run a malware scan on an endpoint. - [Investigate files](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cases-and-issues/investigation-and-response/investigate-files.md): Investigate files and manage execution or quarantine actions. - [Manage file execution](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cases-and-issues/investigation-and-response/investigate-files/manage-file-execution.md): Manage file execution decisions during an investigation. - [Manage quarantined files](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cases-and-issues/investigation-and-response/investigate-files/manage-quarantined-files.md): Review and manage files placed in quarantine. - [Review WildFire analysis details](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cases-and-issues/investigation-and-response/investigate-files/review-wildfire-analysis-details.md): Review WildFire analysis results for a file. - [Import file hash exceptions](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cases-and-issues/investigation-and-response/investigate-files/import-file-hash-exceptions.md): Import file hash exceptions into Cortex Cloud. - [Cortex Assistant](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cases-and-issues/investigation-and-response/cortex-assistant.md): Cortex Assistant is designed to streamline processes by simplifying case triaging, investigation, and remediation. It enables you to seamlessly uncover new insights on hashes, hosts, and more. You can - [Cortex Assistant layout](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cases-and-issues/investigation-and-response/cortex-assistant/cortex-assistant-layout.md): Understand the Cortex Assistant interface and available controls. - [Cortex Assistant capabilities](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cases-and-issues/investigation-and-response/cortex-assistant/cortex-assistant-capabilities.md): Explore the tasks Cortex Assistant can help you complete. - [Automation](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cases-and-issues/investigation-and-response/automation.md): Automate investigation and response workflows in Cortex Cloud. - [Quick Actions](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cases-and-issues/investigation-and-response/automation/quick-actions.md): Run quick actions to automate common investigation tasks. - [Automation Exclusion Center](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cases-and-issues/investigation-and-response/automation/automation-exclusion-center.md): Manage exclusions that prevent automation from running. - [Manage automation exclusion policies](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cases-and-issues/investigation-and-response/automation/manage-automation-exclusion-policies.md): Create and manage policies that exclude automated actions. - [Playbooks](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cases-and-issues/investigation-and-response/automation/playbooks.md): Build and manage playbooks for automated workflows. - [Playbooks overview](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cases-and-issues/investigation-and-response/automation/playbooks/playbooks-overview.md): Learn how playbooks automate investigation and response processes. - [Access to playbooks](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cases-and-issues/investigation-and-response/automation/playbooks/access-to-playbooks.md): Manage access to playbooks and their content. - [Playbook development checklist](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cases-and-issues/investigation-and-response/automation/playbooks/playbook-development-checklist.md): Follow a checklist when planning and building playbooks. - [Plan your playbook](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cases-and-issues/investigation-and-response/automation/playbooks/plan-your-playbook.md): Plan the purpose, inputs, and flow of your playbook. - [Manage playbooks](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cases-and-issues/investigation-and-response/automation/playbooks/manage-playbooks.md): Create, organize, and maintain playbooks. - [Build your playbook](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cases-and-issues/investigation-and-response/automation/playbooks/build-your-playbook.md): Build a playbook by configuring tasks, logic, and settings. - [Choose from existing playbooks or create your own](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cases-and-issues/investigation-and-response/automation/playbooks/build-your-playbook/choose-from-existing-playbooks-or-create-your-own.md): Select a template or create a playbook from scratch. - [Configure playbook settings](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cases-and-issues/investigation-and-response/automation/playbooks/build-your-playbook/configure-playbook-settings.md): Configure playbook settings, inputs, and execution behavior. - [Add objects from the Task Library](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cases-and-issues/investigation-and-response/automation/playbooks/build-your-playbook/add-objects-from-the-task-library.md): Add reusable tasks from the Task Library to a playbook. - [Add commands and scripts](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cases-and-issues/investigation-and-response/automation/playbooks/build-your-playbook/add-objects-from-the-task-library/add-commands-and-scripts.md): Add command and script tasks to a playbook. - [Add sub-playbooks](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cases-and-issues/investigation-and-response/automation/playbooks/build-your-playbook/add-objects-from-the-task-library/add-sub-playbooks.md): Add sub-playbooks to reuse automation workflows. - [Add AI Prompt tasks](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cases-and-issues/investigation-and-response/automation/playbooks/build-your-playbook/add-objects-from-the-task-library/add-ai-prompt-tasks.md): Add AI Prompt tasks to automate AI-assisted workflows. - [Add manual tasks and blank tasks](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cases-and-issues/investigation-and-response/automation/playbooks/build-your-playbook/add-objects-from-the-task-library/add-manual-tasks-and-blank-tasks.md): Add manual and blank tasks to a playbook. - [Create a standard task](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cases-and-issues/investigation-and-response/automation/playbooks/build-your-playbook/add-objects-from-the-task-library/add-manual-tasks-and-blank-tasks/create-a-standard-task.md): Define a Standard task in Cortex Cloud. - [Create a conditional task](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cases-and-issues/investigation-and-response/automation/playbooks/build-your-playbook/add-objects-from-the-task-library/add-manual-tasks-and-blank-tasks/create-a-conditional-task.md): Create a Conditional task in a playbook. - [Create a communication task](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cases-and-issues/investigation-and-response/automation/playbooks/build-your-playbook/add-objects-from-the-task-library/add-manual-tasks-and-blank-tasks/create-a-communication-task.md): Communication tasks let you send surveys and collect issue data. - [Create a section header](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cases-and-issues/investigation-and-response/automation/playbooks/build-your-playbook/create-a-section-header.md): Add section headers to organize playbook tasks. - [Configure script error handling in a playbook](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cases-and-issues/investigation-and-response/automation/playbooks/build-your-playbook/configure-script-error-handling-in-a-playbook.md): Configure how a playbook handles script execution errors. - [Customize your playbook](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cases-and-issues/investigation-and-response/automation/playbooks/build-your-playbook/customize-your-playbook.md): Customize playbook behavior, data handling, and task flow. - [Configure a sub-playbook loop](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cases-and-issues/investigation-and-response/automation/playbooks/build-your-playbook/customize-your-playbook/configure-a-sub-playbook-loop.md): Configure loops that run a sub-playbook for each item. - [Filter and Transform data](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cases-and-issues/investigation-and-response/automation/playbooks/build-your-playbook/customize-your-playbook/filter-and-transform-data.md): Filter and transform data within a playbook. - [Create custom filter and transformers](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cases-and-issues/investigation-and-response/automation/playbooks/build-your-playbook/customize-your-playbook/create-custom-filter-and-transformers.md): Create custom filters and transformers for playbook data. - [Filter considerations, categories, and built-in filters](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cases-and-issues/investigation-and-response/automation/playbooks/build-your-playbook/customize-your-playbook/filter-considerations-categories-and-built-in-filters.md): Understand filter categories and built-in filters. - [Transformer considerations, categories, and built-in transformers](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cases-and-issues/investigation-and-response/automation/playbooks/build-your-playbook/customize-your-playbook/transformer-considerations-categories-and-built-in-transformers.md): Understand transformer categories and built-in transformers. - [Extend context](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cases-and-issues/investigation-and-response/automation/playbooks/build-your-playbook/customize-your-playbook/extend-context.md): Extend playbook context with additional investigation data. - [Extract Indicators](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cases-and-issues/investigation-and-response/automation/playbooks/build-your-playbook/customize-your-playbook/extract-indicators.md): Extract indicators from data during a playbook run. - [Update issue fields with playbook tasks](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cases-and-issues/investigation-and-response/automation/playbooks/build-your-playbook/customize-your-playbook/update-issue-fields-with-playbook-tasks.md): Update issue fields using tasks in a playbook. - [Test your playbook](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cases-and-issues/investigation-and-response/automation/playbooks/build-your-playbook/test-your-playbook.md): Set breakpoints, conditional breakpoints, skips, and input or output overrides in the playbook debugger. - [Troubleshoot playbook performance](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cases-and-issues/investigation-and-response/automation/playbooks/build-your-playbook/test-your-playbook/troubleshoot-playbook-performance.md): Diagnose and improve playbook execution performance. - [Manage playbook content](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cases-and-issues/investigation-and-response/automation/playbooks/build-your-playbook/manage-playbook-content.md): Manage the tasks, scripts, and settings in a playbook. - [Accelerate playbook development using the Agentic Playbook Builder (preview)](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cases-and-issues/investigation-and-response/automation/playbooks/accelerate-playbook-development-using-the-agentic-playbook-builder-preview.md): Use the Agentic Playbook Builder (preview) in Cortex Cloud to create, optimize, and troubleshoot playbooks using natural language and security best practices. - [Agentic Playbook Builder prompt examples](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cases-and-issues/investigation-and-response/automation/playbooks/accelerate-playbook-development-using-the-agentic-playbook-builder-preview/agentic-playbook-builder-prompt-examples.md): Use Agentic Playbook Builder prompt examples to generate Cortex Cloud security response playbooks for triage, enrichment, and remediation. - [Best practices for playbooks](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cases-and-issues/investigation-and-response/automation/playbooks/best-practices-for-playbooks.md): Apply recommended practices when designing and maintaining playbooks. - [AI Prompts](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cases-and-issues/investigation-and-response/automation/ai-prompts.md): Create and manage AI prompts for automated workflows. - [AI prompts role-based access control](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cases-and-issues/investigation-and-response/automation/ai-prompts/ai-prompts-role-based-access-control.md): Manage AI prompt permissions with role-based access control. - [Use existing prompts](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cases-and-issues/investigation-and-response/automation/ai-prompts/use-existing-prompts.md): Find, duplicate, and edit prompts from the Prompts Library. - [Create a prompt](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cases-and-issues/investigation-and-response/automation/ai-prompts/create-a-prompt.md): Create or edit prompts, configure settings, and use them in agents or playbooks. - [Write effective prompts](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cases-and-issues/investigation-and-response/automation/ai-prompts/write-effective-prompts.md): Tips for creating effective AI prompts. - [Create an automation rule](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cases-and-issues/investigation-and-response/automation/create-an-automation-rule.md): Learn how to create an automation rule for an issue. - [Scripts](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cases-and-issues/investigation-and-response/automation/scripts.md): Create and manage scripts for automation workflows. - [Use existing scripts](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cases-and-issues/investigation-and-response/automation/scripts/use-existing-scripts.md): Use existing scripts in playbooks and automation workflows. - [Create a script](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cases-and-issues/investigation-and-response/automation/scripts/create-a-script.md): Create a custom script for automation workflows. - [Accelerate script development using the Automation Engineer agent](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cases-and-issues/investigation-and-response/automation/scripts/accelerate-script-development-using-the-automation-engineer-agent.md): Use Automation Engineer to accelerate script development. - [Change the Docker image in a script](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cases-and-issues/investigation-and-response/automation/scripts/change-the-docker-image-in-a-script.md): Configure the Docker image used by a script. - [Connect an engine to an image registry](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cases-and-issues/investigation-and-response/automation/scripts/change-the-docker-image-in-a-script/connect-an-engine-to-an-image-registry.md): Connect an engine to an image registry for script execution. - [Context data](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cases-and-issues/investigation-and-response/automation/context-data.md): Use context data to assist with the investigation and remediation process. - [Issue context data](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cases-and-issues/investigation-and-response/automation/context-data/issue-context-data.md): Understand context data stored for an issue. - [Case context data](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cases-and-issues/investigation-and-response/automation/context-data/case-context-data.md): Understand context data stored for a case. - [Search context data](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cases-and-issues/investigation-and-response/automation/context-data/search-context-data.md): Search context data across investigations. - [Add context data to an issue](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cases-and-issues/investigation-and-response/automation/context-data/add-context-data-to-an-issue.md): Add context data to an issue. - [Add context data to a case](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cases-and-issues/investigation-and-response/automation/context-data/add-context-data-to-a-case.md): Add context data to a case. - [Delete context data from a case](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cases-and-issues/investigation-and-response/automation/context-data/delete-context-data-from-a-case.md): Delete context data from a case. - [Use context data in a playbook](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cases-and-issues/investigation-and-response/automation/context-data/use-context-data-in-a-playbook.md): Use context data in playbook tasks. - [Lists](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cases-and-issues/investigation-and-response/automation/lists.md): Create and manage lists for automation workflows. - [Create a list](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cases-and-issues/investigation-and-response/automation/lists/create-a-list.md): Create a list for use in automation workflows. - [List commands](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cases-and-issues/investigation-and-response/automation/lists/list-commands.md): Use commands to manage and query lists. - [Use cases: JSON lists](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cases-and-issues/investigation-and-response/automation/lists/use-cases-json-lists.md): Use JSON lists to store structured data. - [Transform a list into an array](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cases-and-issues/investigation-and-response/automation/lists/transform-a-list-into-an-array.md): Transform a list into an array for automation tasks. - [Integrations](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cases-and-issues/investigation-and-response/automation/integrations.md): Configure integrations for automation workflows. - [Add an integration instance](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cases-and-issues/investigation-and-response/automation/integrations/add-an-integration-instance.md): Add and configure an integration instance. - [Use integration commands in the CLI](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cases-and-issues/investigation-and-response/automation/integrations/use-integration-commands-in-the-cli.md): Run integration commands from the CLI. - [Troubleshoot integations](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cases-and-issues/investigation-and-response/automation/integrations/troubleshoot-integations.md): Troubleshoot integration configuration and execution issues. - [Manage credentials](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cases-and-issues/investigation-and-response/automation/integrations/manage-credentials.md): Manage credentials used by integration instances. - [Engines](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cases-and-issues/investigation-and-response/automation/engines.md): Install, manage, configure, and troubleshoot engines. - [What is an engine?](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cases-and-issues/investigation-and-response/automation/engines/what-is-an-engine.md): Learn how engines execute automation tasks. - [Engine requirements](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cases-and-issues/investigation-and-response/automation/engines/engine-requirements.md): Hardware, OS, and required URLs for engines. - [Install an engine](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cases-and-issues/investigation-and-response/automation/engines/install-an-engine.md): Install, deploy and configure Cortex Cloud engines. - [Docker](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cases-and-issues/investigation-and-response/automation/engines/install-an-engine/docker.md): Install, configure, secure, and troubleshoot Docker for Cortex Cloud engines. - [Install Docker](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cases-and-issues/investigation-and-response/automation/engines/install-an-engine/docker/install-docker.md): Install Docker and verify engine user permissions. - [Install Docker distribution for Red Hat](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cases-and-issues/investigation-and-response/automation/engines/install-an-engine/docker/install-docker-distribution-for-red-hat.md): Configure Docker and SELinux on Red Hat engine servers. - [Docker image security](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cases-and-issues/investigation-and-response/automation/engines/install-an-engine/docker/docker-image-security.md): Secure, harden, and troubleshoot Docker images and containers. - [Docker FAQs](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cases-and-issues/investigation-and-response/automation/engines/install-an-engine/docker/docker-faqs.md) - [Troubleshoot Docker Issues](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cases-and-issues/investigation-and-response/automation/engines/install-an-engine/docker/troubleshoot-docker-issues.md) - [Configure Docker pull rate limit](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cases-and-issues/investigation-and-response/automation/engines/install-an-engine/docker/configure-docker-pull-rate-limit.md) - [Change the Docker Installation folder](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cases-and-issues/investigation-and-response/automation/engines/install-an-engine/docker/change-the-docker-installation-folder.md) - [Docker hardening guide](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cases-and-issues/investigation-and-response/automation/engines/install-an-engine/docker/docker-hardening-guide.md) - [Docker network hardening](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cases-and-issues/investigation-and-response/automation/engines/install-an-engine/docker/docker-hardening-guide/docker-network-hardening.md) - [Configure Docker images](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cases-and-issues/investigation-and-response/automation/engines/install-an-engine/docker/docker-hardening-guide/configure-docker-images.md) - [Run Docker with non-root internal users](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cases-and-issues/investigation-and-response/automation/engines/install-an-engine/docker/docker-hardening-guide/run-docker-with-non-root-internal-users.md) - [Configure the memory limit support without swap capabilities](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cases-and-issues/investigation-and-response/automation/engines/install-an-engine/docker/docker-hardening-guide/configure-the-memory-limit-support-without-swap-capabilities.md) - [Configure the memory limitation](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cases-and-issues/investigation-and-response/automation/engines/install-an-engine/docker/docker-hardening-guide/configure-the-memory-limitation.md) - [Configure the CPU, PIDs, and open the file descriptors limit](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cases-and-issues/investigation-and-response/automation/engines/install-an-engine/docker/docker-hardening-guide/configure-the-cpu-pids-and-open-the-file-descriptors-limit.md) - [Check Docker hardening configurations](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cases-and-issues/investigation-and-response/automation/engines/install-an-engine/docker/docker-hardening-guide/check-docker-hardening-configurations.md) - [Podman](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cases-and-issues/investigation-and-response/automation/engines/install-an-engine/podman.md): Install, configure, and troubleshoot Podman for Cortex Cloud engines. - [Change the Container storage](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cases-and-issues/investigation-and-response/automation/engines/install-an-engine/podman/change-the-container-storage.md): Configure Podman container storage for an engine. - [Install Podman](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cases-and-issues/investigation-and-response/automation/engines/install-an-engine/podman/install-podman.md): Install and configure Podman for Cortex Cloud engines. - [Migrate from Docker to Podman](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cases-and-issues/investigation-and-response/automation/engines/install-an-engine/podman/migrate-from-docker-to-podman.md): Migrate an existing engine from Docker to Podman. - [Troubleshoot Podman](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cases-and-issues/investigation-and-response/automation/engines/install-an-engine/podman/troubleshoot-podman.md): Resolve common Podman issues on Cortex Cloud engines. - [Manage engines](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cases-and-issues/investigation-and-response/automation/engines/manage-engines.md): Manage engines and load balancing groups. - [Upgrade an engine](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cases-and-issues/investigation-and-response/automation/engines/upgrade-an-engine.md): Upgrade an engine on Cortex Cloud or directly on the remote machine. - [Remove an engine](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cases-and-issues/investigation-and-response/automation/engines/remove-an-engine.md): Remove an engine by running the relevant command, depending on your operating system. - [Configure engines](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cases-and-issues/investigation-and-response/automation/engines/configure-engines.md): Configure Cortex Cloud engines by editing the d1.conf file or modifying the configuration in the UI (for shell installations). - [Configure the engine to use a web proxy](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cases-and-issues/investigation-and-response/automation/engines/configure-engines/configure-the-engine-to-use-a-web-proxy.md) - [Configure the engine to call the server without using a proxy](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cases-and-issues/investigation-and-response/automation/engines/configure-engines/configure-the-engine-to-call-the-server-without-using-a-proxy.md) - [Use NGINX as a reverse proxy](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cases-and-issues/investigation-and-response/automation/engines/configure-engines/use-nginx-as-a-reverse-proxy.md) - [Configure an engine to use custom certificates](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cases-and-issues/investigation-and-response/automation/engines/configure-engines/configure-an-engine-to-use-custom-certificates.md) - [Use an engine in an integration](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cases-and-issues/investigation-and-response/automation/engines/use-an-engine-in-an-integration.md): Use an engine or a load-balancing group of engines to fetch issues and run commands for an integration. - [Run a script using an engine](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cases-and-issues/investigation-and-response/automation/engines/run-a-script-using-an-engine.md): Run a script on an engine or load-balancing group to distribute the workload and improve performance. - [Troubleshoot engines](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cases-and-issues/investigation-and-response/automation/engines/troubleshoot-engines.md): Troubleshoot engines by accessing logs and viewing errors. - [Troubleshoot integrations running on engines](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cases-and-issues/investigation-and-response/automation/engines/troubleshoot-integrations-running-on-engines.md) - [Response actions](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cases-and-issues/investigation-and-response/response-actions.md): During the case investigation, various response actions are available. - [Initiate a Live Terminal session](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cases-and-issues/investigation-and-response/response-actions/initiate-a-live-terminal-session.md): Start a Live Terminal session on an endpoint. - [Isolate an endpoint](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cases-and-issues/investigation-and-response/response-actions/isolate-an-endpoint.md): Isolate an endpoint from the network. - [Pause endpoint protection](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cases-and-issues/investigation-and-response/response-actions/pause-endpoint-protection.md): Pause endpoint protection when investigation requires it. - [Remediate changes from malicious activity](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cases-and-issues/investigation-and-response/response-actions/remediate-changes-from-malicious-activity.md): Remediate changes caused by malicious activity. - [Search and destroy malicious files](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cases-and-issues/investigation-and-response/response-actions/search-and-destroy-malicious-files.md): Search for and remove malicious files from endpoints. - [Manage external dynamic lists](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cases-and-issues/investigation-and-response/response-actions/manage-external-dynamic-lists.md): Manage external dynamic lists used for enforcement. - [Collect a memory image](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cases-and-issues/investigation-and-response/response-actions/collect-a-memory-image.md): Collect a memory image from an endpoint. - [Forensics](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cases-and-issues/investigation-and-response/forensics.md): Conduct forensic investigations and collect evidence from endpoints. - [Forensic investigations](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cases-and-issues/investigation-and-response/forensics/forensic-investigations.md): Conduct forensic investigations across endpoints. - [Manage an investigation](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cases-and-issues/investigation-and-response/forensics/forensic-investigations/manage-an-investigation.md): Create, manage, and review forensic investigations. - [Create a new investigation](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cases-and-issues/investigation-and-response/forensics/forensic-investigations/manage-an-investigation/create-a-new-investigation.md): Create a forensic investigation, assign access, and start a data collection. - [Edit an investigation](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cases-and-issues/investigation-and-response/forensics/forensic-investigations/manage-an-investigation/edit-an-investigation.md): Update an active investigation's details and user access. - [Close an investigation](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cases-and-issues/investigation-and-response/forensics/forensic-investigations/manage-an-investigation/close-an-investigation.md): Close an investigation and manage its 24-hour grace period. - [User permissions](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cases-and-issues/investigation-and-response/forensics/forensic-investigations/manage-an-investigation/user-permissions.md): You can assign users to the investigation for them to view and manage the investigation. - [Data collection](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cases-and-issues/investigation-and-response/forensics/forensic-investigations/data-collection.md): Collect endpoint data for forensic investigation. - [Hunting](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cases-and-issues/investigation-and-response/forensics/forensic-investigations/data-collection/hunting.md): Collect data to support threat hunting. - [Triage](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cases-and-issues/investigation-and-response/forensics/forensic-investigations/data-collection/triage.md): Collect data for endpoint triage. - [Configure collection](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cases-and-issues/investigation-and-response/forensics/forensic-investigations/data-collection/configure-collection.md): Configure forensic data collection settings. - [Analysis and documentation](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cases-and-issues/investigation-and-response/forensics/forensic-investigations/analysis-and-documentation.md): Analyze forensic results and document investigation findings. - [Review alerts](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cases-and-issues/investigation-and-response/forensics/forensic-investigations/analysis-and-documentation/review-alerts.md): Review alerts generated during a forensic investigation. - [Investigation timeline](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cases-and-issues/investigation-and-response/forensics/forensic-investigations/analysis-and-documentation/investigation-timeline.md): Review the timeline of forensic investigation activity. - [Key assets & artifacts](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cases-and-issues/investigation-and-response/forensics/forensic-investigations/analysis-and-documentation/key-assets-and-artifacts.md): Review key assets and artifacts in an investigation. - [Export](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cases-and-issues/investigation-and-response/forensics/forensic-investigations/export.md): Export forensic investigation data and results. - [Build XQL queries](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cases-and-issues/investigation-and-response/build-xql-queries.md): Learn more about how to build Cortex Query Language (XQL) queries using the Query Builder. - [About the Query Builder](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cases-and-issues/investigation-and-response/build-xql-queries/about-the-query-builder.md): The Query Builder facilitates threat detection, case expansion, and data analytics for suspected threats. - [How to build XQL queries](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cases-and-issues/investigation-and-response/build-xql-queries/how-to-build-xql-queries.md): Learn more about how to build XQL queries in the Query Builder. - [Get started with XQL queries](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cases-and-issues/investigation-and-response/build-xql-queries/how-to-build-xql-queries/get-started-with-xql-queries.md): Get started creating and running XQL queries. - [Useful XQL user interface features](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cases-and-issues/investigation-and-response/build-xql-queries/how-to-build-xql-queries/useful-xql-user-interface-features.md): Use XQL editor features to build queries efficiently. - [XQL Query best practices](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cases-and-issues/investigation-and-response/build-xql-queries/how-to-build-xql-queries/xql-query-best-practices.md): Apply best practices when writing XQL queries. - [Expected results when querying fields](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cases-and-issues/investigation-and-response/build-xql-queries/how-to-build-xql-queries/expected-results-when-querying-fields.md): Understand expected results when querying fields with XQL. - [Create XQL query](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cases-and-issues/investigation-and-response/build-xql-queries/how-to-build-xql-queries/create-xql-query.md): Create an XQL query to analyze your data. - [Review XQL query results](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cases-and-issues/investigation-and-response/build-xql-queries/how-to-build-xql-queries/review-xql-query-results.md): Review and interpret XQL query results. - [Translate to XQL](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cases-and-issues/investigation-and-response/build-xql-queries/how-to-build-xql-queries/translate-to-xql.md): Translate queries into XQL syntax. - [Graph query results](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cases-and-issues/investigation-and-response/build-xql-queries/how-to-build-xql-queries/graph-query-results.md): Visualize XQL query results in a graph. - [XQL query entities](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cases-and-issues/investigation-and-response/build-xql-queries/legacy-query-builder.md): Learn more about the entities in the Legacy Query Builder. - [Create authentication query](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cases-and-issues/investigation-and-response/build-xql-queries/legacy-query-builder/create-authentication-query.md): Create XQL queries for authentication data. - [Create event log query](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cases-and-issues/investigation-and-response/build-xql-queries/legacy-query-builder/create-event-log-query.md): Create XQL queries for event log data. - [Create file query](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cases-and-issues/investigation-and-response/build-xql-queries/legacy-query-builder/create-file-query.md): Create XQL queries for file data. - [Create image load query](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cases-and-issues/investigation-and-response/build-xql-queries/legacy-query-builder/create-image-load-query.md): Create XQL queries for image load data. - [Create network connections query](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cases-and-issues/investigation-and-response/build-xql-queries/legacy-query-builder/create-network-connections-query.md): Create XQL queries for network connection data. - [Create network query](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cases-and-issues/investigation-and-response/build-xql-queries/legacy-query-builder/create-network-query.md): Create XQL queries for network data. - [Create process query](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cases-and-issues/investigation-and-response/build-xql-queries/legacy-query-builder/create-process-query.md): Create XQL queries for process data. - [Create registry query](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cases-and-issues/investigation-and-response/build-xql-queries/legacy-query-builder/create-registry-query.md): Create XQL queries for registry data. - [Query across all entities](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cases-and-issues/investigation-and-response/build-xql-queries/legacy-query-builder/query-across-all-entities.md): Query data across all entity types. - [Overview of the Query Center](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cases-and-issues/investigation-and-response/build-xql-queries/overview-of-the-query-center.md): View information about the In Progress and Completed queries that that were run on the tenant. - [Edit and run queries in Query Center](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cases-and-issues/investigation-and-response/build-xql-queries/overview-of-the-query-center/edit-and-run-queries-in-query-center.md): Edit and run queries in Query Center. - [Query Center reference information](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cases-and-issues/investigation-and-response/build-xql-queries/overview-of-the-query-center/query-center-reference-information.md): Review Query Center fields and capabilities. - [Manage scheduled queries](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cases-and-issues/investigation-and-response/build-xql-queries/manage-scheduled-queries.md): Learn how to manage your scheduled and recurring queries. - [Scheduled Queries reference information](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cases-and-issues/investigation-and-response/build-xql-queries/manage-scheduled-queries/scheduled-queries-reference-information.md): Review Scheduled Queries fields and capabilities. - [Manage your personal query library](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cases-and-issues/investigation-and-response/build-xql-queries/manage-your-personal-query-library.md): Cortex Cloud provides as part of the Query Library a personal library for saving and managing your own queries. - [XQL macros](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cases-and-issues/investigation-and-response/build-xql-queries/xql-macros.md): Use XQL macros to reuse query logic. - [Manage your macros](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cases-and-issues/investigation-and-response/build-xql-queries/manage-your-macros.md): Create, edit, and manage your XQL macros. - [Quick Launcher](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cases-and-issues/investigation-and-response/quick-launcher.md): The Quick Launcher provides a quick, in-context shortcut that you can use to search for information, perform common investigation tasks, or initiate actions. - [Research a known threat](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cases-and-issues/investigation-and-response/research-a-known-threat.md): Cortex Cloud enables you to investigate any threat, also referred to as a lead, which has been detected. - [Customize cases and issues](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cases-and-issues/customize-cases-and-issues.md): Customize your cases and issues for specific requirements. - [Set up case scoring](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cases-and-issues/customize-cases-and-issues/set-up-case-scoring.md): Configure how Cortex Cloud calculates case scores. - [Create a starring configuration](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cases-and-issues/customize-cases-and-issues/create-a-starring-configuration.md): Create configurations that highlight important cases and issues. - [Create SLAs for case and issue resolution](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cases-and-issues/customize-cases-and-issues/create-slas-for-issue-resolution.md): Create SLA rules to set and track issue-resolution timers and time goals. - [Create additional case timers and SLAs](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cases-and-issues/customize-cases-and-issues/create-slas-for-issue-resolution/create-case-timers-and-slas.md): Create case timers and service-level agreements. - [Update case timer and SLA fields](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cases-and-issues/customize-cases-and-issues/create-slas-for-issue-resolution/create-case-timers-and-slas/update-case-timer-and-sla-fields.md): Update fields used by case timers and service-level agreements. - [Create issue exceptions](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cases-and-issues/customize-cases-and-issues/create-issue-exceptions.md): Create time-bound exceptions that pause issue SLA timers during approved remediation delays. - [Configure the issue exception approval workflow](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cases-and-issues/customize-cases-and-issues/create-issue-exceptions/configure-the-issue-exception-approval-workflow.md): Manage approvers and approval requirements for issue exception rules. - [Create issue exception rules](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cases-and-issues/customize-cases-and-issues/create-issue-exceptions/create-issue-exception-rules.md): Create approval-based rules that temporarily pause SLA timers for selected issues. - [Create an exception rule from an issue](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cases-and-issues/customize-cases-and-issues/create-issue-exceptions/create-an-exception-rule-from-an-issue.md): Create an exception rule from an issue. - [View issue Exception Rules](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cases-and-issues/customize-cases-and-issues/create-issue-exceptions/view-issue-exception-rules.md): View exception rules configured for issues. - [Disable issue exception rules](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cases-and-issues/customize-cases-and-issues/create-issue-exceptions/disable-issue-exception-rules.md): Disable issue exception rules when they are no longer needed. - [View excepted issues](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cases-and-issues/customize-cases-and-issues/create-issue-exceptions/view-excepted-issues.md): View issues excluded by exception rules. - [Optimize case grouping in correlations](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cases-and-issues/customize-cases-and-issues/optimize-case-grouping-in-correlations.md): Optimize case grouping for correlation-based detections. - [Create a sync profile](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cases-and-issues/customize-cases-and-issues/create-a-sync-profile.md): Create a sync profile for cases and issues. - [Agentic Assistant chat](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/agentic-assistant-chat/agentic-assistant-chat.md): Chat with the Cortex Agentic Assistant using natural language prompts. - [Get started with Agentic Assistant chat](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/agentic-assistant-chat/agentic-assistant-chat/get-started-with-agentic-assistant-chat.md): Enable Agentic Assistant and access the chat interface. - [Choose an Agentic Assistant agent](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/agentic-assistant-chat/agentic-assistant-chat/choose-an-agentic-assistant-agent.md): Choose a system or custom agent for your chat. - [Chat with an Agentic Assistant agent](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/agentic-assistant-chat/agentic-assistant-chat/chat-with-an-agentic-assistant-agent.md): Tips for chatting with the Cortex Agentic Assistant - [Chat with the Agentic Assistant from Slack](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/agentic-assistant-chat/agentic-assistant-chat/chat-with-the-agentic-assistant-from-slack.md): Enable chatting with an Agentic Assistant agent from Slack. - [Streamline troubleshooting and support with the Help Center agent](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/agentic-assistant-chat/agentic-assistant-chat/streamline-troubleshooting-and-support-with-the-help-center-agent.md) - [Help Center agent actions](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/agentic-assistant-chat/agentic-assistant-chat/streamline-troubleshooting-and-support-with-the-help-center-agent/help-center-agent-actions.md) - [Create and run XQL queries with Agentic Assistant chat](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/agentic-assistant-chat/agentic-assistant-chat/create-and-run-xql-queries-with-agentic-assistant-chat.md): Interact with Cortex Agentic Assistant agents to build and run XQL queries. - [Use natural language to query and visualize your data](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/agentic-assistant-chat/agentic-assistant-chat/use-natural-language-to-query-and-visualize-your-data.md): Prompt Cortex Agentic Assistant agents to create graphs and charts from its findings. - [Manage chat history](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/agentic-assistant-chat/agentic-assistant-chat/manage-chat-history.md): Manage and navigate your past chats with the Cortex Agentic Assistant. - [Monitor dashboards and reports](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/dashboards-and-reports/monitor-dashboards-and-reports.md): Monitor security data and share insights with dashboards and reports. - [Overview of dashboards and reports](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/dashboards-and-reports/monitor-dashboards-and-reports/overview-of-dashboards-and-reports.md): Learn the key concepts, interfaces, types, and widgets for dashboards and reports. - [Dashboard interface basics](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/dashboards-and-reports/monitor-dashboards-and-reports/overview-of-dashboards-and-reports/dashboard-interface-basics.md): Navigate dashboard layouts, controls, and common actions. - [Dashboard types](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/dashboards-and-reports/monitor-dashboards-and-reports/overview-of-dashboards-and-reports/dashboard-types.md): Understand available dashboard types and their use cases. - [Report basics](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/dashboards-and-reports/monitor-dashboards-and-reports/overview-of-dashboards-and-reports/report-basics.md): Learn how reports present dashboard data for distribution and review. - [Widget Library](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/dashboards-and-reports/monitor-dashboards-and-reports/overview-of-dashboards-and-reports/widget-library.md): Browse available widgets for visualizing security data. - [Access and visibility for dashboards and reports](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/dashboards-and-reports/monitor-dashboards-and-reports/access-and-visibility-for-dashboards-and-reports.md): Control access, visibility, and sharing for dashboards, reports, and widgets. - [Visibility settings](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/dashboards-and-reports/monitor-dashboards-and-reports/access-and-visibility-for-dashboards-and-reports/visibility-settings.md): Configure who can view dashboards and reports. - [Access to widgets](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/dashboards-and-reports/monitor-dashboards-and-reports/access-and-visibility-for-dashboards-and-reports/access-to-widgets.md): Control access to widgets used in dashboards and reports. - [Sharing icons](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/dashboards-and-reports/monitor-dashboards-and-reports/access-and-visibility-for-dashboards-and-reports/sharing-icons.md): Understand sharing icons and their visibility indicators. - [Access and sharing cheat sheet](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/dashboards-and-reports/monitor-dashboards-and-reports/access-and-visibility-for-dashboards-and-reports/access-and-sharing-cheat-sheet.md): Reference dashboard and report access and sharing options. - [Manage dashboards and reports](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/dashboards-and-reports/monitor-dashboards-and-reports/manage-dashboards-and-reports.md): Manage dashboard and report content, ownership, sharing, and notifications. - [Dashboard Manager](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/dashboards-and-reports/monitor-dashboards-and-reports/manage-dashboards-and-reports/dashboard-manager.md): Use Dashboard Manager to organize and manage dashboards. - [Reports](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/dashboards-and-reports/monitor-dashboards-and-reports/manage-dashboards-and-reports/reports.md): View, manage, and distribute report templates and generated reports. - [Duplicate dashboards and reports](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/dashboards-and-reports/monitor-dashboards-and-reports/manage-dashboards-and-reports/duplicate-dashboards-and-reports.md): Duplicate dashboards and reports to reuse existing configurations. - [Share custom dashboards and report templates](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/dashboards-and-reports/monitor-dashboards-and-reports/manage-dashboards-and-reports/share-custom-dashboards-and-report-templates.md): Share custom dashboards and report templates with other users. - [Change ownership to dashboards and report templates](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/dashboards-and-reports/monitor-dashboards-and-reports/manage-dashboards-and-reports/change-ownership-to-dashboards-and-report-templates.md): Transfer ownership of dashboards and report templates. - [Import and export dashboards and report templates](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/dashboards-and-reports/monitor-dashboards-and-reports/manage-dashboards-and-reports/import-and-export-dashboards-and-report-templates.md): Import and export dashboards and report templates. - [Configure the notification rule for a failed report](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/dashboards-and-reports/monitor-dashboards-and-reports/manage-dashboards-and-reports/configure-the-notification-rule-for-a-failed-report.md): Configure notifications for failed report generation. - [Deleted content](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/dashboards-and-reports/monitor-dashboards-and-reports/manage-dashboards-and-reports/deleted-content.md): Restore or permanently remove deleted dashboards and reports. - [Create dashboards](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/dashboards-and-reports/monitor-dashboards-and-reports/create-dashboards.md): Create dashboards that visualize security data and operational insights. - [Create a dashboard](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/dashboards-and-reports/monitor-dashboards-and-reports/create-dashboards/create-a-dashboard.md): Create and configure a dashboard for your security data. - [Create reports](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/dashboards-and-reports/monitor-dashboards-and-reports/create-reports.md): Create report templates to share dashboard insights. - [Create a report template from scratch](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/dashboards-and-reports/monitor-dashboards-and-reports/create-reports/create-a-report-template-from-scratch.md): Create a custom report template from scratch. - [Advanced configuration](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/dashboards-and-reports/monitor-dashboards-and-reports/advanced-configuration.md): Configure custom widgets, filters, and drilldowns for dashboards. - [Create custom widgets](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/dashboards-and-reports/monitor-dashboards-and-reports/advanced-configuration/create-custom-widgets.md): Create custom widgets to display tailored dashboard data. - [Create widgets using AI](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/dashboards-and-reports/monitor-dashboards-and-reports/advanced-configuration/create-custom-widgets/create-widgets-using-ai.md): Use AI to create custom dashboard widgets. - [Create XQL widgets](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/dashboards-and-reports/monitor-dashboards-and-reports/advanced-configuration/create-custom-widgets/create-xql-widgets.md): Create widgets that visualize results from XQL queries. - [Add parameters to a custom XQL widget](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/dashboards-and-reports/monitor-dashboards-and-reports/advanced-configuration/create-custom-widgets/add-parameters-to-a-custom-xql-widget.md): Add parameters that let viewers filter custom XQL widgets. - [Create script-based widgets](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/dashboards-and-reports/monitor-dashboards-and-reports/advanced-configuration/create-custom-widgets/create-script-based-widgets.md): Create widgets that use scripts to retrieve and display data. - [Configure global filters](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/dashboards-and-reports/monitor-dashboards-and-reports/advanced-configuration/configure-global-filters.md): Configure dashboard-wide filters that update multiple widgets. - [Configure drilldowns](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/dashboards-and-reports/monitor-dashboards-and-reports/advanced-configuration/configure-drilldowns.md): Configure drilldowns that open detailed data from dashboard widgets. - [Dashboard reference](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/dashboards-and-reports/monitor-dashboards-and-reports/dashboard-reference.md): Reference dashboard features, system dashboards, and Command Center views. - [Command Center reference](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/dashboards-and-reports/monitor-dashboards-and-reports/dashboard-reference/command-center-reference.md): Reference Command Center dashboards and their available data. - [Cortex Agentic Assistant dashboard](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/dashboards-and-reports/monitor-dashboards-and-reports/dashboard-reference/command-center-reference/cortex-agentic-assistant-dashboard.md): Monitor Cortex Agentic Assistant activity and usage with its dashboard. - [Cortex Cloud Command Center](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/dashboards-and-reports/monitor-dashboards-and-reports/dashboard-reference/command-center-reference/cortex-cloud-command-center.md): Monitor key security operations and posture metrics in Command Center. - [System dashboards](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/dashboards-and-reports/monitor-dashboards-and-reports/dashboard-reference/system-dashboards.md): View built-in dashboards for consumption and cloud security operations. - [Cortex Cloud Consumption](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/dashboards-and-reports/monitor-dashboards-and-reports/dashboard-reference/system-dashboards/cortex-cloud-consumption.md): Monitor Cortex Cloud consumption and usage metrics. - [Cloud Security Operations](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/dashboards-and-reports/monitor-dashboards-and-reports/dashboard-reference/system-dashboards/cloud-security-operations.md): Monitor cloud security operations, risks, and remediation progress. - [Learn about the Discovery Engine](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/discovery-engine/discovery-engine.md): Discover cloud assets and keep the Unified Asset Inventory current. - [What is Cortex Cloud AI Security?](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cortex-cloud-ai-security/what-is-cortex-cloud-ai-security.md): A basic overview of the Cortex Cloud AI Security overview page, assets inventory, risks, and benefits. - [Supported services in Cortex Cloud AI Security](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cortex-cloud-ai-security/supported-services-in-cortex-cloud-ai-security.md): A list of platforms and services that are compatible with Cortex Cloud AI Security. - [Cortex Cloud AI Security concepts](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cortex-cloud-ai-security/cortex-cloud-ai-security-concepts.md): Basic concepts of Cortex Cloud AI Security. - [Cortex Cloud AI Security use cases](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cortex-cloud-ai-security/cortex-cloud-ai-security-use-cases.md): Learn about use cases that are relevant for Cortex Cloud AI Security. - [How to perform advanced AI Security investigations using XQL](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cortex-cloud-ai-security/how-to-perform-advanced-ai-security-investigations-using-xql.md): Working with datasets in Cortex Cloud AI Security. - [About Cortex Cloud Application Security](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cortex-cloud-application-security/about-cortex-cloud-application-security.md): Explore application security use cases, components, and licensing requirements. - [Code-to Cloud](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/code-to-cloud/code-to-cloud.md) - [How the C2C engine works](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/code-to-cloud/code-to-cloud/how-the-c2c-engine-works.md) - [Identify and investigate gap](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/code-to-cloud/code-to-cloud/identify-and-investigate-gap.md) - [Remediation workflows](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/code-to-cloud/code-to-cloud/execute-remediation-workflows.md) - [The Coverage dashboard](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/code-to-cloud/code-to-cloud/the-coverage-dashboard.md) - [C2C in Unified Asset Inventory](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/code-to-cloud/code-to-cloud/c2c-in-unified-asset-inventory.md) - [Reference A: Lineage filtering matrix](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/code-to-cloud/code-to-cloud/c2c-in-unified-asset-inventory/reference-a-lineage-filtering-matrix.md) - [Reference B: Essential filtering rules](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/code-to-cloud/code-to-cloud/c2c-in-unified-asset-inventory/reference-b-essential-filtering-rules.md) - [Reference C: Technical background](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/code-to-cloud/code-to-cloud/c2c-in-unified-asset-inventory/reference-c-technical-background.md) - [C2C tab (asset level)](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/code-to-cloud/code-to-cloud/c2c-tab-asset-level.md) - [C2C tab (app level)](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/code-to-cloud/code-to-cloud/c2c-tab-app-level.md) - [Agentix for C2C](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/code-to-cloud/code-to-cloud/agentix-for-c2c.md) - [Investigate issues with C2C](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/code-to-cloud/code-to-cloud/investigate-issues-with-c2c.md) - [C2C in ASPM Command Center](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/code-to-cloud/code-to-cloud/c2c-in-aspm-command-center.md) - [Enforce policies with C2C](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/code-to-cloud/code-to-cloud/enforce-policies-with-c2c.md) - [Troubleshooting](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/code-to-cloud/code-to-cloud/troubleshooting.md) - [FAQs](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/code-to-cloud/code-to-cloud/faqs.md) - [References](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/code-to-cloud/code-to-cloud/references.md) - [Reference A: Supported integrations and asset stages](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/code-to-cloud/code-to-cloud/references/reference-a-supported-integrations-and-asset-stages.md) - [Reference B: Coverage % calculation and configuration toggles](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/code-to-cloud/code-to-cloud/references/reference-b-coverage-calculation-and-configuration-toggles.md) - [Reference C: Dashboard filters by view](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/code-to-cloud/code-to-cloud/references/reference-c-dashboard-filters-by-view.md) - [Reference D: Recommended actions by view and stage](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/code-to-cloud/code-to-cloud/references/reference-d-recommended-actions-by-view-and-stage.md) - [Reference E: Code-to-Cloud Coverage public API](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/code-to-cloud/code-to-cloud/references/reference-e-code-to-cloud-coverage-public-api.md) - [Page Reference F: Call-to-action routing by asset type1](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/code-to-cloud/code-to-cloud/references/page-reference-f-call-to-action-routing-by-asset-type1.md) - [Reference G: Unified Asset Inventory fields and deep links](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/code-to-cloud/code-to-cloud/references/reference-g-unified-asset-inventory-fields-and-deep-links.md) - [Learn about Cloud ASM](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cloud-attack-surface-management/cloud-asm-concepts.md): Learn about Cloud ASM, including scanning and network mapping. - [What is Cloud ASM?](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cloud-attack-surface-management/cloud-asm-concepts/what-is-cloud-asm.md): Cloud ASM provides visibility into all the assets in your cloud infrastructure that are exposed to the internet. - [Scanning](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cloud-attack-surface-management/cloud-asm-concepts/scanning.md): Cortex Cloud provides targeted scanning of customer networks from an attributed scanning infrastructure. - [Network mapping](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cloud-attack-surface-management/cloud-asm-concepts/network-mapping.md): Through a network mapping process, Cortex Cloud discovers and attributes assets to organizations. - [Enable Cloud ASM](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cloud-attack-surface-management/enable-cloud-asm.md): Enable Cloud ASM data discovery to discover all your unmanaged cloud services and cloud services exposed to the internet. - [Attack surface management detections](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cloud-attack-surface-management/attack-surface-management-detections.md): Learn about Attack Surface Management detections, including rules and externally inferred CVEs. - [Attack surface rules](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cloud-attack-surface-management/attack-surface-management-detections/attack-surface-rules.md): Attack surface rules are used to identify risks in your attack surface. - [Externally inferred CVEs](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cloud-attack-surface-management/attack-surface-management-detections/externally-inferred-cves.md) - [Attack surface assets](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cloud-attack-surface-management/attack-surface-assets.md): The assets discovered in an attack surface management scan are called attack surface assets or external surface assets. - [Review your unmanaged cloud services](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cloud-attack-surface-management/review-your-unmanaged-cloud-services.md): Review your unmanaged cloud services in your Attack Surface inventory. - [Review unmanaged cloud issues](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cloud-attack-surface-management/review-unmanaged-cloud-issues.md): View your unmanaged cloud issues, including service details. - [About network exposure detection](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/network-exposure-detection/network-exposure-detection.md): Identify, prioritize, and remediate internet, outbound, and lateral network exposure risks in public cloud environments. - [What is Cloud Network Analyzer?](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/network-exposure-detection/what-is-cloud-network-analyzer.md): Understand how CNA identifies internet, outbound, and lateral exposure across cloud accounts. - [Internet exposure detection](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/network-exposure-detection/internet-exposure-detection.md): Learn how CNA detects publicly reachable cloud assets and validates exposure through external network scanning. - [Outbound exposure detection](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/network-exposure-detection/outbound-exposure-detection.md): Learn about detecting workloads with unrestricted outbound internet access based on security configurations. - [East-west exposure detection](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/network-exposure-detection/east-west-exposure-detection.md): Learn about workloads with unrestricted lateral access and the controls causing that exposure. - [Investigate an internet exposure](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/network-exposure-detection/investigate-an-internet-exposure.md): Investigate internet-exposed assets through Issues and Graph Search. - [Configure trusted IPs](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/network-exposure-detection/configure-trusted-ips.md): Configure trusted public IP ranges excluded from CNA internet exposure evaluations. - [About Cortex Cloud Data Classification](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cortex-cloud-data-classification/cortex-cloud-data-classification.md): Discover how Cortex Cloud identifies and classifies sensitive data across your environment. - [How to create and validate a custom data pattern](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cortex-cloud-data-classification/how-to-create-and-validate-a-custom-data-pattern.md): Create and validate custom patterns for identifying sensitive data. - [Custom data patterns: Guardrails and syntax guide](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cortex-cloud-data-classification/how-to-create-and-validate-a-custom-data-pattern/custom-data-patterns-guardrails-and-syntax-guide.md): Review syntax requirements and guardrails for custom data patterns. - [How to disable and enable data patterns in Data Classification](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cortex-cloud-data-classification/how-to-disable-and-enable-data-patterns-in-data-classification.md): Enable or disable data patterns used to classify sensitive data. - [How to create and validate a custom data profile](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cortex-cloud-data-classification/how-to-create-and-validate-a-custom-data-profile.md): Create and validate custom profiles that combine data patterns. - [How to disable and enable data profiles in Cortex Cloud Data Classification](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cortex-cloud-data-classification/how-to-disable-and-enable-data-profiles-in-cortex-cloud-data-classification.md): Enable or disable data profiles used for data classification. - [How to report a false positive in Cortex Cloud Data Classification](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cortex-cloud-data-classification/how-to-report-a-false-positive-in-cortex-cloud-data-classification.md): Report false positive data classifications to improve detection accuracy. - [Topic classification](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cortex-cloud-data-classification/topic-classification.md): Classify data by topic to improve visibility and data protection. - [What is Cortex Data Security?](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cortex-data-security/what-is-cortex-cloud-data-security.md): Learn about Cortex Data Security capabilities and benefits. - [What is Cortex Cloud Identity Security?](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cortex-cloud-identity-security/what-is-cortex-cloud-identity-security.md): Cortex Cloud Identity Security can help you address the security challenges of managing identity in cloud environments. - [Review and improve your Identity Security posture](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cortex-cloud-identity-security/review-and-improve-your-identity-security-posture.md): Learn how to review and improve your Identity Security posture with the provided use case examples. - [How does Effective Permission Calculation work?](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cortex-cloud-identity-security/how-does-effective-permission-calculation-work.md): An explanation of how Effective Permission Calculation works in Cortex Cloud Identity Security. - [Cortex Cloud Identity Security functionality](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cortex-cloud-identity-security/cortex-cloud-identity-security-functionality.md): About the functionalities of Cortex Cloud Identity Security. - [Configure Cortex Cloud Identity Security](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cortex-cloud-identity-security/configure-cortex-cloud-identity-security.md) - [Unified Human Identities](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cortex-cloud-identity-security/unified-human-identities.md) - [Achieve the principle of least privilege access](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cortex-cloud-identity-security/achieve-the-principle-of-least-privilege-access.md): Use Cortex Cloud Identity Security to achieve the principle of least privilege access. - [Explore permissions using the simple and advanced access tables](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cortex-cloud-identity-security/explore-permissions-using-the-simple-and-advanced-access-tables.md): Learn how to explore permissions in Cortex Cloud Identity Security using the Simple and Advanced access tables. - [Create a custom detection rule in Cortex Cloud Identity Security](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cortex-cloud-identity-security/create-a-custom-detection-rule-in-cortex-cloud-identity-security.md): Learn how to create a custom detection rule in Cortex Cloud Identity Security. - [Perform advanced Identity Security investigations using XQL](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cortex-cloud-identity-security/perform-advanced-identity-security-investigations-using-xql.md): Working with datasets in Cortex Cloud Identity Security. - [Ingest logs and data from Okta](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cortex-cloud-identity-security/ingest-logs-and-data-from-okta.md): Learn more about Ingesting logs and data from Okta for use in Cortex Cloud. - [Enable inactive human identity logs on Azure in Cortex Cloud Identity Security](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cortex-cloud-identity-security/enable-inactive-human-identity-logs-on-azure-in-cortex-cloud-identity-security.md): Configuration information for enabling inactive human identity logs on Azure. - [Manage RBAC and SBAC in Cortex Cloud Identity Security](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cortex-cloud-identity-security/manage-rbac-and-sbac-in-cortex-cloud-identity-security.md): Working with RBAC and SBAC in Cortex Cloud Identity Security. - [SaaS Security](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/saas-security/saas-security.md): SaaS Security delivers continuous visibility and control across SaaS identities, connected apps, and AI agents. - [Setup SaaS Security](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/saas-security/saas-security/setup-saas-security.md): Get started with SaaS Security. - [Onboard a Supported SaaS Application](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/saas-security/saas-security/onboard-a-supported-saas-application.md): Onboard a supported SaaS application to track and monitor misconfigurations and compliance violations. - [Onboard Aha.io](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/saas-security/saas-security/onboard-a-supported-saas-application/onboard-aha.io.md): Onboard Aha.io to track misconfigurations and monitor application compliance. - [Onboard Asana](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/saas-security/saas-security/onboard-a-supported-saas-application/onboard-asana.md): Connect an Asana instance to detect posture risks and compliance violations. - [Onboard Atlassian](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/saas-security/saas-security/onboard-a-supported-saas-application/onboard-atlassian.md): Connect an Atlassian instance to detect posture and compliance risks. - [Onboard Automox](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/saas-security/saas-security/onboard-a-supported-saas-application/onboard-automox.md): Connect an Automox instance to detect posture risks and compliance violations. - [Onboard Businessmap](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/saas-security/saas-security/onboard-a-supported-saas-application/onboard-businessmap.md): Connect a Businessmap instance to detect posture risks and compliance violations. - [Onboard Celonis](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/saas-security/saas-security/onboard-a-supported-saas-application/onboard-celonis.md): Connect a Celonis instance to detect posture risks and compliance violations. - [Onboard Cisco Duo](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/saas-security/saas-security/onboard-a-supported-saas-application/onboard-cisco-duo.md): Connect Cisco Duo instance to detect posture risks and compliance violations. - [Onboard Cisco Meraki](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/saas-security/saas-security/onboard-a-supported-saas-application/onboard-cisco-meraki.md): Connect a Cisco Meraki instance to detect posture risks and compliance violations. - [Onboard ClickUp](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/saas-security/saas-security/onboard-a-supported-saas-application/onboard-clickup.md): Connect a ClickUp instance to detect posture risks and compliance violations. - [Onboard Contentful](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/saas-security/saas-security/onboard-a-supported-saas-application/onboard-contentful.md): Connect a Contentful instance to detect posture risks and compliance violations. - [Onboard Couchbase](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/saas-security/saas-security/onboard-a-supported-saas-application/onboard-couchbase.md): Connect a Couchbase instance to detect posture risks and compliance violations. - [Onboard Coveo](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/saas-security/saas-security/onboard-a-supported-saas-application/onboard-coveo.md): Connect a Coveo instance to detect posture risks and compliance violations. - [Onboard Databricks](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/saas-security/saas-security/onboard-a-supported-saas-application/onboard-databricks.md): Connect a Databricks instance to detect posture risks and compliance violations. - [Onboard Datadog](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/saas-security/saas-security/onboard-a-supported-saas-application/onboard-datadog.md): Connect a Datadog instance to detect posture risks and compliance violations. - [Onboard Gainsight PX](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/saas-security/saas-security/onboard-a-supported-saas-application/onboard-gainsight-px.md): Connect a Gainsight PX instance to detect posture risks and compliance violations. - [Onboard Grammarly](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/saas-security/saas-security/onboard-a-supported-saas-application/onboard-grammarly.md): Connect a Grammarly instance to detect posture risks and compliance violations. - [Onboard Harness](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/saas-security/saas-security/onboard-a-supported-saas-application/onboard-harness.md): Connect a Harness instance to detect posture risks and compliance violations. - [Onboard Intercom](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/saas-security/saas-security/onboard-a-supported-saas-application/onboard-intercom.md): Connect an Intercom instance to detect posture risks and compliance violations. - [Onboard Jamf Pro](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/saas-security/saas-security/onboard-a-supported-saas-application/onboard-jamf-pro.md): Connect a Jamf Pro instance to detect posture risks and compliance violations. - [Onboard JumpCloud](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/saas-security/saas-security/onboard-a-supported-saas-application/onboard-jumpcloud.md): Connect a JumpCloud instance to detect posture risks and compliance violations. - [Onboard Kustomer](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/saas-security/saas-security/onboard-a-supported-saas-application/onboard-kustomer.md): Connect a Kustomer instance to detect posture risks and compliance violations. - [Onboard Microsoft Entra ID](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/saas-security/saas-security/onboard-a-supported-saas-application/onboard-microsoft-entra-id.md): Connect a Microsoft Entra ID instance to detect posture risks and compliance violations. - [Onboard Monday.com](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/saas-security/saas-security/onboard-a-supported-saas-application/onboard-monday.com.md): Connect a Monday.com instance to detect posture risks and compliance violations. - [Onboard MongoDB Atlas](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/saas-security/saas-security/onboard-a-supported-saas-application/onboard-mongodb-atlas.md): Connect a MongoDB Atlas instance to detect posture risks and compliance violations. - [Onboard MuleSoft](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/saas-security/saas-security/onboard-a-supported-saas-application/onboard-mulesoft.md): Connect a MuleSoft instance to detect posture risks and compliance violations. - [Onboard Mural](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/saas-security/saas-security/onboard-a-supported-saas-application/onboard-mural.md): Connect a Mural instance to detect posture risks and compliance violations. - [Onboard Office 365](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/saas-security/saas-security/onboard-a-supported-saas-application/onboard-office-365.md): Connect an Office 365 instance to detect posture risks and compliance violations. - [Onboard Okta](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/saas-security/saas-security/onboard-a-supported-saas-application/onboard-okta.md): Connect an Okta instance to detect posture risks and compliance violations. - [Onboard PagerDuty](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/saas-security/saas-security/onboard-a-supported-saas-application/onboard-pagerduty.md): Connect a PagerDuty instance to detect posture risks and compliance violations. - [Onboard Redis Labs](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/saas-security/saas-security/onboard-a-supported-saas-application/onboard-redis-labs.md): Connect a Redis Labs instance to detect posture risks and compliance violations. - [Onboard Salesforce](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/saas-security/saas-security/onboard-a-supported-saas-application/onboard-salesforce.md): Connect a Salesforce instance to detect posture risks and compliance violations. - [Onboard SAP Ariba](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/saas-security/saas-security/onboard-a-supported-saas-application/onboard-sap-ariba.md): Connect a SAP Ariba instance to detect posture risks and compliance violations. - [Onboard Sentry](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/saas-security/saas-security/onboard-a-supported-saas-application/onboard-sentry.md): Connect a Sentry instance to detect posture risks and compliance violations. - [Onboard ServiceNow](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/saas-security/saas-security/onboard-a-supported-saas-application/onboard-servicenow.md): Connect a ServiceNow instance to detect posture risks and compliance violations. - [Onboard Shopify](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/saas-security/saas-security/onboard-a-supported-saas-application/onboard-shopify.md): Connect a Shopify instance to detect posture risks and compliance violations. - [Onboard Slack Enterprise](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/saas-security/saas-security/onboard-a-supported-saas-application/onboard-slack-enterprise.md): Connect a Slack instance to detect posture risks and compliance violations. - [Onboard Sumo Logic](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/saas-security/saas-security/onboard-a-supported-saas-application/onboard-sumo-logic.md): Connect a Sumo Logic instance to detect posture risks and compliance violations. - [Onboard Workday](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/saas-security/saas-security/onboard-a-supported-saas-application/onboard-workday.md): Connect a Workday instance to detect posture risks and compliance violations. - [Onboard Wrike](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/saas-security/saas-security/onboard-a-supported-saas-application/onboard-wrike.md): Connect a Wrike instance to detect posture risks and compliance violations. - [Onboard YouTrack](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/saas-security/saas-security/onboard-a-supported-saas-application/onboard-youtrack.md): Connect a YouTrack instance to detect posture risks and compliance violations. - [SaaS Security Overview](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/saas-security/saas-security/saas-security-overview.md): This dashboard aggregates and presents security data from all four core SaaS Security pillars including: SSPM (Posture), SaaS Identity Security, SaaS Data Security, and SaaS Agent Security. - [SaaS Security Checks](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/saas-security/saas-security/saas-security-checks.md): The dashboard captures key metrics to help you remediate SaaS assets at risk - [Provider Instances Security Check](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/saas-security/saas-security/provider-instances-security-check.md): This page consolidates application security posture data across all onboarded instances - [Detection Rules](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/saas-security/saas-security/detection-rules.md): View Cloud Security Posture Rules - [Remediation Actions](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/saas-security/saas-security/remediation-actions.md): Learn more about actions available to remediate Issues. - [Create and monitor tickets](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/saas-security/saas-security/create-and-monitor-tickets.md): Learn more about creating a synced ticket to remediate an issue. - [SaaS AI Agent Security](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/saas-security/saas-security/saas-ai-agent-security.md): SaaS AI Agent Security helps you secure AI agents deployed across enterprise SaaS environments. - [Setup SaaS Security for AISPM](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/saas-security/saas-security/saas-ai-agent-security/setup-saas-security-for-aispm.md): Get started with SaaS Agent Security. - [Onboard SaaS AI Agents](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/saas-security/saas-security/saas-ai-agent-security/onboard-saas-ai-agents.md): Learn more about how to onboard specific AI Agents. - [Onboard Atlassian Rovo](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/saas-security/saas-security/saas-ai-agent-security/onboard-saas-ai-agents/onboard-atlassian-rovo.md): Connect Atlassian Rovo to SaaS Agent Security to gain total visibility and control over your AI ecosystem. - [Onboard Box AI Agents](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/saas-security/saas-security/saas-ai-agent-security/onboard-saas-ai-agents/onboard-box-ai-agents.md): Connect Box AI Agents to SaaS Agent Security to gain total visibility and control over your AI ecosystem. - [Onboard ChatGPT Enterprise](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/saas-security/saas-security/saas-ai-agent-security/onboard-saas-ai-agents/onboard-chatgpt-enterprise.md): Connect Box AI Agents to SaaS Agent Security to gain total visibility and control over your AI ecosystem. - [Onboard Cursor Enterprise](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/saas-security/saas-security/saas-ai-agent-security/onboard-saas-ai-agents/onboard-cursor-enterprise.md): Connect Cursor Enterprise to SaaS Agent Security to gain total visibility and control over your AI ecosystem. - [Onboard Gemini Enterprise](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/saas-security/saas-security/saas-ai-agent-security/onboard-saas-ai-agents/onboard-gemini-enterprise.md): Connect Gemini Enterprise to SaaS Agent Security to gain total visibility and control over your AI ecosystem. - [Onboard M365 Copilot](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/saas-security/saas-security/saas-ai-agent-security/onboard-saas-ai-agents/onboard-m365-copilot.md): Connect M365 Copilot to SaaS Agent Security to gain total visibility and control over your AI ecosystem. - [Onboard Microsoft Copilot Studio](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/saas-security/saas-security/saas-ai-agent-security/onboard-saas-ai-agents/onboard-microsoft-copilot-studio.md): Connect Microsoft Copilot Studio to SaaS Agent Security to gain total visibility and control over your AI ecosystem. - [Onboard Service Now](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/saas-security/saas-security/saas-ai-agent-security/onboard-saas-ai-agents/onboard-service-now.md): Connect Service Now to SaaS Agent Security to gain total visibility and control over your AI ecosystem. - [Manage SaaS AI Agents](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/saas-security/saas-security/saas-ai-agent-security/manage-saas-ai-agents.md) - [View AI Agents](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/saas-security/saas-security/saas-ai-agent-security/manage-saas-ai-agents/view-ai-agents.md) - [View Datasets](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/saas-security/saas-security/saas-ai-agent-security/manage-saas-ai-agents/view-datasets.md): The Datasets view provides a detailed look at the Inference Datasets. - [View Agent Tools](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/saas-security/saas-security/saas-ai-agent-security/manage-saas-ai-agents/view-agent-tools.md): SaaS Agent Tools go beyond traditional scans that focus on an inventory of previously vendor vetted, underlying tools. - [Vulnerability management in Cortex Cloud](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/vunerability-management/vulnerability-management-in-cortex-cloud.md): Vulnerability management helps you identify, assess, prioritize, and remediate security vulnerabilities across your entire IT infrastructure, including endpoints, code, and cloud. - [Cortex Cloud vulnerability concepts](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/vunerability-management/vulnerability-management-in-cortex-cloud/cortex-cloud-vulnerability-concepts.md): Familiarize yourself with Cortex Cloud vulnerability concepts. - [Vulnerability Management dashboard](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/vunerability-management/vulnerability-management-in-cortex-cloud/vulnerability-management-dashboard.md): Visualize your most pressing risks, changes to risk over time, and remediation progress on the Vulnerability Management dashboard. - [Cortex Vulnerability Risk Score](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/vunerability-management/cortex-vulnerability-risk-score.md): Learn how Cortex Cloud calculates and displays CVRS to prioritize vulnerability remediation. - [Vulnerability policies](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/vunerability-management/vulnerability-policies.md): A vulnerability policy defines the action you want to take for a specific set of vulnerability findings. - [Create a vulnerability policy](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/vunerability-management/vulnerability-policies/create-a-vulnerability-policy.md): Create vulnerability policies that create issues or prevent findings based on defined conditions and scope. - [Update the Ignored CVEs, Asset Groups, and Assets policy](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/vunerability-management/vulnerability-policies/update-the-ignored-cves-asset-groups-and-assets-policy.md): Update the ignored CVEs, asset groups, and assets policy to prevent matching vulnerability findings from creating issues. - [Modify a vulnerability policy](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/vunerability-management/vulnerability-policies/modify-a-vulnerability-policy.md): Update issue-creation and prevention policies through the policy wizard. - [Configure a block grace period](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/vunerability-management/vulnerability-policies/configure-a-block-grace-period.md): Configure remediation grace periods that delay Kubernetes deployment blocks or build failures after vulnerability disclosure. - [Enable or disable a vulnerability policy](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/vunerability-management/vulnerability-policies/enable-or-disable-a-vulnerability-policy.md): Enable or disable issue-creation and prevention policies to control actions for matching findings. - [Investigate and remediate vulnerabilities](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/vunerability-management/investigate-and-remediate-vulnerabilities.md): Investigate, prioritize, and remediate vulnerabilities through issues, findings, and vulnerable assets. - [Vulnerability Intelligence](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/vunerability-management/vulnerability-intelligence.md): Vulnerability Intelligence is an in-product, real-time feed that provides vulnerability data and threat intelligence from a variety of certified upstream sources. - [Emerging Vulnerabilities](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/vunerability-management/emerging-vulnerabilities.md): The Emerging Vulnerabilities page is a a centralized hub for security teams to research, assess, and respond to global, emergent threats and zero-day exploits. - [Recast CVSS scores and CVSS severities](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/vunerability-management/recast-cvss-scores-and-cvss-severities.md): Customize CVSS scores and CVSS severities in the platform to align your risk management approach with your organizational context and priorities. - [Registry scanning](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/registry-scanning/registry-scanning.md): Learn about Registry scanning capability in Cortex Cloud - [Supported container registry integrations](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/registry-scanning/registry-scanning/supported-container-registry-integrations.md): Learn about supported container registry integrations in Cortex Cloud - [How Container Registry Scanning Works](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/registry-scanning/registry-scanning/how-container-registry-scanning-works.md): Learn how Cortex Cloud discovers, scans, and evaluates container images in onboarded registries to identify and continuously monitor security risks. - [Scan re-evaluation process](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/registry-scanning/registry-scanning/scan-re-evaluation-process.md): Understand how Cortex Cloud re-evaluates container registry scan results. - [Configure registry scanning for cloud accounts](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/registry-scanning/configure-registry-scanning-for-cloud-accounts.md): Configure Cortex Cloud to scan container registries in connected cloud accounts. - [Modify the container registry scanning scope](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/registry-scanning/configure-registry-scanning-for-cloud-accounts/modify-the-container-registry-scanning-scope.md): Modify the Cortex Cloud container registry scanning scope for cloud accounts and registries. - [Configure registry scanning for third party integrations](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/registry-scanning/configure-registry-scanning-for-third-party-integrations.md): Learn how to configure Cortex Cloud to scan container registries in third-party integrations - [Manage registry scanning with APIs](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/registry-scanning/manage-registry-scanning-with-apis.md): Learn how to onboard and manage registry scanning programatically with APIs for Cortex Cloud. - [About Rules and Policies](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/rules-and-policies/about-rules-and-policies.md): Discover how Cortex Cloud detects security risks across your infrastructure, workloads, and container images, and how policies automate the response. - [Cloud security rules and policies](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/rules-and-policies/cloud-security-rules-and-policies.md): Learn how cloud security rules and policies detect threats and misconfigurations across your environment. - [Cloud security rules](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/rules-and-policies/cloud-security-rules-and-policies/cloud-security-rules.md): Learn about out-of-the-box and custom cloud security rules. - [Cloud security policies](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/rules-and-policies/cloud-security-rules-and-policies/cloud-security-policies.md): Learn about cloud security policies. - [Create and manage cloud security rules](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/rules-and-policies/cloud-security-rules-and-policies/create-and-manage-cloud-security-rules.md): Create and manage custom cloud security rules for detecting cloud security risks. - [Create a graph rule](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/rules-and-policies/cloud-security-rules-and-policies/create-and-manage-cloud-security-rules/create-a-graph-rule.md): Create custom graph detection rules that identify risky relationships and attack paths. - [Create a configuration rule](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/rules-and-policies/cloud-security-rules-and-policies/create-and-manage-cloud-security-rules/create-a-configuration-rule.md): Create configuration rules that identify cloud resource misconfigurations and policy violations. - [Create a data rule](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/rules-and-policies/cloud-security-rules-and-policies/create-and-manage-cloud-security-rules/create-a-data-rule.md): Create data rules to detect data risks, malware, and classification issues. - [Create an identity rule](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/rules-and-policies/cloud-security-rules-and-policies/create-and-manage-cloud-security-rules/create-an-identity-rule.md): Create identity rules to detect excessive or unused cloud permissions. - [Create a network exposure rule](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/rules-and-policies/cloud-security-rules-and-policies/create-and-manage-cloud-security-rules/create-a-network-exposure-rule.md): Create network exposure rules to detect risky inbound, outbound, and east-west access. - [Create an AI rule](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/rules-and-policies/cloud-security-rules-and-policies/create-and-manage-cloud-security-rules/create-an-ai-rule.md): Create AI rules to detect risks and misconfigurations across your AI ecosystem. - [Create an attack path (legacy) rule](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/rules-and-policies/cloud-security-rules-and-policies/create-and-manage-cloud-security-rules/create-an-attack-path-rule.md): Create attack path rules that identify breach paths to high-value cloud assets. - [View cloud security rule status](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/rules-and-policies/cloud-security-rules-and-policies/create-and-manage-cloud-security-rules/view-cloud-security-rule-status.md): View, filter, and sort the status of cloud security rules. - [Edit a cloud security rule](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/rules-and-policies/cloud-security-rules-and-policies/create-and-manage-cloud-security-rules/edit-a-cloud-security-rule.md): Edit cloud security rules and understand how changes affect related issues. - [Enable or disable a rule](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/rules-and-policies/cloud-security-rules-and-policies/create-and-manage-cloud-security-rules/enable-or-disable-a-rule.md): Enable or disable cloud security rules to control when they evaluate assets. - [Use an existing rule to create a new one](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/rules-and-policies/cloud-security-rules-and-policies/create-and-manage-cloud-security-rules/use-an-existing-rule-to-create-a-new-one.md): Duplicate an existing cloud security rule and customize it for your needs. - [Delete a custom cloud security rule](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/rules-and-policies/cloud-security-rules-and-policies/create-and-manage-cloud-security-rules/delete-a-custom-cloud-security-rule.md): Delete custom cloud security rules that are no longer needed. - [Create and manage cloud security policies](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/rules-and-policies/cloud-security-rules-and-policies/create-and-manage-cloud-security-policies.md): Create and manage cloud security policies. - [Create a cloud security policy](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/rules-and-policies/cloud-security-rules-and-policies/create-and-manage-cloud-security-policies/create-a-cloud-security-policy.md): Create a cloud security policy that applies security rules to selected cloud assets. - [Edit a cloud security policy](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/rules-and-policies/cloud-security-rules-and-policies/create-and-manage-cloud-security-policies/edit-a-cloud-security-policy.md): Edit cloud security policies to update their details, rules, and scopes. - [Enable or disable a policy](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/rules-and-policies/cloud-security-rules-and-policies/create-and-manage-cloud-security-policies/enable-or-disable-a-policy.md): Enable or disable custom and default cloud security policies. - [Use an existing policy to create a new one](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/rules-and-policies/cloud-security-rules-and-policies/create-and-manage-cloud-security-policies/use-an-existing-policy-to-create-a-new-one.md): Clone an existing cloud security policy and tailor it to your needs. - [Delete a custom cloud security policy](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/rules-and-policies/cloud-security-rules-and-policies/create-and-manage-cloud-security-policies/delete-a-custom-cloud-security-policy.md): Remove custom cloud security policies that are no longer needed. - [Cloud Workload Policies and Rules](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/rules-and-policies/cloud-workload-policies-and-rules.md): Learn how cloud workload policies and rules protect your workloads. - [How policies and rules work together](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/rules-and-policies/cloud-workload-policies-and-rules/how-policies-and-rules-work-together.md): Understand how policies apply cloud workload rules to your workloads. - [Cloud workload policies](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/rules-and-policies/cloud-workload-policies-and-rules/cloud-workload-policies.md): Create and manage policies that apply protection rules to cloud workloads. - [Types of cloud workload policies](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/rules-and-policies/cloud-workload-policies-and-rules/cloud-workload-policies/types-of-cloud-workload-policies.md): Learn about cloud workload policy types and their use cases. - [Trusted image cloud workload policies](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/rules-and-policies/cloud-workload-policies-and-rules/cloud-workload-policies/types-of-cloud-workload-policies/types-of-cloud-workload-policies.md): Use trusted image policies to control which container images can run. - [Cloud Workload Policies page](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/rules-and-policies/cloud-workload-policies-and-rules/cloud-workload-policies/cloud-workload-policies-page.md): Use the Cloud Workload Policies page to view and manage policies. - [Enable or disable a cloud workload policy](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/rules-and-policies/cloud-workload-policies-and-rules/cloud-workload-policies/enable-or-disable-a-cloud-workload-policy.md): Enable or disable a cloud workload policy to control its enforcement. - [Create a cloud workload policy](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/rules-and-policies/cloud-workload-policies-and-rules/cloud-workload-policies/create-a-cloud-workload-policy.md): Create a cloud workload policy to apply rules to selected workloads. - [Use an existing policy to create a new cloud workload policy](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/rules-and-policies/cloud-workload-policies-and-rules/cloud-workload-policies/use-an-existing-policy-to-create-a-new-cloud-workload-policy.md): Duplicate an existing policy and customize it for new workload requirements. - [Edit a cloud workload policy](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/rules-and-policies/cloud-workload-policies-and-rules/cloud-workload-policies/edit-a-cloud-workload-policy.md): Edit a cloud workload policy to update its rules and scope. - [Delete a cloud workload policy](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/rules-and-policies/cloud-workload-policies-and-rules/cloud-workload-policies/delete-a-cloud-workload-policy.md): Delete cloud workload policies that are no longer needed. - [Cloud workload preventive action](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/rules-and-policies/cloud-workload-policies-and-rules/cloud-workload-policies/cloud-workload-preventive-action.md): Understand preventive actions that block noncompliant cloud workloads. - [Cloud workload rules](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/rules-and-policies/cloud-workload-policies-and-rules/cloud-workload-rules.md): Create and manage rules that detect and prevent cloud workload risks. - [Default (pre-defined) rules](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/rules-and-policies/cloud-workload-policies-and-rules/cloud-workload-rules/default-pre-defined-rules.md): Learn about built-in cloud workload rules and their detection coverage. - [Custom (user-defined) rules](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/rules-and-policies/cloud-workload-policies-and-rules/cloud-workload-rules/custom-user-defined-rules.md): Create and manage custom rules for cloud workload detection. - [Cloud Workload Rules page](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/rules-and-policies/cloud-workload-policies-and-rules/cloud-workload-rules/cloud-workload-rules-page.md): Use the Cloud Workload Rules page to view and manage rules. - [Create a new custom detection rule](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/rules-and-policies/cloud-workload-policies-and-rules/cloud-workload-rules/create-a-new-custom-detection-rule.md): Create a custom detection rule for cloud workload security risks. - [Configure Agentless disk scan rule](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/rules-and-policies/cloud-workload-policies-and-rules/cloud-workload-rules/create-a-new-custom-detection-rule/configure-agentless-disk-scan-rule.md) - [Configure Kubernetes connector rule](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/rules-and-policies/cloud-workload-policies-and-rules/cloud-workload-rules/create-a-new-custom-detection-rule/configure-kubernetes-connector-rule.md) - [Configure XDR agent rule](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/rules-and-policies/cloud-workload-policies-and-rules/cloud-workload-rules/create-a-new-custom-detection-rule/configure-xdr-agent-rule.md) - [Use an existing rule to create a new custom detection rule](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/rules-and-policies/cloud-workload-policies-and-rules/cloud-workload-rules/use-an-existing-rule-to-create-a-new-custom-detection-rule.md): Duplicate an existing rule and customize it for new detection needs. - [Edit a custom detection rule](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/rules-and-policies/cloud-workload-policies-and-rules/cloud-workload-rules/edit-a-custom-detection-rule.md): Edit a custom detection rule to update its detection logic and scope. - [Delete a custom detection rule](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/rules-and-policies/cloud-workload-policies-and-rules/cloud-workload-rules/delete-a-custom-detection-rule.md): Delete custom detection rules that are no longer needed. - [Base image rules](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/rules-and-policies/base-images-rule.md): Learn about how base image rules identify and manage approved container images. - [Create a base image rule](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/rules-and-policies/base-images-rule/create-a-base-images-rule.md): Create a base image rule to define trusted container image criteria. - [Find the base image for an asset](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/rules-and-policies/base-images-rule/prerequisites.md): Find an asset’s base image to investigate its image lineage and risk. - [Monitor and track compliance adherence](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/compliance/monitor-and-track-compliance-adherence.md): Evaluate and track asset compliance against industry standards and organizational policies. - [Choose compliance standards from the compliance catalog](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/compliance/monitor-and-track-compliance-adherence/choose-compliance-standards-from-the-compliance-catalog.md): Select built-in or custom compliance standards and controls from the compliance catalogs. - [Standards catalog](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/compliance/monitor-and-track-compliance-adherence/choose-compliance-standards-from-the-compliance-catalog/standards-catalog.md): Browse available compliance standards. - [Use a built-in or custom standard](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/compliance/monitor-and-track-compliance-adherence/choose-compliance-standards-from-the-compliance-catalog/use-a-built-in-or-custom-standard.md): Use built-in standards or create and edit custom standards for your organization. - [Use a built-in or custom control](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/compliance/monitor-and-track-compliance-adherence/choose-compliance-standards-from-the-compliance-catalog/use-a-built-in-or-custom-control.md): Add built-in controls or create and manage custom controls for custom standards. - [Create a new custom detection rule](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/compliance/monitor-and-track-compliance-adherence/choose-compliance-standards-from-the-compliance-catalog/create-a-new-custom-detection-rule.md): Create custom detection rules to enforce compliance requirements and security best practices. - [Use an assessment profile to run compliance checks on your assets](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/compliance/monitor-and-track-compliance-adherence/use-an-assessment-profile-to-run-compliance-checks-on-your-assets.md): Create assessment profiles to evaluate selected asset groups against compliance standards. - [View and manage compliance assessments and reports](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/compliance/monitor-and-track-compliance-adherence/view-and-manage-compliance-assessments-and-reports.md): Review assessment results and generate or schedule downloadable compliance reports. - [Review compliance assessments](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/compliance/monitor-and-track-compliance-adherence/view-and-manage-compliance-assessments-and-reports/assessments.md): View assessment results and drill into control, rule, and asset compliance details. - [Review compliance reports](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/compliance/monitor-and-track-compliance-adherence/view-and-manage-compliance-assessments-and-reports/reports.md): View, export, and manage historical compliance assessment reports. - [Compliance Overview Dashboard](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/compliance/monitor-and-track-compliance-adherence/compliance-overview-dashboard.md): Monitor organization-wide compliance scores, standards, failed controls, and asset group performance. - [Broker VM](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/data-management/broker-vm.md): Deploy and manage Broker VM for secure data collection and connectivity. - [What is the Broker VM?](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/data-management/broker-vm/what-is-the-broker-vm.md): Learn how Broker VM securely connects Cortex Cloud to your environment. - [Set up and configure Broker VM](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/data-management/broker-vm/set-up-and-configure-broker-vm.md): Set up and configure Broker VM for data collection and integrations. - [Broker VM image installations](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/data-management/broker-vm/set-up-and-configure-broker-vm/broker-vm-image-installations.md): Install Broker VM images on supported cloud and virtualization platforms. - [Set up Broker VM on Alibaba Cloud](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/data-management/broker-vm/set-up-and-configure-broker-vm/broker-vm-image-installations/set-up-broker-vm-on-alibaba-cloud.md): Deploy Broker VM on Alibaba Cloud using a supported image. - [Set up Broker VM on Amazon Web Services](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/data-management/broker-vm/set-up-and-configure-broker-vm/broker-vm-image-installations/set-up-broker-vm-on-amazon-web-services.md): Deploy Broker VM on Amazon Web Services using a supported image. - [Set up Broker VM on Google Cloud Platform (GCP)](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/data-management/broker-vm/set-up-and-configure-broker-vm/broker-vm-image-installations/set-up-broker-vm-on-google-cloud-platform-gcp.md): Deploy Broker VM on Google Cloud Platform using a supported image. - [Set up Broker VM on KVM using Ubuntu](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/data-management/broker-vm/set-up-and-configure-broker-vm/broker-vm-image-installations/set-up-broker-vm-on-kvm-using-ubuntu.md): Deploy Broker VM on KVM hosts running Ubuntu. - [Set up Broker VM on Microsoft Azure](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/data-management/broker-vm/set-up-and-configure-broker-vm/broker-vm-image-installations/set-up-broker-vm-on-microsoft-azure.md): Deploy Broker VM on Microsoft Azure using a supported image. - [Set up Broker VM on Microsoft Hyper-V](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/data-management/broker-vm/set-up-and-configure-broker-vm/broker-vm-image-installations/set-up-broker-vm-on-microsoft-hyper-v.md): Deploy Broker VM on Microsoft Hyper-V using a supported image. - [Set up Broker VM on Nutanix Hypervisor](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/data-management/broker-vm/set-up-and-configure-broker-vm/broker-vm-image-installations/set-up-broker-vm-on-nutanix-hypervisor.md): Deploy Broker VM on Nutanix Hypervisor using a supported image. - [Set up Broker VM on VMware ESXi using vSphere Client](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/data-management/broker-vm/set-up-and-configure-broker-vm/broker-vm-image-installations/set-up-broker-vm-on-vmware-esxi-using-vsphere-client.md): Deploy Broker VM on VMware ESXi using the vSphere Client. - [Broker VM data collector applets](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/data-management/broker-vm/set-up-and-configure-broker-vm/broker-vm-data-collector-applets.md): Learn about data collector applets that run on Broker VM. - [Manage Broker VM](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/data-management/broker-vm/manage-broker-vm.md): Manage Broker VM configuration, maintenance, monitoring, and clustering. - [Edit Broker VM Configuration](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/data-management/broker-vm/manage-broker-vm/edit-broker-vm-configuration.md): Update Broker VM configuration settings for your environment. - [Increase Broker VM storage allocated for data caching](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/data-management/broker-vm/manage-broker-vm/increase-broker-vm-storage-allocated-for-data-caching.md): Increase Broker VM storage available for cached data. - [Monitor Broker VM using Prometheus](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/data-management/broker-vm/manage-broker-vm/monitor-broker-vm-using-prometheus.md): Monitor Broker VM metrics with Prometheus. - [Collect Broker VM Logs](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/data-management/broker-vm/manage-broker-vm/collect-broker-vm-logs.md): Collect Broker VM logs for troubleshooting and support. - [Upgrade Broker VM](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/data-management/broker-vm/manage-broker-vm/upgrade-broker-vm.md): Upgrade Broker VM to the latest supported version. - [Update Broker VM applets independently](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/data-management/broker-vm/manage-broker-vm/update-broker-vm-applets-independently.md): Update Broker VM data collector applets independently of the VM image. - [Import Broker VM Configuration](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/data-management/broker-vm/manage-broker-vm/import-broker-vm-configuration.md): Import an existing configuration into Broker VM. - [Open Live Terminal](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/data-management/broker-vm/manage-broker-vm/open-live-terminal.md): Open a Live Terminal session on Broker VM. - [Add Broker VM to cluster](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/data-management/broker-vm/manage-broker-vm/add-broker-vm-to-cluster.md): Add a Broker VM node to a high availability cluster. - [Switchover Primary Node in Cluster](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/data-management/broker-vm/manage-broker-vm/switchover-primary-node-in-cluster.md): Switch the primary node in a Broker VM high availability cluster. - [Remove from Cluster](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/data-management/broker-vm/manage-broker-vm/remove-from-cluster.md): Remove a Broker VM node from its high availability cluster. - [Manage Broker VM data collector applets](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/data-management/broker-vm/manage-broker-vm-data-collector-applets.md): Manage data collector applets installed on Broker VM. - [Broker VM High Availability Cluster](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/data-management/broker-vm/broker-vm-high-availability-cluster.md): Use Broker VM high availability clusters for resilient data collection. - [Configure High Availability Cluster](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/data-management/broker-vm/broker-vm-high-availability-cluster/configure-high-availability-cluster.md): Configure a high availability cluster for Broker VM. - [Manage Broker VM clusters](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/data-management/broker-vm/broker-vm-high-availability-cluster/manage-broker-vm-clusters.md): Manage Broker VM high availability clusters and their members. - [View cluster details](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/data-management/broker-vm/broker-vm-high-availability-cluster/manage-broker-vm-clusters/view-cluster-details.md): View status, configuration, and members for a Broker VM cluster. - [Edit cluster](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/data-management/broker-vm/broker-vm-high-availability-cluster/manage-broker-vm-clusters/edit-cluster.md): Edit the configuration of a Broker VM cluster. - [Add applet to cluster](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/data-management/broker-vm/broker-vm-high-availability-cluster/manage-broker-vm-clusters/add-applet-to-cluster.md): Add a data collector applet to a Broker VM cluster. - [Add Broker VM to cluster](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/data-management/broker-vm/broker-vm-high-availability-cluster/manage-broker-vm-clusters/add-broker-vm-to-cluster.md): Add a Broker VM node to a high availability cluster. - [Remove cluster](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/data-management/broker-vm/broker-vm-high-availability-cluster/manage-broker-vm-clusters/remove-cluster.md): Remove a Broker VM high availability cluster. - [Broker VM notifications](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/data-management/broker-vm/broker-vm-notifications.md): Configure and review Broker VM notifications. - [Monitor Broker VM activity](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/data-management/broker-vm/monitor-broker-vm-activity.md): Monitor Broker VM activity and operational status. - [Troubleshoot Broker VM applet errors](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/data-management/broker-vm/troubleshoot-broker-vm-applet-errors.md): Troubleshoot errors reported by Broker VM data collector applets. - [Dataset management](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/data-management/dataset-management.md): Learn more about managing your datasets and understanding your overall data storage, period-based retention. - [What are datasets?](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/data-management/dataset-management/what-are-datasets.md): Learn how to import, delete, and interact with custom or third-party datasets in Cortex Cloud. - [Lookup datasets](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/data-management/dataset-management/lookup-datasets.md): Learn more about lookup datasets to correlate data from a data source with events in your environment. - [Import a lookup dataset](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/data-management/dataset-management/lookup-datasets/import-a-lookup-dataset.md): Import a lookup dataset for correlating data in Cortex Cloud. - [Download JSON file of lookup dataset](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/data-management/dataset-management/lookup-datasets/download-json-file-of-lookup-dataset.md): Download lookup dataset contents as a JSON file. - [Set time to live for lookup datasets](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/data-management/dataset-management/lookup-datasets/set-time-to-live-for-lookup-datasets.md): Set how long lookup dataset entries remain available. - [Monitor datasets and dataset views activity](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/data-management/dataset-management/monitor-datasets-and-dataset-views-activity.md): Learn more about the monitored Cortex Cloud datasets and dataset views activities. - [Manage Event Forwarding](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/data-management/manage-event-forwarding.md): Save your ingested, parsed data in an external location by exporting your event logs to a temporary GCP storage bucket. - [Upload to a temporary GCP storage bucket](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/data-management/manage-event-forwarding/upload-to-a-temporary-gcp-storage-bucket.md): Save your ingested, parsed data in an external location by exporting your event logs to a temporary GCP storage bucket. - [Endpoints Event Forwarding - included/excluded fields by event type](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/data-management/manage-event-forwarding/endpoints-event-forwarding-includedexcluded-fields-by-event-type.md): Learn more about the included/excluded fields by event type for Endpoint Event Forwarding in Cortex Cloud. - [Manage compute units](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/data-management/manage-compute-units.md): Learn more about managing and tracking your compute units usage for API and Cold Storage XQL queries. - [Compute units usage](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/data-management/manage-compute-units/compute-units-usage.md): Learn more about how to compute units CU) works according to your license and available options after reaching your quota. - [What are Cortex Cloud data sources and connectors?](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cortex-cloud-data-sources-and-connectors/what-are-cortex-cloud-data-sources.md): Learn more about Cortex Cloud data sources and connectors with a unified approach to integrations. - [What is the data source and connector catalog?](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cortex-cloud-data-sources-and-connectors/complete-data-source-catalog.md): Learn more about the complete data source and connector catalog available in Cortex Cloud. - [Vendor-specific data sources and connectors](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cortex-cloud-data-sources-and-connectors/vendor-specific-data-sources.md): Browse vendor-specific data sources and connectors for Cortex Cloud. - [AbuseIPDB](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cortex-cloud-data-sources-and-connectors/vendor-specific-data-sources/abuseipdb.md): Configure the AbuseIPDB connector for Cortex Cloud. - [AbuseIPDB](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cortex-cloud-data-sources-and-connectors/vendor-specific-data-sources/abuseipdb/abuseipdb.md): Use AbuseIPDB data with Cortex Cloud. - [AIOps](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cortex-cloud-data-sources-and-connectors/vendor-specific-data-sources/aiops.md): Configure the AIOps connector for Cortex Cloud. - [AIOps](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cortex-cloud-data-sources-and-connectors/vendor-specific-data-sources/aiops/aiops.md): Use AIOps data with Cortex Cloud. - [Amazon](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cortex-cloud-data-sources-and-connectors/vendor-specific-data-sources/amazon.md): Configure the Amazon data sources and connectors for Cortex Cloud. - [Amazon S3](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cortex-cloud-data-sources-and-connectors/vendor-specific-data-sources/amazon/amazon-s3.md): Use Amazon S3 data in Cortex Cloud. - [Ingest audit logs from AWS CloudTrail](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cortex-cloud-data-sources-and-connectors/vendor-specific-data-sources/amazon/amazon-s3/ingest-audit-logs-from-aws-cloudtrail.md): Collect audit logs from AWS CloudTrail in Cortex Cloud. - [Ingest network flow logs from Amazon S3](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cortex-cloud-data-sources-and-connectors/vendor-specific-data-sources/amazon/amazon-s3/ingest-network-flow-logs-from-amazon-s3.md): Collect network flow logs from Amazon S3 in Cortex Cloud. - [Ingest generic logs from Amazon S3](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cortex-cloud-data-sources-and-connectors/vendor-specific-data-sources/amazon/amazon-s3/ingest-generic-logs-from-amazon-s3.md): Collect generic logs from Amazon S3 in Cortex Cloud. - [Ingest network Route 53 logs from Amazon S3](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cortex-cloud-data-sources-and-connectors/vendor-specific-data-sources/amazon/amazon-s3/ingest-network-route-53-logs-from-amazon-s3.md): Collect network Route 53 logs from Amazon S3 in Cortex Cloud. - [Create an assumed role](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cortex-cloud-data-sources-and-connectors/vendor-specific-data-sources/amazon/amazon-s3/create-an-assumed-role.md): Learn more about creating an assumed role in Cortex Cloud. - [Create a Workload Federated Identity role](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cortex-cloud-data-sources-and-connectors/vendor-specific-data-sources/amazon/amazon-s3/create-a-workload-federated-identity-role.md): Learn more about creating a Workload Federated Identity role in Cortex Cloud. - [Configure data collection from Amazon S3 manually](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cortex-cloud-data-sources-and-connectors/vendor-specific-data-sources/amazon/amazon-s3/configure-data-collection-from-amazon-s3-manually.md): Collect data from Amazon S3 manually in Cortex Cloud. - [Amazon Web Services](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cortex-cloud-data-sources-and-connectors/vendor-specific-data-sources/amazon/amazon-web-services.md): Use Amazon Web Services in Cortex Cloud. - [AWS Automation and Collection](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cortex-cloud-data-sources-and-connectors/vendor-specific-data-sources/amazon/aws-automation-and-collection.md): Use AWS Automation and Collection in Cortex Cloud. - [Anomali](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cortex-cloud-data-sources-and-connectors/vendor-specific-data-sources/anomali.md): Configure the Anomali connector for Cortex Cloud. - [Anomali](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cortex-cloud-data-sources-and-connectors/vendor-specific-data-sources/anomali/anomali.md): Use Anomali data with Cortex Cloud. - [Anthropic](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cortex-cloud-data-sources-and-connectors/vendor-specific-data-sources/anthropic.md): Configure the Anthropic connectors for Cortex Cloud. - [Claude](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cortex-cloud-data-sources-and-connectors/vendor-specific-data-sources/anthropic/claude.md): Use Claude with Cortex Cloud. - [API Security](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cortex-cloud-data-sources-and-connectors/vendor-specific-data-sources/api-security.md): Use API data in Cortex Cloud. - [Ingest data for API security](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cortex-cloud-data-sources-and-connectors/vendor-specific-data-sources/api-security/ingest-data-for-api-security.md): Collect API Security data with Cortex Cloud. - [Ingest AWS API Gateway](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cortex-cloud-data-sources-and-connectors/vendor-specific-data-sources/api-security/ingest-data-for-api-security/ingest-aws-api-gateway.md): Collect AWS API Gateway data with Cortex Cloud. - [Ingest Azure APIM](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cortex-cloud-data-sources-and-connectors/vendor-specific-data-sources/api-security/ingest-data-for-api-security/ingest-azure-apim.md): Collect Azure APIM data with Cortex Cloud. - [Ingest Apigee Proxy](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cortex-cloud-data-sources-and-connectors/vendor-specific-data-sources/api-security/ingest-data-for-api-security/ingest-apigee-proxy.md): Collect Apigee Proxy data with Cortex Cloud. - [Ingest Kong](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cortex-cloud-data-sources-and-connectors/vendor-specific-data-sources/api-security/ingest-data-for-api-security/ingest-kong.md): Collect Kong data with Cortex Cloud. - [Ingest F5](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cortex-cloud-data-sources-and-connectors/vendor-specific-data-sources/api-security/ingest-data-for-api-security/ingest-f5.md): Collect F5 data with Cortex Cloud. - [Atlassian](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cortex-cloud-data-sources-and-connectors/vendor-specific-data-sources/atlassian.md): Configure the Atlassian connectors for Cortex Cloud. - [Atlassian](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cortex-cloud-data-sources-and-connectors/vendor-specific-data-sources/atlassian/atlassian.md): Use Atlassian data with Cortex Cloud. - [Atlassian Automation and Collection](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cortex-cloud-data-sources-and-connectors/vendor-specific-data-sources/atlassian/atlassian-automation-and-collection.md): Use Atlassian Automation and Collection data with Cortex Cloud. - [BeyondTrust](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cortex-cloud-data-sources-and-connectors/vendor-specific-data-sources/beyondtrust.md): Configure the BeyondTrust data source for Cortex Cloud. - [BeyondTrust Privilege Management Cloud](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cortex-cloud-data-sources-and-connectors/vendor-specific-data-sources/beyondtrust/beyondtrust-privilege-management-cloud.md): Use BeyondTrust Privilege Management Cloud data with Cortex Cloud. - [Ingest logs from BeyondTrust Privilege Management Cloud](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cortex-cloud-data-sources-and-connectors/vendor-specific-data-sources/beyondtrust/beyondtrust-privilege-management-cloud/ingest-logs-from-beyondtrust-privilege-management-cloud.md): Collect BeyondTrust Privilege Management Cloud data with Cortex Cloud. - [Box](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cortex-cloud-data-sources-and-connectors/vendor-specific-data-sources/box.md): Configure the Box data source for Cortex Cloud. - [Ingest logs and data from Box](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cortex-cloud-data-sources-and-connectors/vendor-specific-data-sources/box/ingest-logs-and-data-from-box.md): Collect Box data from Cortex Cloud. - [Check Point](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cortex-cloud-data-sources-and-connectors/vendor-specific-data-sources/check-point.md): Configure the Check Point data source for Cortex Cloud. - [Check Point FW1/VPN1](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cortex-cloud-data-sources-and-connectors/vendor-specific-data-sources/check-point/check-point-fw1-vpn1.md): Use Check Point FW1/VPN1 data with Cortex Cloud. - [Cisco](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cortex-cloud-data-sources-and-connectors/vendor-specific-data-sources/cisco.md): Configure the Cisco data source for Cortex Cloud. - [Cisco ASA firewalls and AnyConnect](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cortex-cloud-data-sources-and-connectors/vendor-specific-data-sources/cisco/cisco-asa-firewalls-and-anyconnect.md): Use Cisco ASA firewalls and AnyConnect data with Cortex Cloud. - [Corelight](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cortex-cloud-data-sources-and-connectors/vendor-specific-data-sources/corelight.md): Configure the Corelight data source for Cortex Cloud. - [Corelight Zeek](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cortex-cloud-data-sources-and-connectors/vendor-specific-data-sources/corelight/corelight-zeek.md): Use Corelight Zeek data with Cortex Cloud. - [Cribl](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cortex-cloud-data-sources-and-connectors/vendor-specific-data-sources/cribl.md): Configure the Cribl connector for Cortex Cloud. - [Cribl connector](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cortex-cloud-data-sources-and-connectors/vendor-specific-data-sources/cribl/cribl-connector.md): Use Cribl connector data with Cortex Cloud. - [CyberArk](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cortex-cloud-data-sources-and-connectors/vendor-specific-data-sources/cyberark.md): Configure the CyberArk connector for Cortex Cloud. - [CyberArk](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cortex-cloud-data-sources-and-connectors/vendor-specific-data-sources/cyberark/cyberark.md): Use CyberArk data with Cortex Cloud. - [Databricks](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cortex-cloud-data-sources-and-connectors/vendor-specific-data-sources/databricks.md): Configure the Databricks data source and connector for Cortex Cloud. - [How to onboard Databricks](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cortex-cloud-data-sources-and-connectors/vendor-specific-data-sources/databricks/databricks.md): Collect Databricks data in Cortex Cloud. - [Databricks](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cortex-cloud-data-sources-and-connectors/vendor-specific-data-sources/databricks/databricks-1.md): Use Databricks data with Cortex Cloud. - [Docker](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cortex-cloud-data-sources-and-connectors/vendor-specific-data-sources/docker.md): Configure the Docker data sources for Cortex Cloud. - [Connect Docker Hub registry](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cortex-cloud-data-sources-and-connectors/vendor-specific-data-sources/docker/connect-docker-hub-registry.md): Connect a Docker Hub registry to Cortex Cloud for container image scanning. - [Manage a Docker Hub connector](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cortex-cloud-data-sources-and-connectors/vendor-specific-data-sources/docker/connect-docker-hub-registry/manage-a-docker-hub-connector.md): Manage the Docker Hub registry connector in Cortex Cloud. - [Connect Docker V2 compliant container registry](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cortex-cloud-data-sources-and-connectors/vendor-specific-data-sources/docker/connect-docker-v2-compliant-container-registry.md): Connect a Docker V2-compliant registry to Cortex Cloud for container image scanning. - [Manage a Docker V2 connector](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cortex-cloud-data-sources-and-connectors/vendor-specific-data-sources/docker/connect-docker-v2-compliant-container-registry/manage-a-docker-v2-connector.md): Manage the Docker V2-compliant registry connector in Cortex Cloud. - [Dropbox](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cortex-cloud-data-sources-and-connectors/vendor-specific-data-sources/dropbox.md): Configure the Dropbox data source for Cortex Cloud. - [Ingest logs and data from Dropbox](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cortex-cloud-data-sources-and-connectors/vendor-specific-data-sources/dropbox/ingest-logs-and-data-from-dropbox.md): Collect dropbox data in Cortex Cloud. - [Elastic](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cortex-cloud-data-sources-and-connectors/vendor-specific-data-sources/elastic.md): Configure the Elastic data sources and connectors for Cortex Cloud. - [Elasticsearch Filebeat](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cortex-cloud-data-sources-and-connectors/vendor-specific-data-sources/elastic/elasticsearch-filebeat.md): Use Elasticsearch Filebeat data with Cortex Cloud. - [Ingest logs from Elasticsearch Filebeat](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cortex-cloud-data-sources-and-connectors/vendor-specific-data-sources/elastic/elasticsearch-filebeat/ingest-logs-from-elasticsearch-filebeat.md): Collect Elasticsearch Filebeat data with Cortex Cloud. - [Windows DHCP via Elasticsearch Filebeat](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cortex-cloud-data-sources-and-connectors/vendor-specific-data-sources/elastic/windows-dhcp-via-elasticsearch-filebeat.md): Use Windows DHCP data using Elasticsearch Filebeat with Cortex Cloud. - [Ingest logs from Windows DHCP using Elasticsearch Filebeat](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cortex-cloud-data-sources-and-connectors/vendor-specific-data-sources/elastic/windows-dhcp-via-elasticsearch-filebeat/ingest-logs-from-windows-dhcp-using-elasticsearch-filebeat.md): Collect Windows DHCP data using Elasticsearch Filebeat with Cortex Cloud. - [ElasticSearch](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cortex-cloud-data-sources-and-connectors/vendor-specific-data-sources/elastic/elasticsearch.md): Use ElasticSearch data with Cortex Cloud. - [Forcepoint](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cortex-cloud-data-sources-and-connectors/vendor-specific-data-sources/forcepoint.md): Configure the Forcepoint data source for Cortex Cloud. - [Forcepoint DLP](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cortex-cloud-data-sources-and-connectors/vendor-specific-data-sources/forcepoint/forcepoint-dlp.md): Use Forcepoint DLP data with Cortex Cloud. - [Fortinet](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cortex-cloud-data-sources-and-connectors/vendor-specific-data-sources/fortinet.md): Configure the Fortinet data source for Cortex Cloud. - [Fortinet Fortigate](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cortex-cloud-data-sources-and-connectors/vendor-specific-data-sources/fortinet/fortinet-fortigate.md): Collect Fortinet Fortigate data with Cortex Cloud. - [Freshworks](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cortex-cloud-data-sources-and-connectors/vendor-specific-data-sources/freshworks.md): Configure the Freshworks connector for Cortex Cloud. - [Freshworks](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cortex-cloud-data-sources-and-connectors/vendor-specific-data-sources/freshworks/freshworks.md): Use Freshworks data with Cortex Cloud. - [Generic](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cortex-cloud-data-sources-and-connectors/vendor-specific-data-sources/generic.md): Configure the Generic connectors for Cortex Cloud. - [Generic MCP](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cortex-cloud-data-sources-and-connectors/vendor-specific-data-sources/generic/generic-mcp.md): Use Generic MCP data with Cortex Cloud. - [Generic SQL](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cortex-cloud-data-sources-and-connectors/vendor-specific-data-sources/generic/generic-sql.md): Use Generic SQL data with Cortex Cloud. - [GitHub](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cortex-cloud-data-sources-and-connectors/vendor-specific-data-sources/github.md): Configure the GitHub connector for Cortex Cloud. - [GitHub](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cortex-cloud-data-sources-and-connectors/vendor-specific-data-sources/github/github.md): Use GitHub data with Cortex Cloud. - [GitLab](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cortex-cloud-data-sources-and-connectors/vendor-specific-data-sources/gitlab.md): Configure the GitLab data source for Cortex Cloud. - [Connect GitLab container registry](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cortex-cloud-data-sources-and-connectors/vendor-specific-data-sources/gitlab/connect-gitlab-container-registry.md): Connect a GitLab container registry to Cortex Cloud for image scanning. - [Manage a GitLab Container Registry connector](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cortex-cloud-data-sources-and-connectors/vendor-specific-data-sources/gitlab/connect-gitlab-container-registry/manage-a-gitlab-container-registry-connector.md): Manage the GitLab Container Registry connector in Cortex Cloud. - [Google](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cortex-cloud-data-sources-and-connectors/vendor-specific-data-sources/google.md): Configure the Google data sources and connectors for Cortex Cloud. - [Google Cloud Platform](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cortex-cloud-data-sources-and-connectors/vendor-specific-data-sources/google/google-cloud-platform.md): Use Google Cloud Platform data with Cortex Cloud. - [Ingest logs and data from a GCP Pub/Sub](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cortex-cloud-data-sources-and-connectors/vendor-specific-data-sources/google/google-cloud-platform/ingest-logs-and-data-from-a-gcp-pub-sub.md): Collect GCP Pub/Sub data with Cortex Cloud. - [Google Kubernetes Engine](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cortex-cloud-data-sources-and-connectors/vendor-specific-data-sources/google/google-kubernetes-engine.md): Use Google Kubernetes Engine data with Cortex Cloud. - [Ingest logs from Google Kubernetes Engine](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cortex-cloud-data-sources-and-connectors/vendor-specific-data-sources/google/google-kubernetes-engine/ingest-logs-from-google-kubernetes-engine.md): Collect Google Kubernetes Engine data with Cortex Cloud. - [Google Workspace](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cortex-cloud-data-sources-and-connectors/vendor-specific-data-sources/google/google-workspace.md): Use Google Workspace data with Cortex Cloud. - [Ingest logs and data from Google Workspace](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cortex-cloud-data-sources-and-connectors/vendor-specific-data-sources/google/google-workspace/ingest-logs-and-data-from-google-workspace.md): Collect Google Workspace data with Cortex Cloud. - [Google Workspace connector](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cortex-cloud-data-sources-and-connectors/vendor-specific-data-sources/google/google-workspace/google-workspace-connector.md): Use Google Workspace with Cortex Cloud. - [Google Workspace Automation and Collection](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cortex-cloud-data-sources-and-connectors/vendor-specific-data-sources/google/google-workspace/google-workspace-automation-and-collection.md): Use Google Workspace Automation and Collection data with Cortex Cloud. - [Harbor](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cortex-cloud-data-sources-and-connectors/vendor-specific-data-sources/harbor.md): Configure the Harbor data source for Cortex Cloud. - [Connect Harbor registry](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cortex-cloud-data-sources-and-connectors/vendor-specific-data-sources/harbor/connect-harbor-registry.md): Connect a Harbor registry to Cortex Cloud for container image scanning. - [Manage a Harbor connector](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cortex-cloud-data-sources-and-connectors/vendor-specific-data-sources/harbor/connect-harbor-registry/manage-a-harbor-connector.md): Manage the Harbor registry connector in Cortex Cloud. - [HTTP log collector](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cortex-cloud-data-sources-and-connectors/vendor-specific-data-sources/http-log-collector.md): Configure the HTTP log collector data source for Cortex Cloud. - [Set up an HTTP log collector to receive logs](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cortex-cloud-data-sources-and-connectors/vendor-specific-data-sources/http-log-collector/set-up-an-http-log-collector-to-receive-logs.md): Collect HTTP log data in Cortex Cloud. - [IBM](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cortex-cloud-data-sources-and-connectors/vendor-specific-data-sources/ibm.md): Configure the IBM connectors for Cortex Cloud. - [IBM QRadar](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cortex-cloud-data-sources-and-connectors/vendor-specific-data-sources/ibm/ibm-qradar.md): Use IBM QRadar data with Cortex Cloud. - [iZOOlogic](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cortex-cloud-data-sources-and-connectors/vendor-specific-data-sources/izoologic.md): Configure the iZOOlogic connector for Cortex Cloud. - [iZOOlogic](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cortex-cloud-data-sources-and-connectors/vendor-specific-data-sources/izoologic/izoologic.md): Use iZOOlogic data with Cortex Cloud. - [JFrog](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cortex-cloud-data-sources-and-connectors/vendor-specific-data-sources/jfrog.md): Configure the JFrog data source for Cortex Cloud. - [Connect JFrog container registry](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cortex-cloud-data-sources-and-connectors/vendor-specific-data-sources/jfrog/connect-jfrog-container-registry.md): Connect a JFrog container registry to Cortex Cloud for image scanning. - [Manage a JFrog connector](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cortex-cloud-data-sources-and-connectors/vendor-specific-data-sources/jfrog/connect-jfrog-container-registry/manage-a-jfrog-connector.md): Manage the JFrog container registry connector in Cortex Cloud. - [Koi](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cortex-cloud-data-sources-and-connectors/vendor-specific-data-sources/koi.md): Configure the Koi connector for Cortex Cloud. - [Koi](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cortex-cloud-data-sources-and-connectors/vendor-specific-data-sources/koi/koi.md): Use Koi data with Cortex Cloud. - [Kubernetes](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cortex-cloud-data-sources-and-connectors/vendor-specific-data-sources/kubernetes.md): Configure the Kubernetes data source for Cortex Cloud. - [Onboard the Kubernetes connector](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cortex-cloud-data-sources-and-connectors/vendor-specific-data-sources/kubernetes/onboard-the-kubernetes-connector.md): Use Kubernetes data with Cortex Cloud. - [What's new in Kubernetes connector](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cortex-cloud-data-sources-and-connectors/vendor-specific-data-sources/kubernetes/whats-new-in-kubernetes-connector.md): Learn more about the changes, additions, known issues, and fixes for each version of the Kubernetes connector. - [Supported Kubernetes distributions](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cortex-cloud-data-sources-and-connectors/vendor-specific-data-sources/kubernetes/supported-kubernetes-distributions.md): Learn more about the supported Kubernetes platform versions for the Kubernetes connector. - [Mail Utilities](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cortex-cloud-data-sources-and-connectors/vendor-specific-data-sources/mail-utilities.md): Configure the Mail Utilities connector for Cortex Cloud. - [Mail Utilities](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cortex-cloud-data-sources-and-connectors/vendor-specific-data-sources/mail-utilities/mail-utilities.md): Use Mail Utilities data with Cortex Cloud. - [Microsoft](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cortex-cloud-data-sources-and-connectors/vendor-specific-data-sources/microsoft.md): Configure the Microsoft data sources and connectors for Cortex Cloud. - [Azure Event Hub](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cortex-cloud-data-sources-and-connectors/vendor-specific-data-sources/microsoft/azure-event-hub.md): Use Azure Event Hub data with Cortex Cloud. - [Ingest logs from Microsoft Azure Event Hub](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cortex-cloud-data-sources-and-connectors/vendor-specific-data-sources/microsoft/azure-event-hub/ingest-logs-from-microsoft-azure-event-hub.md): Collect Microsoft Azure Event Hub data with Cortex Cloud. - [Microsoft Azure](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cortex-cloud-data-sources-and-connectors/vendor-specific-data-sources/microsoft/microsoft-azure.md): Use Microsoft Azure data with Cortex Cloud. - [Microsoft Entra ID](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cortex-cloud-data-sources-and-connectors/vendor-specific-data-sources/microsoft/microsoft-entra-id.md): Use Microsoft Entra ID data with Cortex Cloud. - [Microsoft365 (legacy)](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cortex-cloud-data-sources-and-connectors/vendor-specific-data-sources/microsoft/microsoft365-legacy.md): Use Microsoft365 data with Cortex Cloud. - [Migrate to new Microsoft 365 connector](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cortex-cloud-data-sources-and-connectors/vendor-specific-data-sources/microsoft/microsoft365-legacy/migrate-to-new-microsoft-365-connector.md) - [Microsoft 365 (new)](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cortex-cloud-data-sources-and-connectors/vendor-specific-data-sources/microsoft/microsoft-365-new.md): Use Microsoft 365 data with Cortex Cloud. - [Create a Microsoft Entra ID](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cortex-cloud-data-sources-and-connectors/vendor-specific-data-sources/microsoft/microsoft-365-new/create-a-microsoft-entra-id.md) - [Microsoft Office 365](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cortex-cloud-data-sources-and-connectors/vendor-specific-data-sources/microsoft/microsoft-office-365.md): Use Microsoft Office 365 data with Cortex Cloud. - [Ingest logs from Microsoft Office 365](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cortex-cloud-data-sources-and-connectors/vendor-specific-data-sources/microsoft/microsoft-office-365/ingest-logs-from-microsoft-office-365.md): Collect Microsoft Office 365 data with Cortex Cloud. - [Microsoft Office 365 (email)](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cortex-cloud-data-sources-and-connectors/vendor-specific-data-sources/microsoft/microsoft-office-365-email.md): Use Microsoft Office 365 (email) data with Cortex Cloud. - [Ingest logs and data from Microsoft 365](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cortex-cloud-data-sources-and-connectors/vendor-specific-data-sources/microsoft/microsoft-office-365-email/ingest-logs-and-data-from-microsoft-365.md): Collect Microsoft 365 data with Cortex Cloud. - [Microsoft 365 (Posture)](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cortex-cloud-data-sources-and-connectors/vendor-specific-data-sources/microsoft/microsoft-365-posture.md): Use Microsoft 365 (Posture) data with Cortex Cloud. - [How to onboard Microsoft 365](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cortex-cloud-data-sources-and-connectors/vendor-specific-data-sources/microsoft/microsoft-365-posture/how-to-onboard-microsoft-365.md): Learn more about adding Microsoft 365 as a third-party data source in Cortex Cloud. - [Microsoft Teams](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cortex-cloud-data-sources-and-connectors/vendor-specific-data-sources/microsoft/microsoft-teams.md): Use Microsoft Teams data with Cortex Cloud. - [Microsoft Active Directory](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cortex-cloud-data-sources-and-connectors/vendor-specific-data-sources/microsoft/microsoft-active-directory.md): Use Microsoft Active Directory data with Cortex Cloud. - [Microsoft Graph](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cortex-cloud-data-sources-and-connectors/vendor-specific-data-sources/microsoft/microsoft-graph.md): Use Microsoft Graph data with Cortex Cloud. - [Microsoft Identity](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cortex-cloud-data-sources-and-connectors/vendor-specific-data-sources/microsoft/microsoft-identity.md): Use Microsoft Identity data with Cortex Cloud. - [Microsoft Security Automation and Collection](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cortex-cloud-data-sources-and-connectors/vendor-specific-data-sources/microsoft/microsoft-security-automation-and-collection.md): Use Microsoft Security Automation and Collection data with Cortex Cloud. - [M365 Automation and Collection](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cortex-cloud-data-sources-and-connectors/vendor-specific-data-sources/microsoft/m365-automation-and-collection.md): Use M365 Automation and Collection data with Cortex Cloud. - [Monday](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cortex-cloud-data-sources-and-connectors/vendor-specific-data-sources/monday.md): Configure the Monday connectors for Cortex Cloud. - [Monday](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cortex-cloud-data-sources-and-connectors/vendor-specific-data-sources/monday/monday.md): Use Monday data with Cortex Cloud. - [MongoDB](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cortex-cloud-data-sources-and-connectors/vendor-specific-data-sources/mongodb.md): Configure the MongoDB connectors for Cortex Cloud. - [MongoDB Atlas](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cortex-cloud-data-sources-and-connectors/vendor-specific-data-sources/mongodb/mongodb-atlas.md): Use MongoDB Atlas data with Cortex Cloud. - [Okta](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cortex-cloud-data-sources-and-connectors/vendor-specific-data-sources/okta.md): Configure the Okta data source and connector for Cortex Cloud. - [Ingest logs and data from Okta](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cortex-cloud-data-sources-and-connectors/vendor-specific-data-sources/okta/ingest-logs-and-data-from-okta.md): Configure Okta log and data collection for Cortex Cloud. - [Okta Automation and Collection](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cortex-cloud-data-sources-and-connectors/vendor-specific-data-sources/okta/okta-automation-and-collection.md): Configure Okta automation and collection for Cortex Cloud. - [OneLogin](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cortex-cloud-data-sources-and-connectors/vendor-specific-data-sources/onelogin.md): Configure the OneLogin data source for Cortex XSIAM. - [Ingest logs and data from OneLogin](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cortex-cloud-data-sources-and-connectors/vendor-specific-data-sources/onelogin/ingest-logs-and-data-from-onelogin.md): Configure OneLogin log and directory data collection for Cortex Cloud. - [Oracle](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cortex-cloud-data-sources-and-connectors/vendor-specific-data-sources/oracle.md): Configure the Oracle data source for Cortex Cloud. - [Oracle Cloud Infrastructure](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cortex-cloud-data-sources-and-connectors/vendor-specific-data-sources/oracle/oracle-cloud-infrastructure.md): Configure Oracle Cloud Infrastructure data source for Cortex Cloud. - [PagerDuty](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cortex-cloud-data-sources-and-connectors/vendor-specific-data-sources/pagerduty.md): Configure the PagerDuty connector for Cortex XSIAM. - [PagerDuty Automation and Collection](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cortex-cloud-data-sources-and-connectors/vendor-specific-data-sources/pagerduty/pagerduty-automation-and-collection.md): Configure PagerDuty automation and collection for Cortex Cloud. - [Ping Identity](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cortex-cloud-data-sources-and-connectors/vendor-specific-data-sources/ping-identity.md): Configure the Ping Identity data sources for Cortex Cloud. - [PingFederate](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cortex-cloud-data-sources-and-connectors/vendor-specific-data-sources/ping-identity/pingfederate.md): Configure PingFederate authentication log collection for Cortex Cloud. - [PingOne](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cortex-cloud-data-sources-and-connectors/vendor-specific-data-sources/ping-identity/pingone.md): Configure PingOne data sources for Cortex Cloud. - [Ingest authentication logs and data from PingOne](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cortex-cloud-data-sources-and-connectors/vendor-specific-data-sources/ping-identity/pingone/ingest-authentication-logs-and-data-from-pingone.md): Ingest PingOne authentication logs and data into Cortex Cloud. - [Salesforce](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cortex-cloud-data-sources-and-connectors/vendor-specific-data-sources/salesforce.md): Configure the Salesforce data source and connector for Cortex Cloud. - [Ingest logs and data from Salesforce](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cortex-cloud-data-sources-and-connectors/vendor-specific-data-sources/salesforce/ingest-logs-and-data-from-salesforce.md): Ingest Salesforce logs and data into Cortex Cloud. - [Salesforce connector](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cortex-cloud-data-sources-and-connectors/vendor-specific-data-sources/salesforce/ingest-and-run-salesforce-automation-and-remediation.md): Use Salesforce data in Cortex Cloud. - [ServiceNow](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cortex-cloud-data-sources-and-connectors/vendor-specific-data-sources/servicenow.md): Configure the ServiceNow data sources for Cortex Cloud. - [ServiceNow Automation and Collection](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cortex-cloud-data-sources-and-connectors/vendor-specific-data-sources/servicenow/servicenow-automation-and-collection.md): Configure ServiceNow automation and collection for Cortex Cloud. - [ServiceNow](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cortex-cloud-data-sources-and-connectors/vendor-specific-data-sources/servicenow/servicenow.md): Use ServiceNow data in Cortex Cloud. - [Slack](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cortex-cloud-data-sources-and-connectors/vendor-specific-data-sources/slack.md): Configure the Slack connectors for Cortex Cloud. - [Slack Automation and Collection](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cortex-cloud-data-sources-and-connectors/vendor-specific-data-sources/slack/slack-automation-and-collection.md): Configure Slack automation, notifications, and audit log collection for Cortex Cloud. - [Slack Enterprise](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cortex-cloud-data-sources-and-connectors/vendor-specific-data-sources/slack/slack-enterprise.md): Configure Slack Enterprise identity and SaaS posture monitoring for Cortex Cloud. - [SMB](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cortex-cloud-data-sources-and-connectors/vendor-specific-data-sources/smb.md): Configure the SMB connector for Cortex Cloud. - [SMB](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cortex-cloud-data-sources-and-connectors/vendor-specific-data-sources/smb/smb.md): Use SMB data for Cortex Cloud file and directory management. - [Snowflake](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cortex-cloud-data-sources-and-connectors/vendor-specific-data-sources/snowflake.md): Configure the Snowflake data source for Cortex Cloud. - [How to onboard Snowflake](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cortex-cloud-data-sources-and-connectors/vendor-specific-data-sources/snowflake/how-to-onboard-snowflake.md): Onboard Snowflake as a data source in Cortex Cloud. - [Sonatype Nexus registry](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cortex-cloud-data-sources-and-connectors/vendor-specific-data-sources/sonatype-nexus-registry.md): Configure the Sonatype Nexus connector for Cortex Cloud. - [Connect Sonatype Nexus registry](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cortex-cloud-data-sources-and-connectors/vendor-specific-data-sources/sonatype-nexus-registry/connect-sonatype-nexus-registry.md): Use Sonatype Nexus registry data in Cortex Cloud for container image scanning. - [Manage a Sonatype connector](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cortex-cloud-data-sources-and-connectors/vendor-specific-data-sources/sonatype-nexus-registry/connect-sonatype-nexus-registry/manage-a-sonatype-connector.md): Manage the Sonatype registry connector in Cortex Cloud. - [Workday](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cortex-cloud-data-sources-and-connectors/vendor-specific-data-sources/workday.md): Configure the Workday data source in Cortex Cloud. - [Ingest report data from Workday](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cortex-cloud-data-sources-and-connectors/vendor-specific-data-sources/workday/ingest-report-data-from-workday.md): Ingest Workday report data into Cortex Cloud. - [Zendesk](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cortex-cloud-data-sources-and-connectors/vendor-specific-data-sources/zendesk.md): Configure the Zendesk connector for Cortex Cloud. - [Zendesk](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cortex-cloud-data-sources-and-connectors/vendor-specific-data-sources/zendesk/zendesk.md): Use Zendesk data in Cortex Cloud. - [Zscaler](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cortex-cloud-data-sources-and-connectors/vendor-specific-data-sources/zscaler.md): Configure the Zscaler data sources for Cortex Cloud. - [Zscaler Internet Access](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cortex-cloud-data-sources-and-connectors/vendor-specific-data-sources/zscaler/zscaler-internet-access.md): Configure Zscaler Internet Access (ZIA) log collection in Cortex Cloud. - [Zscaler Private Access](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cortex-cloud-data-sources-and-connectors/vendor-specific-data-sources/zscaler/zscaler-private-access.md): Configure Zscaler Private Access (ZPA) log collection in Cortex Cloud. - [Zscaler](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cortex-cloud-data-sources-and-connectors/vendor-specific-data-sources/zscaler/zscaler.md): Use Zscaler data in Cortex Cloud for ZIA log collection and security management. - [Connectors](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cortex-cloud-data-sources-and-connectors/connectors.md) - [Standard data sources](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cortex-cloud-data-sources-and-connectors/standard-data-sources.md) - [Cloud service provider (CSP) onboarding](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cortex-cloud-data-sources-and-connectors/cloud-service-provider-csp-onboarding.md): Learn more about onboarding cloud data sources to Cortex Cloud. - [Generic on-premise data collectors](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cortex-cloud-data-sources-and-connectors/generic-on-premise-data-collectors.md) - [Broker VM data collector applets](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cortex-cloud-data-sources-and-connectors/generic-on-premise-data-collectors/broker-vm-data-collector-applets.md) - [Activate Apache Kafka Collector](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cortex-cloud-data-sources-and-connectors/generic-on-premise-data-collectors/broker-vm-data-collector-applets/activate-apache-kafka-collector.md) - [Activate CSV Collector](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cortex-cloud-data-sources-and-connectors/generic-on-premise-data-collectors/broker-vm-data-collector-applets/activate-csv-collector.md) - [Activate Database Collector](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cortex-cloud-data-sources-and-connectors/generic-on-premise-data-collectors/broker-vm-data-collector-applets/activate-database-collector.md) - [Activate DSPM Database](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cortex-cloud-data-sources-and-connectors/generic-on-premise-data-collectors/broker-vm-data-collector-applets/activate-dspm-database.md): Configure the DSPM Database applet for Cortex Cloud. - [Activate DSPM Fileshare](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cortex-cloud-data-sources-and-connectors/generic-on-premise-data-collectors/broker-vm-data-collector-applets/activate-dspm-fileshare.md): Configure the DSPM Fileshare applet for Cortex Cloud. - [Activate Files and Folders Collector](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cortex-cloud-data-sources-and-connectors/generic-on-premise-data-collectors/broker-vm-data-collector-applets/activate-files-and-folders-collector.md) - [Activate FTP Collector](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cortex-cloud-data-sources-and-connectors/generic-on-premise-data-collectors/broker-vm-data-collector-applets/activate-ftp-collector.md) - [Activate Local Agent Settings](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cortex-cloud-data-sources-and-connectors/generic-on-premise-data-collectors/broker-vm-data-collector-applets/activate-local-agent-settings.md) - [Activate NetFlow Collector](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cortex-cloud-data-sources-and-connectors/generic-on-premise-data-collectors/broker-vm-data-collector-applets/activate-netflow-collector.md) - [Activate Network Mapper](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cortex-cloud-data-sources-and-connectors/generic-on-premise-data-collectors/broker-vm-data-collector-applets/activate-network-mapper.md) - [Activate Registry Scanner](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cortex-cloud-data-sources-and-connectors/generic-on-premise-data-collectors/broker-vm-data-collector-applets/activate-registry-scanner.md): Configure Registry Scanner applet for Cortex Cloud. - [Syslog Collector applet](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cortex-cloud-data-sources-and-connectors/generic-on-premise-data-collectors/broker-vm-data-collector-applets/syslog-collector-applet.md) - [Activate Syslog Collector](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cortex-cloud-data-sources-and-connectors/generic-on-premise-data-collectors/broker-vm-data-collector-applets/syslog-collector-applet/activate-syslog-collector.md) - [Ingest logs from a Syslog receiver](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cortex-cloud-data-sources-and-connectors/generic-on-premise-data-collectors/broker-vm-data-collector-applets/syslog-collector-applet/ingest-logs-from-a-syslog-receiver.md): To extend visibility, Cortex Cloud can receive Syslog from additional vendors that use CEF or LEEF formatted over Syslog (TLS not supported). - [Check Point FW1 VPN1](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cortex-cloud-data-sources-and-connectors/generic-on-premise-data-collectors/broker-vm-data-collector-applets/syslog-collector-applet/check-point-fw1-vpn1.md) - [Ingest logs from Check Point firewalls](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cortex-cloud-data-sources-and-connectors/generic-on-premise-data-collectors/broker-vm-data-collector-applets/syslog-collector-applet/check-point-fw1-vpn1/ingest-logs-from-check-point-firewalls.md) - [Cisco ASA firewalls and AnyConnect](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cortex-cloud-data-sources-and-connectors/generic-on-premise-data-collectors/broker-vm-data-collector-applets/syslog-collector-applet/cisco-asa-firewalls-and-anyconnect.md) - [Ingest logs from Cisco ASA firewalls and AnyConnect](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cortex-cloud-data-sources-and-connectors/generic-on-premise-data-collectors/broker-vm-data-collector-applets/syslog-collector-applet/cisco-asa-firewalls-and-anyconnect/ingest-logs-from-cisco-asa-firewalls-and-anyconnect.md) - [Corelight Zeek](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cortex-cloud-data-sources-and-connectors/generic-on-premise-data-collectors/broker-vm-data-collector-applets/syslog-collector-applet/corelight-zeek.md) - [Ingest logs from Corelight Zeek](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cortex-cloud-data-sources-and-connectors/generic-on-premise-data-collectors/broker-vm-data-collector-applets/syslog-collector-applet/corelight-zeek/ingest-logs-from-corelight-zeek.md) - [Forcepoint DLP](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cortex-cloud-data-sources-and-connectors/generic-on-premise-data-collectors/broker-vm-data-collector-applets/syslog-collector-applet/forcepoint-dlp.md) - [Ingest logs from Forcepoint DLP](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cortex-cloud-data-sources-and-connectors/generic-on-premise-data-collectors/broker-vm-data-collector-applets/syslog-collector-applet/forcepoint-dlp/ingest-logs-from-forcepoint-dlp.md) - [Fortinet Fortigate](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cortex-cloud-data-sources-and-connectors/generic-on-premise-data-collectors/broker-vm-data-collector-applets/syslog-collector-applet/fortinet-fortigate.md) - [Ingest logs from Fortinet Fortigate firewalls](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cortex-cloud-data-sources-and-connectors/generic-on-premise-data-collectors/broker-vm-data-collector-applets/syslog-collector-applet/fortinet-fortigate/ingest-logs-from-fortinet-fortigate-firewalls.md) - [Next Generation Firewall](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cortex-cloud-data-sources-and-connectors/generic-on-premise-data-collectors/broker-vm-data-collector-applets/syslog-collector-applet/next-generation-firewall.md) - [Ingest Next-Generation Firewall logs using the Syslog Collector](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cortex-cloud-data-sources-and-connectors/generic-on-premise-data-collectors/broker-vm-data-collector-applets/syslog-collector-applet/next-generation-firewall/ingest-next-generation-firewall-logs-using-the-syslog-collector.md) - [PingFederate](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cortex-cloud-data-sources-and-connectors/generic-on-premise-data-collectors/broker-vm-data-collector-applets/syslog-collector-applet/pingfederate.md) - [Ingest authentication logs from PingFederate](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cortex-cloud-data-sources-and-connectors/generic-on-premise-data-collectors/broker-vm-data-collector-applets/syslog-collector-applet/pingfederate/ingest-authentication-logs-from-pingfederate.md) - [Zscaler Internet Access](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cortex-cloud-data-sources-and-connectors/generic-on-premise-data-collectors/broker-vm-data-collector-applets/syslog-collector-applet/zscaler-internet-access.md) - [Ingest logs from Zscaler Internet Access](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cortex-cloud-data-sources-and-connectors/generic-on-premise-data-collectors/broker-vm-data-collector-applets/syslog-collector-applet/zscaler-internet-access/ingest-logs-from-zscaler-internet-access.md) - [Zscaler Private Access](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cortex-cloud-data-sources-and-connectors/generic-on-premise-data-collectors/broker-vm-data-collector-applets/syslog-collector-applet/zscaler-private-access.md) - [Ingest logs from Zscaler Private Access](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cortex-cloud-data-sources-and-connectors/generic-on-premise-data-collectors/broker-vm-data-collector-applets/syslog-collector-applet/zscaler-private-access/ingest-logs-from-zscaler-private-access.md) - [Activate Transporter](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cortex-cloud-data-sources-and-connectors/generic-on-premise-data-collectors/broker-vm-data-collector-applets/activate-transporter.md) - [Activate Windows Event Collector](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cortex-cloud-data-sources-and-connectors/generic-on-premise-data-collectors/broker-vm-data-collector-applets/activate-windows-event-collector.md) - [Activate Windows Event Collector on Windows Core](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cortex-cloud-data-sources-and-connectors/generic-on-premise-data-collectors/broker-vm-data-collector-applets/activate-windows-event-collector/activate-windows-event-collector-on-windows-core.md) - [Renew WEC certificates](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cortex-cloud-data-sources-and-connectors/generic-on-premise-data-collectors/broker-vm-data-collector-applets/activate-windows-event-collector/renew-wec-certificates.md) - [XDR Collectors](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cortex-cloud-data-sources-and-connectors/generic-on-premise-data-collectors/xdr-collectors.md) - [XDR Collector audit logs](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cortex-cloud-data-sources-and-connectors/generic-on-premise-data-collectors/xdr-collectors/xdr-collector-audit-logs.md) - [XDR Collector machine requirements and supported operating systems](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cortex-cloud-data-sources-and-connectors/generic-on-premise-data-collectors/xdr-collectors/xdr-collector-machine-requirements-and-supported-operating-systems.md) - [Resources required to enable access to XDR collectors](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cortex-cloud-data-sources-and-connectors/generic-on-premise-data-collectors/xdr-collectors/resources-required-to-enable-access-to-xdr-collectors.md) - [Manage XDR Collectors](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cortex-cloud-data-sources-and-connectors/generic-on-premise-data-collectors/xdr-collectors/manage-xdr-collectors.md) - [XDR Collectors installation resource for Windows and Linux](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cortex-cloud-data-sources-and-connectors/generic-on-premise-data-collectors/xdr-collectors/manage-xdr-collectors/xdr-collectors-installation-resource-for-windows-and-linux.md) - [Create an XDR Collector installation package](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cortex-cloud-data-sources-and-connectors/generic-on-premise-data-collectors/xdr-collectors/manage-xdr-collectors/create-an-xdr-collector-installation-package.md) - [Install the XDR Collector installation package for Windows](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cortex-cloud-data-sources-and-connectors/generic-on-premise-data-collectors/xdr-collectors/manage-xdr-collectors/install-the-xdr-collector-installation-package-for-windows.md) - [Install the XDR collector on Windows using the MSI](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cortex-cloud-data-sources-and-connectors/generic-on-premise-data-collectors/xdr-collectors/manage-xdr-collectors/install-the-xdr-collector-installation-package-for-windows/install-the-xdr-collector-on-windows-using-the-msi.md) - [Install the XDR Collector on Windows using Msiexec](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cortex-cloud-data-sources-and-connectors/generic-on-premise-data-collectors/xdr-collectors/manage-xdr-collectors/install-the-xdr-collector-installation-package-for-windows/install-the-xdr-collector-on-windows-using-msiexec.md) - [Install the XDR Collector installation package for Linux](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cortex-cloud-data-sources-and-connectors/generic-on-premise-data-collectors/xdr-collectors/manage-xdr-collectors/install-the-xdr-collector-installation-package-for-linux.md) - [Configure XDR Collector upgrade scheduler](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cortex-cloud-data-sources-and-connectors/generic-on-premise-data-collectors/xdr-collectors/manage-xdr-collectors/configure-xdr-collector-upgrade-scheduler.md) - [Set an application proxy for XDR Collectors](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cortex-cloud-data-sources-and-connectors/generic-on-premise-data-collectors/xdr-collectors/manage-xdr-collectors/set-an-application-proxy-for-xdr-collectors.md) - [Set an alias for an XDR Collector machine](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cortex-cloud-data-sources-and-connectors/generic-on-premise-data-collectors/xdr-collectors/manage-xdr-collectors/set-an-alias-for-an-xdr-collector-machine.md) - [Upgrade XDR Collectors](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cortex-cloud-data-sources-and-connectors/generic-on-premise-data-collectors/xdr-collectors/manage-xdr-collectors/upgrade-xdr-collectors.md) - [Uninstall the XDR Collector](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cortex-cloud-data-sources-and-connectors/generic-on-premise-data-collectors/xdr-collectors/manage-xdr-collectors/uninstall-the-xdr-collector.md) - [Define XDR Collector machine groups](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cortex-cloud-data-sources-and-connectors/generic-on-premise-data-collectors/xdr-collectors/manage-xdr-collectors/define-xdr-collector-machine-groups.md) - [About Cortex Cloud Collector content updates](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cortex-cloud-data-sources-and-connectors/generic-on-premise-data-collectors/xdr-collectors/manage-xdr-collectors/about-cortex-cloud-collector-content-updates.md) - [XDR Collector profiles](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cortex-cloud-data-sources-and-connectors/generic-on-premise-data-collectors/xdr-collectors/xdr-collector-profiles.md) - [Add an XDR Collector profile for Windows](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cortex-cloud-data-sources-and-connectors/generic-on-premise-data-collectors/xdr-collectors/xdr-collector-profiles/add-an-xdr-collector-profile-for-windows.md) - [How to configure XDR Collector profiles](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cortex-cloud-data-sources-and-connectors/generic-on-premise-data-collectors/xdr-collectors/xdr-collector-profiles/add-an-xdr-collector-profile-for-windows/how-to-configure-xdr-collector-profiles.md) - [Additional XDR Collector profile management options](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cortex-cloud-data-sources-and-connectors/generic-on-premise-data-collectors/xdr-collectors/xdr-collector-profiles/add-an-xdr-collector-profile-for-windows/additional-xdr-collector-profile-management-options.md) - [Query Windows Event Log records](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cortex-cloud-data-sources-and-connectors/generic-on-premise-data-collectors/xdr-collectors/xdr-collector-profiles/add-an-xdr-collector-profile-for-windows/query-windows-event-log-records.md) - [Ingest logs from Windows DHCP using Elasticsearch Filebeat](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cortex-cloud-data-sources-and-connectors/generic-on-premise-data-collectors/xdr-collectors/xdr-collector-profiles/ingest-logs-from-windows-dhcp-using-elasticsearch-filebeat.md) - [Ingest Windows DNS debug logs using Elasticsearch Filebeat](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cortex-cloud-data-sources-and-connectors/generic-on-premise-data-collectors/xdr-collectors/xdr-collector-profiles/ingest-windows-dns-debug-logs-using-elasticsearch-filebeat.md) - [Add an XDR Collector profile for Linux](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cortex-cloud-data-sources-and-connectors/generic-on-premise-data-collectors/xdr-collectors/xdr-collector-profiles/add-an-xdr-collector-profile-for-linux.md) - [Apply profiles to collection machine policies](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cortex-cloud-data-sources-and-connectors/generic-on-premise-data-collectors/xdr-collectors/apply-profiles-to-collection-machine-policies.md) - [XDR Collector datasets](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cortex-cloud-data-sources-and-connectors/generic-on-premise-data-collectors/xdr-collectors/xdr-collector-datasets.md) - [Palo Alto Networks integrations](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cortex-cloud-data-sources-and-connectors/palo-alto-networks-integrations.md): Cortex Cloud supports data ingestion from other Palo Alto Networks products. - [About Palo Alto Networks integrations](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cortex-cloud-data-sources-and-connectors/palo-alto-networks-integrations/about-palo-alto-networks-integrations.md): Stream data directly from other Palo Alto Networks products to Cortex Cloud. - [Cloud Next-Generation Firewall](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cortex-cloud-data-sources-and-connectors/palo-alto-networks-integrations/cloud-next-generation-firewall.md): Learn more ingesting firewall data from your Next-Generation Firewall (NGFW) and Panorama devices in Cortex Cloud. - [Ingest data from Cloud Next-Generation Firewall](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cortex-cloud-data-sources-and-connectors/palo-alto-networks-integrations/cloud-next-generation-firewall/ingest-data-from-cloud-next-generation-firewall.md) - [Next-Generation Firewall](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cortex-cloud-data-sources-and-connectors/palo-alto-networks-integrations/next-generation-firewall.md) - [Ingest data from Next-Generation Firewall](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cortex-cloud-data-sources-and-connectors/palo-alto-networks-integrations/next-generation-firewall/ingest-data-from-next-generation-firewall.md) - [Ingest Next-Generation Firewall logs using the Syslog collector](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cortex-cloud-data-sources-and-connectors/palo-alto-networks-integrations/next-generation-firewall/ingest-next-generation-firewall-logs-using-the-syslog-collector.md) - [Panorama](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cortex-cloud-data-sources-and-connectors/palo-alto-networks-integrations/next-generation-firewall/panorama.md) - [Prisma Access](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cortex-cloud-data-sources-and-connectors/palo-alto-networks-integrations/prisma-access.md) - [Ingest data from Prisma Access](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cortex-cloud-data-sources-and-connectors/palo-alto-networks-integrations/prisma-access/ingest-data-from-prisma-access.md): Learn how to ingest detection data from Prisma Access. - [Palo Alto Networks Prisma](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cortex-cloud-data-sources-and-connectors/palo-alto-networks-integrations/prisma-access/palo-alto-networks-prisma.md) - [Ingest logs from Prisma Access Browser](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cortex-cloud-data-sources-and-connectors/palo-alto-networks-integrations/ingest-logs-from-prisma-access-browser.md): Ingest Prisma Browser logs into Cortex Cloud. - [Ingest detection data from Strata Logging Service](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cortex-cloud-data-sources-and-connectors/palo-alto-networks-integrations/ingest-detection-data-from-strata-logging-service.md): Learn how to ingest detection data from Strata Logging Service. - [IoT Security](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cortex-cloud-data-sources-and-connectors/palo-alto-networks-integrations/iot-security.md) - [Ingest alerts and assets from IoT Security (Deprecated)](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cortex-cloud-data-sources-and-connectors/palo-alto-networks-integrations/iot-security/ingest-alerts-and-assets-from-iot-security.md) - [Ingest alerts and assets from Device Security](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cortex-cloud-data-sources-and-connectors/palo-alto-networks-integrations/iot-security/ingest-alerts-and-assets-from-device-security.md) - [Cortex Internals](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cortex-cloud-data-sources-and-connectors/palo-alto-networks-integrations/cortex-internals.md) - [Enterprise DLP](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cortex-cloud-data-sources-and-connectors/palo-alto-networks-integrations/enterprise-dlp.md) - [Palo Alto Networks Cortex](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cortex-cloud-data-sources-and-connectors/palo-alto-networks-integrations/palo-alto-networks-cortex.md) - [SaaS Security (Aperture)](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cortex-cloud-data-sources-and-connectors/palo-alto-networks-integrations/saas-security-aperture.md) - [WildFire Cloud](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cortex-cloud-data-sources-and-connectors/palo-alto-networks-integrations/wildfire-cloud.md) - [Collecting URL and File log types](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cortex-cloud-data-sources-and-connectors/palo-alto-networks-integrations/collecting-url-and-file-log-types.md) - [Detectors connected to URL and File log types](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cortex-cloud-data-sources-and-connectors/palo-alto-networks-integrations/collecting-url-and-file-log-types/detectors-connected-to-url-and-file-log-types.md) - [Cloud Posture and Runtime Security data sources](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cortex-cloud-data-sources-and-connectors/cloud-posture-and-runtime-security-data-sources.md): Learn more about the Cloud Posture and Runtime Security data sources in Cortex Cloud. - [Administration and troubleshooting](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cortex-cloud-data-sources-and-connectors/administration-and-troubleshooting.md): Learn more about the administration and troubleshooting of the different data collector integrations in Cortex Cloud. - [Manage instances](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cortex-cloud-data-sources-and-connectors/administration-and-troubleshooting/manage-instances.md) - [Add a new data source or instance](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cortex-cloud-data-sources-and-connectors/administration-and-troubleshooting/manage-instances/add-a-new-data-source-or-instance.md) - [How to configure the scanning settings for supported services](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cortex-cloud-data-sources-and-connectors/administration-and-troubleshooting/manage-instances/how-to-configure-the-scanning-settings-for-supported-services.md) - [Manage cloud instances](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cortex-cloud-data-sources-and-connectors/administration-and-troubleshooting/manage-instances/manage-cloud-instances.md) - [Update cloud permissions after Cortex release updates](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cortex-cloud-data-sources-and-connectors/administration-and-troubleshooting/manage-instances/update-cloud-permissions-after-cortex-release-updates.md) - [Pending cloud instances](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cortex-cloud-data-sources-and-connectors/administration-and-troubleshooting/manage-instances/pending-cloud-instances.md) - [Troubleshoot errors on cloud instances](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cortex-cloud-data-sources-and-connectors/administration-and-troubleshooting/manage-instances/troubleshoot-errors-on-cloud-instances.md) - [Manage Kubernetes Connector instances](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cortex-cloud-data-sources-and-connectors/administration-and-troubleshooting/manage-instances/manage-kubernetes-connector-instances.md) - [Integrations](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cortex-cloud-data-sources-and-connectors/administration-and-troubleshooting/integrations.md) - [Add an integration instance](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cortex-cloud-data-sources-and-connectors/administration-and-troubleshooting/integrations/add-an-integration-instance.md) - [Configure integration permissions](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cortex-cloud-data-sources-and-connectors/administration-and-troubleshooting/integrations/configure-integration-permissions.md) - [Troubleshoot Integrations](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cortex-cloud-data-sources-and-connectors/administration-and-troubleshooting/integrations/troubleshoot-integrations.md) - [Verify collector connectivity](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cortex-cloud-data-sources-and-connectors/administration-and-troubleshooting/verify-collector-connectivity.md) - [Overview of data ingestion metrics](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cortex-cloud-data-sources-and-connectors/administration-and-troubleshooting/overview-of-data-ingestion-metrics.md) - [Creating correlation rules to monitor data ingestion health](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cortex-cloud-data-sources-and-connectors/administration-and-troubleshooting/overview-of-data-ingestion-metrics/creating-correlation-rules-to-monitor-data-ingestion-health.md) - [Measuring data freshness](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cortex-cloud-data-sources-and-connectors/administration-and-troubleshooting/overview-of-data-ingestion-metrics/measuring-data-freshness.md) - [About health issues](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cortex-cloud-data-sources-and-connectors/administration-and-troubleshooting/about-health-issues.md) - [Investigate and resolve health issues](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cortex-cloud-data-sources-and-connectors/administration-and-troubleshooting/about-health-issues/investigate-and-resolve-health-issues.md) - [Monitor data ingestion health (BETA)](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cortex-cloud-data-sources-and-connectors/administration-and-troubleshooting/about-health-issues/monitor-data-ingestion-health.md) - [Monitor Correlation rules](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cortex-cloud-data-sources-and-connectors/administration-and-troubleshooting/about-health-issues/monitor-correlation-rules.md) - [What is the Cortex Marketplace](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/marketplace/cortex-marketplace.md): Search Cortex Marketplace and find content. Search by use cases, integrations, and categories. - [Content Pack Support Types](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/marketplace/content-pack-support-types.md): Types of content packs support - Cortex supported, Partner-Supported, Developer-Supported, Community-Supported. - [Cortex Cloud content](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/marketplace/cortex-cloud-content.md): The type of content in Cortex Cloud - [Manage content packs](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/marketplace/manage-content-packs.md): Install, delete, update, and revert content packs. - [Marketplace FAQs](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/marketplace/marketplace-faqs.md): Frequently Asked Questions about Cortex Cloud Marketplace Content - [Content changes when upgrading Cortex Cloud versions](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/marketplace/content-changes-when-upgrading-cortex-cloud-versions.md): Content updates when upgrading Cortex Cloud versions. - [Learn about Serverless function posture security](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/serverless-function-posture-security/serverless-function-posture-security.md): Understand how Cortex Cloud scans and assesses serverless function security. - [Onboard cloud providers for serverless functions](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/serverless-function-posture-security/onboard-cloud-providers-for-serverless-functions.md): Onboard cloud providers to discover and assess serverless functions. - [Serverless function posture rules](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/serverless-function-posture-security/serverless-function-posture-rules.md): Use posture rules to identify serverless function security risks. - [Manage serverless function rules](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/serverless-function-posture-security/serverless-function-posture-rules/manage-serverless-function-rules.md): View, filter, enable, and manage serverless function posture rules. - [Create serverless function rules](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/serverless-function-posture-security/serverless-function-posture-rules/create-serverless-function-rules.md): Create custom rules to identify security risks in serverless functions. - [Create an attack path rule for serverless functions](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/serverless-function-posture-security/serverless-function-posture-rules/create-an-attack-path-rule-for-serverless-functions.md): Create attack path rules that identify risky routes to serverless functions. - [Create a configuration rule for serverless functions](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/serverless-function-posture-security/serverless-function-posture-rules/create-a-configuration-rule-for-serverless-functions.md): Create configuration rules that identify serverless function misconfigurations. - [Create a network exposure rule for serverless functions](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/serverless-function-posture-security/serverless-function-posture-rules/create-a-network-exposure-rule-for-serverless-functions.md): Create network exposure rules that identify publicly exposed serverless functions. - [Serverless function posture policies](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/serverless-function-posture-security/serverless-function-posture-policies.md): Create and manage serverless function policies to detect threats and drive remediation. - [Manage serverless function policies](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/serverless-function-posture-security/serverless-function-posture-policies/manage-serverless-function-policies.md): View, edit, enable, and manage serverless function posture policies. - [Create serverless function policies](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/serverless-function-posture-security/serverless-function-posture-policies/create-serverless-function-policies.md): Create policies that apply posture rules to selected serverless functions. - [Serverless function usage](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/serverless-function-posture-security/serverless-function-usage.md): Monitor serverless function usage and related security posture data. - [Overview](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/serverless-function-runtime-security/overview.md): Learn how Cortex Cloud protects serverless functions at runtime. - [Set up serverless function protection](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/serverless-function-runtime-security/set-up-serverless-function-protection.md): Configure runtime protection for your serverless functions. - [Serverless runtime issues](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/serverless-function-runtime-security/serverless-runtime-issues.md): Investigate runtime security issues detected in serverless functions. - [About Cortex CLI](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cortex-cli/cortex-cli.md): The Cortex CLI is a unified command-line tool integrating Cloud Workload Protection, API Security, and Code Security scans into a single executable. - [Connect Cortex CLI](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cortex-cli/connect-cortex-cli.md): Install Cortex CLI, configure authentication, and review module requirements. - [Installation workflows](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cortex-cli/connect-cortex-cli/installation-workflows.md): Install Cortex CLI using a package manager, manual download, or the Cortex Cloud interface. - [Manage the CLI after installation](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cortex-cli/connect-cortex-cli/manage-the-cli-after-installation.md): Upgrade, pin, uninstall, or update Cortex CLI through automated downloads. - [Authenticate credentials](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cortex-cli/connect-cortex-cli/authenticate-credentials.md): Configure Cortex CLI credentials using a file, environment variables, or command-line flags. - [Self-service API keys for CLI scans](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cortex-cli/connect-cortex-cli/self-service-api-keys-for-cli-scans.md): Create role-restricted API keys for Cortex CLI and IDE scans. - [Cortex CLI usage](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cortex-cli/cortex-cli-usage.md): Run Cortex CLI scans with global flags and module-specific options. - [Exit codes and error handling](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cortex-cli/exit-codes-and-error-handling.md) - [Cortex CLI common command line reference guide](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cortex-cli/cortex-cli-common-command-line-reference-guide.md): Reference common and global flags for Cortex CLI scans. - [Cortex CLI for Code Security](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cortex-cli/cortex-cli-for-code-security.md): Run Code Security scans for secrets, IaC, and third-party dependencies. - [Cortex CLI usage for Cortex Cloud Application Security](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cortex-cli/cortex-cli-for-code-security/cortex-cli-usage-for-cortex-cloud-application-security.md): Run Cortex Cloud Application Security scans and configure scan output. - [Cortex CLI Cortex Cloud Application Security command line reference](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cortex-cli/cortex-cli-for-code-security/cortex-cli-cortex-cloud-application-security-command-line-reference.md): Reference commands and flags for Cortex Cloud Application Security scans. - [Custom Cortex checks and signature verification](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cortex-cli/cortex-cli-for-code-security/cortex-cli-cortex-cloud-application-security-command-line-reference/custom-cortex-checks-and-signature-verification.md): Load custom Cortex checks and optionally verify their signatures. - [Cortex CLI pre-commit hooks](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cortex-cli/cortex-cli-for-code-security/cortex-cli-pre-commit-hooks.md): Integrate Application Security secrets scanner as pre-commit hooks into your workflows to scan for errors on your machine before local commits. - [Pre-commit hook usage](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cortex-cli/cortex-cli-for-code-security/cortex-cli-pre-commit-hooks/pre-commit-hook-usage.md): Configure pre-commit hooks for local secrets scans and suppression. - [Cortex CLI pre-receive hooks](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cortex-cli/cortex-cli-for-code-security/cortex-cli-pre-receive-hooks.md): Integrate the Application Security secrets scanner as a pre-receive hook into your workflows to scan for errors before code is accepted into your repository. - [Pre-receive hook usage](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cortex-cli/cortex-cli-for-code-security/cortex-cli-pre-receive-hooks/pre-receive-hook-usage.md): Configure pre-receive hooks for server-side secrets scans. - [Cortex CLI for Cloud Workload Protection](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cortex-cli/cortex-cli-for-cloud-workload-protection.md): Scan container images and export SBOMs with Cloud Workload Protection. - [Cloud Workload Protection command line reference](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cortex-cli/cortex-cli-for-cloud-workload-protection/cloud-workload-protection-command-line-reference.md): Reference Cloud Workload Protection commands and flags for image scans. - [Cortex CLI for API Security](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cortex-cli/cortex-cli-for-api-security.md): Scan APIs for vulnerabilities and misconfigurations using Cortex CLI. - [Cortex CLI API Security command line reference guide](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cortex-cli/cortex-cli-for-api-security/cortex-cli-api-security-command-line-reference-guide.md): Reference commands and flags for Cortex CLI API Security scans. - [API Security scan report schema](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cortex-cli/cortex-cli-for-api-security/api-security-scan-report-schema.md): Reference schema for API Security scan reports. - [API Security scan output example](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cortex-cli/cortex-cli-for-api-security/api-security-scan-output-example.md): Example API Security scan report output. - [Get started with XQL](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cortex-cloud-xql/get-started-with-xql.md): XQL is the Palo Alto Networks Cortex Query Language used in Cortex Cloud. - [XQL language features](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cortex-cloud-xql/get-started-with-xql/xql-language-features.md): Learn more about the Cortex Query Language features to query for raw network and endpoint data. - [XQL Language Structure](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cortex-cloud-xql/get-started-with-xql/xql-language-structure.md): Learn more about the Cortex Query Language structure when creating a query. - [Supported operators](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cortex-cloud-xql/get-started-with-xql/supported-operators.md): Cortex Query Language supports specific comparison, boolean, and set operators in Cortex Cloud. - [Datasets and presets](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cortex-cloud-xql/get-started-with-xql/datasets-and-presets.md): The Cortex Query Language supports built-in datasets, custom datasets, and presets. - [About examples](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cortex-cloud-xql/get-started-with-xql/about-examples.md): Learn more about the Cortex Query Language (XQL) examples provided. - [JSON functions](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cortex-cloud-xql/get-started-with-xql/json-functions.md): Learn more about how Cortex Cloud treats JSON functions in the Cortex Query Language. - [How to filter for empty values in the results table](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cortex-cloud-xql/get-started-with-xql/how-to-filter-for-empty-values-in-the-results-table.md): Learn how to filter for empty values in the results table in Cortex Query Language. - [Understanding string manipulation in XQL](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cortex-cloud-xql/get-started-with-xql/understanding-string-manipulation-in-xql.md): Learn more about string manipulation in Cortex Query Language (XQL) using double and triple quotes. - [Build XQL queries](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cortex-cloud-xql/build-xql-queries.md): Learn more about how to build Cortex Query Language (XQL) queries using the Query Builder. - [About the Query Builder](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cortex-cloud-xql/build-xql-queries/about-the-query-builder.md): The Query Builder facilitates threat detection, case expansion, and data analytics for suspected threats. - [How to build XQL queries](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cortex-cloud-xql/build-xql-queries/how-to-build-xql-queries.md): Learn more about how to build XQL queries in the Query Builder. - [XQL query entities](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cortex-cloud-xql/build-xql-queries/xql-query-entities.md): Learn more about the Cortex Query Language (XQL) entities available in the Query Builder. - [Overview of the Query Center](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cortex-cloud-xql/build-xql-queries/overview-of-the-query-center.md): View information about the In Progress and Completed queries that that were run on the tenant. - [Manage scheduled queries](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cortex-cloud-xql/build-xql-queries/manage-scheduled-queries.md): Learn how to manage your scheduled and recurring queries. - [Manage your query library](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cortex-cloud-xql/build-xql-queries/manage-your-query-library.md): Cortex Cloud provides a Query Library for saving and managing your own queries. - [XQL macros](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cortex-cloud-xql/build-xql-queries/xql-macros.md) - [Manage your macros](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cortex-cloud-xql/build-xql-queries/manage-your-macros.md) - [Cortex XQL syntax, parameters, and examples](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cortex-cloud-xql/cortex-xql-syntax-parameters-and-examples.md): Comprehensive syntax rules and structural requirements for XQL queries - [What is Graph Search?](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/graph-search/what-is-graph-search.md): Learn more about how to use Graph Search to search assets, findings, and their contextual data. - [Get started with Graph Search queries](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/graph-search/get-started-with-graph-search-queries.md): Learn more about how to get started before building a Graph Search query. - [How to build Graph Search queries?](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/graph-search/how-to-build-graph-search-queries.md): Learn more about building Graph Search queries using the built-in query interface. - [Understand Graph Search query results](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/graph-search/understand-graph-search-query-results.md): Learn more about the Graph Search query results. - [Create Graph Search query](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/graph-search/create-graph-search-query.md): Learn how to create Graph Search queries in Cortex Cloud. - [Graph Search examples](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/graph-search/graph-search-examples.md): Learn how to build Graph Search queries by working through a few examples. - [Manage the Graph Search Query Library](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/graph-search/manage-the-graph-search-query-library.md): Learn more about the Cortex Cloud Graph Search Query Library to manage your queries. - [Edit and run queries in Query Center](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/graph-search/edit-and-run-queries-in-query-center.md): Learn more about viewing the results of a query, modifying a query, and rerunning queries from Query Center. - [Query Center reference information](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/graph-search/edit-and-run-queries-in-query-center/query-center-reference-information.md): Descriptions of the fields in the Query Center table. - [Supported assets and findings](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/graph-search/supported-assets-and-findings.md): Review the assets and finding categories supported by Graph Search. - [FAQ on Graph Search](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/graph-search/faq-on-graph-search.md): Answer some frequently asked questions relating to Graph Search. - [Create detection rules based on graph search](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/graph-search/create-detection-rules-based-on-graph-search.md): Create Graph Engine detection rules from Graph Search queries. - [Learn how to a migrate a new Broker VM image](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/migration-process-for-new-broker-vm-image/migrating-to-a-new-broker-vm-image.md): Learn more about migrating to the latest broker VM image in Cortex Cloud. - [Standalone Broker VM](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/migration-process-for-new-broker-vm-image/standalone-broker-vm.md): Learn more about migrating a standalone broker VM image. - [Broker VM high availability cluster node](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/migration-process-for-new-broker-vm-image/broker-vm-high-availability-cluster-node.md): Learn more about migrating a broker VM High Availability (HA) cluster node. ## Cortex CLOUD Posture Management - [Navigate the Cortex Cloud Posture Management docs](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/get-started/readme.md): Start here for a visual overview of the main Cortex Cloud Posture Management documentation areas. - [What is Cortex Cloud?](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/get-started/what-is-cortex-cloud.md): Learn how Cortex Cloud unifies cloud security from code to SOC. - [Key features](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/get-started/what-is-cortex-cloud/key-features.md): Explore Cortex Cloud capabilities for visibility, risk management, compliance, and automation. - [What is Cortex Cloud Posture Management?](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/get-started/what-is-cortex-cloud-posture-management.md): Learn about Cortex Cloud Posture Management and the key integrated capabilities. - [Agentic AI in Cortex Cloud](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/get-started/agentic-ai-in-cortex-cloud.md): Use the Cortex Agentic Assistant to investigate cases, perform threat hunting, and create scripts. Embed and run LLM prompts in playbooks. View AI case summaries. - [Agentic Assistant use cases](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/get-started/agentic-ai-in-cortex-cloud/agentic-assistant-use-cases.md): Recommended prompts to automate your SOC using the Cortex Agentic Assistant - [Agentic Assistant security](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/get-started/agentic-ai-in-cortex-cloud/agentic-assistant-security.md): Learn about how the Agentic Assistant is built using responsible AI principles. - [Supported web browsers](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/get-started/supported-web-browsers.md): Review supported browser versions and performance requirements for Cortex Cloud. - [Use the interface](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/get-started/use-the-interface.md): Navigate the Cortex Cloud interface, Command Center, assets, and cases. - [In-product support ticket creation](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/get-started/in-product-support-case-creation.md): Open a support ticket directly in Cortex Cloud and record your console to capture your issues and have the ticket handled efficiently. - [Understand your user persona](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/get-started/understand-your-user-persona.md): Learn how Cortex Cloud supports cloud security engineers and architects. - [Fair Usage policy for Cortex Cloud](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/get-started/fair-usage-policy-for-cortex-cloud.md): Understand fair usage expectations for data ingestion, data sources, and APIs. - [Understand license plans](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/get-started/understand-license-plans.md): Understand Cortex Cloud licenses, protected workloads, add-ons, and usage rules. - [Data retention](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/get-started/understand-license-plans/data-retention.md): Learn more about the default retention periods for all Cortex Cloud licenses and the available retention add-ons. - [Learn how to onboard and configure Cortex Cloud](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/onboard-and-configure/onboard-and-configure-cortex-cloud.md): Learn about the deployment preparation and procedures to onboard and configure Cortex Cloud. - [Plan and prepare](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/onboard-and-configure/plan-and-prepare.md): Learn more about deployment considerations and onboarding steps. - [Prepare for deployment](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/onboard-and-configure/plan-and-prepare/prepare-for-deployment.md): Learn more about deployment considerations and onboarding steps. - [Deployment steps and checklist](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/onboard-and-configure/deployment-steps-and-checklist.md): Review the steps to onboard and configure Cortex Cloud. - [Activate Cortex Cloud](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/onboard-and-configure/deployment-steps-and-checklist/activate-cortex-cloud.md): Learn how to activate your tenant. - [Cortex Cloud supported regions](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/onboard-and-configure/deployment-steps-and-checklist/activate-cortex-cloud/cortex-cloud-supported-regions.md): Review the regions where Cortex Cloud is available. - [Enable access to required PANW resources](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/onboard-and-configure/deployment-steps-and-checklist/activate-cortex-cloud/enable-access-to-required-panw-resources.md): Allow required access to Palo Alto Networks resources for Cortex Cloud. - [Regional egress resources](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/onboard-and-configure/deployment-steps-and-checklist/activate-cortex-cloud/enable-access-to-required-panw-resources/regional-egress-resources.md): Review regional resources used for Cortex Cloud outbound connectivity. - [Engines IP addresses (outbound)](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/onboard-and-configure/deployment-steps-and-checklist/activate-cortex-cloud/enable-access-to-required-panw-resources/engines-ip-addresses-outbound.md): Find outbound IP addresses required by Cortex Cloud engines. - [Inbound source resources](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/onboard-and-configure/deployment-steps-and-checklist/activate-cortex-cloud/enable-access-to-required-panw-resources/inbound-source-resources.md): Review inbound source resources required for Cortex Cloud access. - [FedRAMP and the US Federal Government required resources](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/onboard-and-configure/deployment-steps-and-checklist/activate-cortex-cloud/enable-access-to-required-panw-resources/fedramp-and-the-us-federal-government-required-resources.md): Review required resources for FedRAMP and US Federal Government deployments. - [Upgrade from Prisma Cloud to Cortex Cloud](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/onboard-and-configure/deployment-steps-and-checklist/upgrade-from-prisma-cloud-to-cortex-cloud.md): Link tenants, copy configurations, and migrate CLI workflows to Cortex Cloud. - [About the Upgrade Helper](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/onboard-and-configure/deployment-steps-and-checklist/upgrade-from-prisma-cloud-to-cortex-cloud/about-the-upgrade-helper.md): Learn how the Upgrade Helper supports your migration to Cortex Cloud. - [Link Cortex Cloud to Prisma Cloud](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/onboard-and-configure/deployment-steps-and-checklist/upgrade-from-prisma-cloud-to-cortex-cloud/link-cortex-cloud-to-prisma-cloud.md): Link your Cortex Cloud and Prisma Cloud tenants before migrating. - [Copy content](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/onboard-and-configure/deployment-steps-and-checklist/upgrade-from-prisma-cloud-to-cortex-cloud/copy-content.md): Copy supported Prisma Cloud configurations to Cortex Cloud. - [Copy Global configurations](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/onboard-and-configure/deployment-steps-and-checklist/upgrade-from-prisma-cloud-to-cortex-cloud/copy-content/copy-global-configurations.md): Copy supported global configurations from Prisma Cloud. - [Copy CSPM configurations](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/onboard-and-configure/deployment-steps-and-checklist/upgrade-from-prisma-cloud-to-cortex-cloud/copy-content/copy-cspm-configurations.md): Copy supported CSPM configurations from Prisma Cloud. - [Copy CWP configurations](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/onboard-and-configure/deployment-steps-and-checklist/upgrade-from-prisma-cloud-to-cortex-cloud/copy-content/copy-cwp-configurations.md): Copy supported CWP configurations from Prisma Cloud. - [Copy Cortex Cloud Application Security configurations](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/onboard-and-configure/deployment-steps-and-checklist/upgrade-from-prisma-cloud-to-cortex-cloud/copy-content/copy-cortex-cloud-application-security-configurations.md): Copy supported Application Security configurations to Cortex Cloud. - [Migrate Cortex CLI](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/onboard-and-configure/deployment-steps-and-checklist/upgrade-from-prisma-cloud-to-cortex-cloud/migrate-cortex-cli.md): Migrate Cortex CLI workflows from Prisma Cloud to Cortex Cloud. - [Set up users, groups, and roles](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/onboard-and-configure/deployment-steps-and-checklist/set-up-users-and-roles.md): Learn how to set up users and roles in Cortex Cloud. - [User group management](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/onboard-and-configure/deployment-steps-and-checklist/set-up-users-and-roles/user-group-management.md): Create and manage user groups, roles, and scopes. - [Assign user roles and groups](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/onboard-and-configure/deployment-steps-and-checklist/set-up-users-and-roles/assign-user-roles-and-groups.md): Assign roles and group memberships to users. - [Manage API keys](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/onboard-and-configure/deployment-steps-and-checklist/manage-api-keys.md): Create, manage, and revoke API keys for Cortex Cloud. - [Set up authentication](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/onboard-and-configure/deployment-steps-and-checklist/set-up-authentication.md): Authenticate Cortex Cloud users using SAML 2.0 or Customer Support Portal (CSP). - [Authenticate users through the Customer Support Portal](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/onboard-and-configure/deployment-steps-and-checklist/set-up-authentication/authenticate-users-through-the-customer-support-portal.md): Authenticate users through the Customer Support Portal. - [Authenticate users using SSO](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/onboard-and-configure/deployment-steps-and-checklist/set-up-authentication/authenticate-users-using-sso.md): Configure SAML single sign-on for Cortex Cloud users. - [Set up Okta as the Identity Provider Using SAML 2.0](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/onboard-and-configure/deployment-steps-and-checklist/set-up-authentication/set-up-okta-as-the-identity-provider-using-saml-2.0.md): Configure Okta as a SAML 2.0 identity provider. - [Set up Microsoft Entra ID as the Identity Provider Using SAML 2.0](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/onboard-and-configure/deployment-steps-and-checklist/set-up-authentication/set-up-microsoft-entra-id-as-the-identity-provider-using-saml-2.0.md): Configure Microsoft Entra ID as a SAML 2.0 identity provider. - [Cloud service provider (CSP) onboarding](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/onboard-and-configure/deployment-steps-and-checklist/cloud-service-provider-csp-onboarding.md): Learn about onboarding your cloud service provider to Cortex Cloud. - [Amazon Web Services cloud onboarding](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/onboard-and-configure/deployment-steps-and-checklist/cloud-service-provider-csp-onboarding/amazon-web-services-cloud-onboarding.md): Follow the AWS onboarding wizard, and Cortex Cloud creates a custom authentication template to be deployed in AWS. - [AWS security capabilities and deployment planning](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/onboard-and-configure/deployment-steps-and-checklist/cloud-service-provider-csp-onboarding/amazon-web-services-cloud-onboarding/aws-security-capabilities-and-deployment-planning.md): Plan AWS onboarding based on supported security capabilities and deployment options. - [AWS resource inventory](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/onboard-and-configure/deployment-steps-and-checklist/cloud-service-provider-csp-onboarding/amazon-web-services-cloud-onboarding/aws-resource-inventory.md): Learn how Cortex Cloud inventories AWS resources. - [AWS security model and authentication](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/onboard-and-configure/deployment-steps-and-checklist/cloud-service-provider-csp-onboarding/amazon-web-services-cloud-onboarding/aws-security-model-and-authentication.md): Understand the AWS security model and authentication requirements. - [Cortex Cloud and AWS audit log collection architecture](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/onboard-and-configure/deployment-steps-and-checklist/cloud-service-provider-csp-onboarding/amazon-web-services-cloud-onboarding/cortex-cloud-and-aws-audit-log-collection-architecture.md): Understand how Cortex Cloud collects AWS audit logs. - [Onboard Amazon Web Services](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/onboard-and-configure/deployment-steps-and-checklist/cloud-service-provider-csp-onboarding/amazon-web-services-cloud-onboarding/onboard-amazon-web-services.md): Follow the AWS onboarding wizard, and Cortex Cloud creates a custom authentication template to be executed in AWS. - [Prerequisites for onboarding AWS](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/onboard-and-configure/deployment-steps-and-checklist/cloud-service-provider-csp-onboarding/amazon-web-services-cloud-onboarding/prerequisites-for-onboarding-aws.md): Before you begin onboarding AWS, you must review the following prerequisites. - [How to onboard Amazon Web Services](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/onboard-and-configure/deployment-steps-and-checklist/cloud-service-provider-csp-onboarding/amazon-web-services-cloud-onboarding/how-to-onboard-amazon-web-services.md): Follow the AWS onboarding wizard and Cortex Cloud creates a custom authentication template to be deployed in AWS CloudFormation. - [Deploy the authentication template in AWS](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/onboard-and-configure/deployment-steps-and-checklist/cloud-service-provider-csp-onboarding/amazon-web-services-cloud-onboarding/deploy-the-authentication-template-in-aws.md): Learn how to deploy the Terraform or CloudFormation authentication template in Amazon Web Services. - [Post-deployment: Custom (BYOB) and Control Tower audit log collection](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/onboard-and-configure/deployment-steps-and-checklist/cloud-service-provider-csp-onboarding/amazon-web-services-cloud-onboarding/post-deployment-custom-byob-audit-log-collection.md): Configure custom and Control Tower audit log collection after AWS onboarding. - [Grant cross-account KMS key access for Control Tower BYOB log collection](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/onboard-and-configure/deployment-steps-and-checklist/cloud-service-provider-csp-onboarding/amazon-web-services-cloud-onboarding/grant-cross-account-kms-key-access-for-control-tower-byob-log-collection.md): Learn how to configure cross-account AWS KMS key permissions for Cortex Control Tower BYOB log collection. Step-by-step guide to updating KMS key policies. - [AWS post-deployment verification](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/onboard-and-configure/deployment-steps-and-checklist/cloud-service-provider-csp-onboarding/amazon-web-services-cloud-onboarding/aws-post-deployment-verification.md): After you have completed the AWS onboarding wizard and you have deployed the authentication template in AWS (using CloudFormation or Terraform), verify that the deployment succeeded. - [Amazon Web Services (AWS) provider permissions](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/onboard-and-configure/deployment-steps-and-checklist/cloud-service-provider-csp-onboarding/amazon-web-services-cloud-onboarding/amazon-web-services-aws-provider-permissions.md): List of Amazon Web Services (AWS) permissions for use during Cortex Cloud onboarding to enable continuous monitoring in your cloud environment. - [Microsoft Azure cloud onboarding](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/onboard-and-configure/deployment-steps-and-checklist/cloud-service-provider-csp-onboarding/microsoft-azure-cloud-onboarding.md): Onboard Microsoft Azure to monitor your cloud resources with Cortex Cloud. - [Onboard Microsoft Azure](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/onboard-and-configure/deployment-steps-and-checklist/cloud-service-provider-csp-onboarding/microsoft-azure-cloud-onboarding/onboard-microsoft-azure.md): Follow the Azure onboarding wizard, and Cortex creates a custom authentication template to be executed in Azure. - [Prerequisites for onboarding Azure](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/onboard-and-configure/deployment-steps-and-checklist/cloud-service-provider-csp-onboarding/microsoft-azure-cloud-onboarding/prerequisites-for-onboarding-azure.md): Before you begin onboarding Microsoft Azure, you must review the following prerequisites. - [How to onboard Microsoft Azure](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/onboard-and-configure/deployment-steps-and-checklist/cloud-service-provider-csp-onboarding/microsoft-azure-cloud-onboarding/how-to-onboard-microsoft-azure.md): Follow the Azure onboarding wizard, and Cortex creates a custom authentication template to be executed in Azure. - [Finalize Microsoft Azure onboarding by executing the authentication template](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/onboard-and-configure/deployment-steps-and-checklist/cloud-service-provider-csp-onboarding/microsoft-azure-cloud-onboarding/finalize-microsoft-azure-onboarding-by-executing-the-authentication-template.md): Learn how to execute the authentication template file in Microsoft Azure for subscriptions, tenants, and management groups. We provide instructions both for applying the Terraform template's configura - [Microsoft Azure offboarding overview](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/onboard-and-configure/deployment-steps-and-checklist/cloud-service-provider-csp-onboarding/microsoft-azure-cloud-onboarding/microsoft-azure-offboarding-overview.md): This section contains the technical procedures required to safely decommission and offboard your Cortex Cloud resources in Microsoft Azure. - [Offboard Terraform-based Azure deployments (all scopes)](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/onboard-and-configure/deployment-steps-and-checklist/cloud-service-provider-csp-onboarding/microsoft-azure-cloud-onboarding/microsoft-azure-offboarding-overview/offboard-terraform-based-azure-deployments-all-scopes.md): How to offboard all Terraform-based Microsoft Azure scopes from Cortex Cloud: A step-by-step technical guide to safely running Terraform destroy and cleaning up policy-deployed resources. - [Offboard Azure subscription (ARM)](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/onboard-and-configure/deployment-steps-and-checklist/cloud-service-provider-csp-onboarding/microsoft-azure-cloud-onboarding/microsoft-azure-offboarding-overview/offboard-azure-subscription-arm.md): How to offboard a Microsoft Azure subscription scope that was onboarded using ARM: A step-by-step technical guide to safely running the interactive offboarding script and cleaning up all resources. - [Offboard Azure management group or tenant scope (ARM)](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/onboard-and-configure/deployment-steps-and-checklist/cloud-service-provider-csp-onboarding/microsoft-azure-cloud-onboarding/microsoft-azure-offboarding-overview/offboard-azure-management-group-or-tenant-scope-arm.md): How to offboard Microsoft Azure management group or tenant scopes from Cortex Cloud: A step-by-step technical guide to safely removing all Azure resources deployed by Cortex onboarding templates. - [Offboard Azure tenant with Entra ID only](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/onboard-and-configure/deployment-steps-and-checklist/cloud-service-provider-csp-onboarding/microsoft-azure-cloud-onboarding/microsoft-azure-offboarding-overview/offboard-azure-tenant-with-entra-id-only.md): How to offboard a Microsoft Azure tenant onboarded with the Entra ID only option from Cortex Cloud: A step-by-step technical guide to safely removing deployed resources. - [Microsoft Azure provider permissions](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/onboard-and-configure/deployment-steps-and-checklist/cloud-service-provider-csp-onboarding/microsoft-azure-cloud-onboarding/microsoft-azure-provider-permissions.md): List of Microsoft Azure provider permissions for Cortex Cloud. - [Google Cloud Platform cloud onboarding](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/onboard-and-configure/deployment-steps-and-checklist/cloud-service-provider-csp-onboarding/google-cloud-platform-cloud-onboarding.md): Onboard Google Cloud Platform to monitor cloud resources with Cortex Cloud. - [Onboard Google Cloud Platform](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/onboard-and-configure/deployment-steps-and-checklist/cloud-service-provider-csp-onboarding/google-cloud-platform-cloud-onboarding/onboard-google-cloud-platform.md): Follow the GCP onboarding wizard, and Cortex creates a custom authentication template to be executed in GCP. - [Prerequisites for onboarding GCP](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/onboard-and-configure/deployment-steps-and-checklist/cloud-service-provider-csp-onboarding/google-cloud-platform-cloud-onboarding/prerequisites-for-onboarding-gcp.md): Before you begin onboarding GCP, you must review the following prerequisites. - [Required APIs](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/onboard-and-configure/deployment-steps-and-checklist/cloud-service-provider-csp-onboarding/google-cloud-platform-cloud-onboarding/prerequisites-for-onboarding-gcp/required-apis.md) - [How to onboard Google Cloud Platform](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/onboard-and-configure/deployment-steps-and-checklist/cloud-service-provider-csp-onboarding/google-cloud-platform-cloud-onboarding/how-to-onboard-google-cloud-platform.md): Follow the GCP onboarding wizard, and Cortex Cloud creates a custom authentication template to be applied in GCP. - [Deploy the Terraform authentication template in GCP](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/onboard-and-configure/deployment-steps-and-checklist/cloud-service-provider-csp-onboarding/google-cloud-platform-cloud-onboarding/deploy-the-terraform-authentication-template-in-gcp.md): Learn how to deploy the Terraform authentication template in Google Cloud Console. - [Connect Google Workspace with your GCP cloud instance](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/onboard-and-configure/deployment-steps-and-checklist/cloud-service-provider-csp-onboarding/google-cloud-platform-cloud-onboarding/connect-google-workspace-with-your-gcp-cloud-instance.md): Connect Google Workspace to your Google Cloud Platform cloud instance. - [Monitor GCP resources inside service perimeters](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/onboard-and-configure/deployment-steps-and-checklist/cloud-service-provider-csp-onboarding/google-cloud-platform-cloud-onboarding/monitor-gcp-resources-inside-service-perimeters.md): Learn how to grant authorization to Cortex Cloud to scan within your GCP service perimeter. - [Google Cloud Platform (GCP) provider permissions](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/onboard-and-configure/deployment-steps-and-checklist/cloud-service-provider-csp-onboarding/google-cloud-platform-cloud-onboarding/google-cloud-platform-gcp-provider-permissions.md): List of Google Cloud Platform (GCP) permissions for use during Cortex Cloud onboarding to enable continuous monitoring in your cloud environment. - [Oracle Cloud Infrastructure cloud onboarding](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/onboard-and-configure/deployment-steps-and-checklist/cloud-service-provider-csp-onboarding/oracle-cloud-infrastructure-cloud-onboarding.md): Follow the Oracle Cloud Infrastructure onboarding wizard and Cortex Cloud creates a custom Terraform authentication template to be deployed in Oracle Cloud Infrastructure. - [Onboard Oracle Cloud Infrastructure](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/onboard-and-configure/deployment-steps-and-checklist/cloud-service-provider-csp-onboarding/oracle-cloud-infrastructure-cloud-onboarding/onboard-oracle-cloud-infrastructure.md): Follow the OCI onboarding wizard, and Cortex creates a custom authentication template to be executed in OCI. - [Prerequisites for onboarding OCI](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/onboard-and-configure/deployment-steps-and-checklist/cloud-service-provider-csp-onboarding/oracle-cloud-infrastructure-cloud-onboarding/prerequisites-for-onboarding-oci.md): Before you begin onboarding Oracle Cloud Infrastructure, you must review the following prerequisites. - [How to onboard Oracle Cloud Infrastructure](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/onboard-and-configure/deployment-steps-and-checklist/cloud-service-provider-csp-onboarding/oracle-cloud-infrastructure-cloud-onboarding/how-to-onboard-oracle-cloud-infrastructure.md): Follow the OCI onboarding wizard and Cortex Cloud creates a custom authentication template to be applied in OCI. - [Deploy the Terraform authentication template in OCI](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/onboard-and-configure/deployment-steps-and-checklist/cloud-service-provider-csp-onboarding/oracle-cloud-infrastructure-cloud-onboarding/deploy-the-terraform-authentication-template-in-oci.md): Learn how to deploy the Terraform authentication template in Oracle Cloud Infrastructure. - [Oracle Cloud Infrastructure (OCI) provider permissions](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/onboard-and-configure/deployment-steps-and-checklist/cloud-service-provider-csp-onboarding/oracle-cloud-infrastructure-cloud-onboarding/oracle-cloud-infrastructure-oci-provider-permissions.md): List of Oracle Cloud Infrastructure provider permissions for Cortex Cloud. - [Alibaba Cloud cloud onboarding](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/onboard-and-configure/deployment-steps-and-checklist/cloud-service-provider-csp-onboarding/alibaba-cloud-cloud-onboarding.md): Follow the Alibaba Cloud onboarding wizard and Cortex Cloud creates a custom Terraform authentication template to be deployed in Alibaba Cloud. - [Alibaba security capabilities and deployment planning](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/onboard-and-configure/deployment-steps-and-checklist/cloud-service-provider-csp-onboarding/alibaba-cloud-cloud-onboarding/alibaba-security-capabilities-and-deployment-planning.md): Plan Alibaba Cloud onboarding based on security capabilities and deployment options. - [Alibaba Cloud resource inventory](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/onboard-and-configure/deployment-steps-and-checklist/cloud-service-provider-csp-onboarding/alibaba-cloud-cloud-onboarding/alibaba-cloud-resource-inventory.md): Learn how Cortex Cloud inventories Alibaba Cloud resources. - [Alibaba Cloud security model and authentication](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/onboard-and-configure/deployment-steps-and-checklist/cloud-service-provider-csp-onboarding/alibaba-cloud-cloud-onboarding/alibaba-cloud-security-model-and-authentication.md): Understand the Alibaba Cloud security model and authentication requirements. - [Onboard Alibaba Cloud](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/onboard-and-configure/deployment-steps-and-checklist/cloud-service-provider-csp-onboarding/alibaba-cloud-cloud-onboarding/onboard-alibaba-cloud.md): Follow the Alibaba Cloud onboarding wizard and Cortex Cloud creates a custom CloudFormation authentication template to be deployed in Alibaba Cloud. - [Prerequisites for onboarding Alibaba Cloud](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/onboard-and-configure/deployment-steps-and-checklist/cloud-service-provider-csp-onboarding/alibaba-cloud-cloud-onboarding/prerequisites-for-onboarding-alibaba-cloud.md): Before you begin onboarding Alibaba Cloud, you must review the following prerequisites. - [How to onboard Alibaba Cloud](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/onboard-and-configure/deployment-steps-and-checklist/cloud-service-provider-csp-onboarding/alibaba-cloud-cloud-onboarding/how-to-onboard-alibaba-cloud.md): Follow the onboarding workflow for Alibaba Cloud. - [Alibaba Cloud post-deployment verification](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/onboard-and-configure/deployment-steps-and-checklist/cloud-service-provider-csp-onboarding/alibaba-cloud-cloud-onboarding/alibaba-cloud-post-deployment-verification.md): After you have completed the Alibaba Cloud onboarding wizard and you have deployed the authentication template in Alibaba Cloud, verify that the deployment succeeded. - [Alibaba Cloud provider permissions](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/onboard-and-configure/deployment-steps-and-checklist/cloud-service-provider-csp-onboarding/alibaba-cloud-cloud-onboarding/alibaba-cloud-provider-permissions.md): List of Alibaba Cloud permissions for use during Cortex Cloud onboarding to enable continuous monitoring in your cloud environment. - [Outpost onboarding](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/onboard-and-configure/deployment-steps-and-checklist/cloud-service-provider-csp-onboarding/outpost-onboarding.md): Learn about outposts, which are a dedicated set of infrastructure resources that extends the reach of Cortex Cloud into your environment. - [Outpost fundamentals and planning](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/onboard-and-configure/deployment-steps-and-checklist/cloud-service-provider-csp-onboarding/outpost-onboarding/outpost-fundamentals-and-planning.md): An outpost enables you to have security scans performed on infrastructure in a cloud account owned by you. Learn about outpost fundamentals and what to consider when planning your outpost. - [Outpost creation workflow](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/onboard-and-configure/deployment-steps-and-checklist/cloud-service-provider-csp-onboarding/outpost-onboarding/outpost-creation-workflow.md): Learn about the creation process for an outposts, which facilitate security scanning performed on infrastructure in a cloud account owned by you. - [Working with standard outposts](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/onboard-and-configure/deployment-steps-and-checklist/cloud-service-provider-csp-onboarding/outpost-onboarding/working-with-standard-outposts.md): Standard outposts are the recommended way to create dedicated set of infrastructure resources that extends the reach of Cortex Cloud into your environment. - [Create a standard outpost](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/onboard-and-configure/deployment-steps-and-checklist/cloud-service-provider-csp-onboarding/outpost-onboarding/working-with-standard-outposts/create-a-standard-outpost.md): Instructions for creating a standard outpost while onboarding your CSP. - [Working with Bringing your own Azure app (BYOA) outposts](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/onboard-and-configure/deployment-steps-and-checklist/cloud-service-provider-csp-onboarding/outpost-onboarding/working-with-bringing-your-own-azure-app-byoa-outposts.md): Using advanced settings while creating your outpost, you can deploy a Cortex Cloud Azure outpost using your own pre-created Entra ID app registration. - [Task 1: Meet the prerequisites for Azure BYOA outposts](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/onboard-and-configure/deployment-steps-and-checklist/cloud-service-provider-csp-onboarding/outpost-onboarding/working-with-bringing-your-own-azure-app-byoa-outposts/task-1-meet-the-prerequisites-for-azure-byoa-outposts.md): You can customize your own Azure outpost by bringing your own app (BYOA). This page lists the prerequisites that must be met before customizing your outpost in this way. - [Task 2: Create the app registration for the Azure BYOA outpost](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/onboard-and-configure/deployment-steps-and-checklist/cloud-service-provider-csp-onboarding/outpost-onboarding/working-with-bringing-your-own-azure-app-byoa-outposts/task-2-create-the-app-registration-for-the-azure-byoa-outpost.md): You can customize your own outpost for Azure by bringing your own app (BYOA). This page describes the steps for creating the app registration. - [Task 3: Deploy the Azure BYOA outpost](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/onboard-and-configure/deployment-steps-and-checklist/cloud-service-provider-csp-onboarding/outpost-onboarding/working-with-bringing-your-own-azure-app-byoa-outposts/task-3-deploy-the-azure-byoa-outpost.md): You can customize your own outpost by bringing your own app (BYOA). This page describes the steps for deploying the Azure BYOA outpost. - [Task 4: Verify the BYOA outpost deployment](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/onboard-and-configure/deployment-steps-and-checklist/cloud-service-provider-csp-onboarding/outpost-onboarding/working-with-bringing-your-own-azure-app-byoa-outposts/task-4-verify-the-byoa-outpost-deployment.md): You can customize your own Azure outpost by bringing your own app (BYOA). This page describes the steps for verifying your BYOA outpost deployment. - [The shell script for Azure app registration](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/onboard-and-configure/deployment-steps-and-checklist/cloud-service-provider-csp-onboarding/outpost-onboarding/working-with-bringing-your-own-azure-app-byoa-outposts/the-shell-script-for-azure-app-registration.md): You can run this helper shell script to set up your resources and retrieve their IDs for use while creating your Azure BYOA outpost. This page provides technical, "read-me style" details about the scr - [Outpost troubleshooting](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/onboard-and-configure/deployment-steps-and-checklist/cloud-service-provider-csp-onboarding/outpost-onboarding/outpost-troubleshooting.md): Check here for solutions to issues that might occur while configuring, deploying, and operating outposts. - [Outpost Cloud Service Provider (CSP) permissions](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/onboard-and-configure/deployment-steps-and-checklist/cloud-service-provider-csp-onboarding/outpost-onboarding/outpost-cloud-service-provider-csp-permissions.md): This page lists and explains the various roles and permissions needed for working with resources for outposts by CSP. - [Amazon Web Services (AWS) outpost permissions](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/onboard-and-configure/deployment-steps-and-checklist/cloud-service-provider-csp-onboarding/outpost-onboarding/outpost-cloud-service-provider-csp-permissions/amazon-web-services-aws-outpost-permissions.md): List of Amazon Web Services (AWS) permissions for use during Cortex Cloud outpost onboarding to enable continuous monitoring in your cloud environment. - [Microsoft Azure outpost permissions](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/onboard-and-configure/deployment-steps-and-checklist/cloud-service-provider-csp-onboarding/outpost-onboarding/outpost-cloud-service-provider-csp-permissions/microsoft-azure-outpost-permissions.md): List of Microsoft Azure provider outpost permissions for Cortex Cloud. - [Google Cloud Platform (GCP) outpost permissions](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/onboard-and-configure/deployment-steps-and-checklist/cloud-service-provider-csp-onboarding/outpost-onboarding/outpost-cloud-service-provider-csp-permissions/google-cloud-platform-gcp-outpost-permissions.md): List of Google Cloud Platform (GCP) permissions for use during Cortex Cloud onboarding outposts to enable continuous monitoring in your cloud environment. - [Introduction to Terraform for Cloud service provider (CSP) onboarding](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/onboard-and-configure/deployment-steps-and-checklist/cloud-service-provider-csp-onboarding/introduction-to-terraform-for-cloud-service-provider-csp-onboarding.md): Learn how to onboard Cloud Service Providers (CSPs) using Terraform. Discover step-by-step workflows for initial provisioning, updates, and Cloud Shell deployment. - [Manually connect a cloud instance](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/onboard-and-configure/deployment-steps-and-checklist/cloud-service-provider-csp-onboarding/manually-connect-a-cloud-instance.md): Connect a cloud instance manually when automated onboarding is unavailable. - [Pending cloud instances](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/onboard-and-configure/deployment-steps-and-checklist/cloud-service-provider-csp-onboarding/pending-cloud-instances.md): Review cloud instances awaiting onboarding or configuration. - [Edit your onboarded CSP configuration](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/onboard-and-configure/deployment-steps-and-checklist/cloud-service-provider-csp-onboarding/edit-your-onboarded-csp-configuration.md): Update configuration settings for an onboarded cloud service provider. - [Update cloud permissions after Cortex Cloud release updates](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/onboard-and-configure/deployment-steps-and-checklist/cloud-service-provider-csp-onboarding/update-cloud-permissions-after-cortex-release-updates.md): Manage permission updates for your cloud instances following new feature releases or bug fixes. - [Troubleshoot errors on cloud instances](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/onboard-and-configure/deployment-steps-and-checklist/cloud-service-provider-csp-onboarding/troubleshoot-errors-on-cloud-instances.md): You can troubleshoot errors on cloud instances by drilling down on an instance from the Data Sources & Integrations page. - [Cloud service provider permissions](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/onboard-and-configure/deployment-steps-and-checklist/cloud-service-provider-csp-onboarding/cloud-service-provider-permissions.md): Grant the correct cloud service provider permissions for Cortex Cloud. - [Onboard the Kubernetes Connector](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/onboard-and-configure/deployment-steps-and-checklist/onboard-the-kubernetes-connector.md): Connect Kubernetes clusters to Cortex Cloud for monitoring and security. - [What's new in Kubernetes Connector?](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/onboard-and-configure/deployment-steps-and-checklist/onboard-the-kubernetes-connector/whats-new-in-kubernetes-connector.md): Review recent Kubernetes Connector features and updates. - [Supported Kubernetes distributions](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/onboard-and-configure/deployment-steps-and-checklist/onboard-the-kubernetes-connector/supported-kubernetes-distributions.md): Review Kubernetes distributions supported by the Kubernetes Connector. - [FedRAMP overview](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/onboard-and-configure/deployment-steps-and-checklist/fedramp-overview.md): Learn about Cortex Cloud FedRAMP support and deployment considerations. - [Cortex Cloud federal compliance](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/onboard-and-configure/deployment-steps-and-checklist/fedramp-overview/cortex-cloud-federal-compliance.md): Review federal compliance capabilities in Cortex Cloud. - [Onoarding & configuration](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/onboard-and-configure/deployment-steps-and-checklist/fedramp-overview/onoarding-and-configuration.md): Configure Cortex Cloud for a FedRAMP deployment. - [Limitations & supported regions](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/onboard-and-configure/deployment-steps-and-checklist/fedramp-overview/limitations-and-supported-regions.md): Review FedRAMP limitations and supported Cortex Cloud regions. - [Post-deployment steps](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/onboard-and-configure/post-deployment-steps.md): Complete environment setup, access management, and other post-deployment tasks. - [Set up your environment](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/onboard-and-configure/post-deployment-steps/set-up-your-environment.md): Learn more about setting up the Cortex Cloud environment based on your preferences. - [Configure server settings](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/onboard-and-configure/post-deployment-steps/set-up-your-environment/configure-server-settings.md): Configure server settings for your Cortex Cloud environment. - [Configure security settings](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/onboard-and-configure/post-deployment-steps/set-up-your-environment/configure-security-settings.md): Configure security settings for your Cortex Cloud environment. - [Data and log forwarding](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/onboard-and-configure/post-deployment-steps/set-up-your-environment/data-and-log-forwarding.md): Configure data and log forwarding from Cortex Cloud. - [Forward logs and data from Cortex Cloud to external services](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/onboard-and-configure/post-deployment-steps/set-up-your-environment/data-and-log-forwarding/forward-logs-and-data-from-cortex-cloud-to-external-services.md): Send Cortex Cloud logs and data to external services. - [Configure external applications for forwarding](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/onboard-and-configure/post-deployment-steps/set-up-your-environment/data-and-log-forwarding/forward-logs-and-data-from-cortex-cloud-to-external-services/configure-external-applications-for-forwarding.md): Configure external applications to receive Cortex Cloud notifications. - [Forward notifications to Amazon SQS](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/onboard-and-configure/post-deployment-steps/set-up-your-environment/data-and-log-forwarding/forward-logs-and-data-from-cortex-cloud-to-external-services/configure-external-applications-for-forwarding/forward-notifications-to-amazon-sqs.md): Forward Cortex Cloud notifications to an Amazon SQS queue. - [Forward notifications to Amazon S3](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/onboard-and-configure/post-deployment-steps/set-up-your-environment/data-and-log-forwarding/forward-logs-and-data-from-cortex-cloud-to-external-services/configure-external-applications-for-forwarding/forward-notifications-to-amazon-s3.md): Forward Cortex Cloud notifications to an Amazon S3 bucket. - [Forward notifications to Splunk](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/onboard-and-configure/post-deployment-steps/set-up-your-environment/data-and-log-forwarding/forward-logs-and-data-from-cortex-cloud-to-external-services/configure-external-applications-for-forwarding/forward-notifications-to-splunk.md): Forward Cortex Cloud notifications to Splunk. - [Forward notifications to webhook](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/onboard-and-configure/post-deployment-steps/set-up-your-environment/data-and-log-forwarding/forward-logs-and-data-from-cortex-cloud-to-external-services/configure-external-applications-for-forwarding/forward-notifications-to-webhook.md): Forward Cortex Cloud notifications to a webhook endpoint. - [Integrate a syslog receiver](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/onboard-and-configure/post-deployment-steps/set-up-your-environment/data-and-log-forwarding/forward-logs-and-data-from-cortex-cloud-to-external-services/configure-external-applications-for-forwarding/integrate-a-syslog-receiver.md): Configure a syslog receiver for Cortex Cloud notifications. - [Integrate Slack for outbound notifications](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/onboard-and-configure/post-deployment-steps/set-up-your-environment/data-and-log-forwarding/forward-logs-and-data-from-cortex-cloud-to-external-services/configure-external-applications-for-forwarding/integrate-slack-for-outbound-notifications.md): Configure Slack to receive outbound Cortex Cloud notifications. - [Configure notification forwarding](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/onboard-and-configure/post-deployment-steps/set-up-your-environment/data-and-log-forwarding/forward-logs-and-data-from-cortex-cloud-to-external-services/configure-notification-forwarding.md): Configure where Cortex Cloud forwards notifications. - [Set up email notifications for tenant updates](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/onboard-and-configure/post-deployment-steps/set-up-your-environment/data-and-log-forwarding/forward-logs-and-data-from-cortex-cloud-to-external-services/set-up-email-notifications-for-tenant-updates.md): Configure email notifications for Cortex Cloud tenant updates. - [Monitor administrative activity](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/onboard-and-configure/post-deployment-steps/set-up-your-environment/data-and-log-forwarding/forward-logs-and-data-from-cortex-cloud-to-external-services/monitor-administrative-activity.md): Monitor administrative activity in your Cortex Cloud tenant. - [Data and log notification formats](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/onboard-and-configure/post-deployment-steps/set-up-your-environment/data-and-log-forwarding/data-and-log-notification-formats.md): Review formats for Cortex Cloud data and log notifications. - [Management audit log messages](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/onboard-and-configure/post-deployment-steps/set-up-your-environment/data-and-log-forwarding/data-and-log-notification-formats/management-audit-log-messages.md): Review management audit log message formats. - [Issue notification format](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/onboard-and-configure/post-deployment-steps/set-up-your-environment/data-and-log-forwarding/data-and-log-notification-formats/issue-notification-format.md): Review the format of Cortex Cloud issue notifications. - [Agent Audit log notification format](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/onboard-and-configure/post-deployment-steps/set-up-your-environment/data-and-log-forwarding/data-and-log-notification-formats/agent-audit-log-notification-format.md): Review the format of agent audit log notifications. - [Management Audit log notification format](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/onboard-and-configure/post-deployment-steps/set-up-your-environment/data-and-log-forwarding/data-and-log-notification-formats/management-audit-log-notification-format.md): Review the format of management audit log notifications. - [Log format for IOC and BIOC issues](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/onboard-and-configure/post-deployment-steps/set-up-your-environment/data-and-log-forwarding/data-and-log-notification-formats/log-format-for-ioc-and-bioc-issues.md): Review log formats for IOC and BIOC issues. - [Analytics log format](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/onboard-and-configure/post-deployment-steps/set-up-your-environment/data-and-log-forwarding/data-and-log-notification-formats/analytics-log-format.md): Review the analytics log format. - [Cortex MCP server](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/onboard-and-configure/post-deployment-steps/cortex-mcp-server.md): The Cortex MCP server enables you to leverage Cortex's powerful capabilities directly through natural language. - [Install the Cortex MCP server](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/onboard-and-configure/post-deployment-steps/cortex-mcp-server/install-the-cortex-mcp-server.md): Install the Cortex MCP server in your environment. - [Configure the MCP client](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/onboard-and-configure/post-deployment-steps/cortex-mcp-server/configure-the-mcp-client.md): Configure an MCP client to connect to the Cortex MCP server. - [Use the Cortex MCP server](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/onboard-and-configure/post-deployment-steps/cortex-mcp-server/use-the-cortex-mcp-server.md): Use the Cortex MCP server with your MCP client. - [Create custom Cortex MCP server tools](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/onboard-and-configure/post-deployment-steps/cortex-mcp-server/create-custom-cortex-mcp-server-tools.md): Create custom tools for the Cortex MCP server. - [Manage user roles and access management](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/onboard-and-configure/post-deployment-steps/manage-user-roles-and-access-management.md): Learn how to manage access for users, user roles, user groups, and Single Sign-On (SSO) for users on a specific Cortex Cloud tenant. - [Manage user roles](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/onboard-and-configure/post-deployment-steps/manage-user-roles-and-access-management/manage-user-roles.md): Create and manage user roles in Cortex Cloud. - [Manage user access](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/onboard-and-configure/post-deployment-steps/manage-user-roles-and-access-management/manage-user-access.md): Manage user access to Cortex Cloud features and data. - [User access reference information](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/onboard-and-configure/post-deployment-steps/manage-user-roles-and-access-management/manage-user-access/user-access-reference-information.md): Review reference information for managing user access. - [Manage user scope](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/onboard-and-configure/post-deployment-steps/manage-user-roles-and-access-management/manage-user-scope.md): Manage user scope to control access to Cortex Cloud data. - [Manage access to objects](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/onboard-and-configure/post-deployment-steps/manage-user-roles-and-access-management/manage-access-to-objects.md): Control access to Cortex Cloud objects and saved content. - [Manage access to custom dashboards](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/onboard-and-configure/post-deployment-steps/manage-user-roles-and-access-management/manage-access-to-objects/manage-access-to-custom-dashboards.md): Control access to custom dashboards. - [Manage access to report templates](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/onboard-and-configure/post-deployment-steps/manage-user-roles-and-access-management/manage-access-to-objects/manage-access-to-report-templates.md): Control access to report templates. - [Manage access to playbooks and scripts](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/onboard-and-configure/post-deployment-steps/manage-user-roles-and-access-management/manage-access-to-objects/manage-access-to-playbooks-and-scripts.md): Control access to playbooks and scripts. - [Manage access to saved queries](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/onboard-and-configure/post-deployment-steps/manage-user-roles-and-access-management/manage-access-to-objects/manage-access-to-saved-queries.md): Control access to saved queries. - [Configure the Cortex Agentic Assistant](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/onboard-and-configure/post-deployment-steps/configure-the-cortex-agentic-assistant.md): Configure the Cortex Agentic Assistant for your organization. - [Agentic Assistant components and concepts](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/onboard-and-configure/post-deployment-steps/configure-the-cortex-agentic-assistant/agentic-assistant-components-and-concepts.md): Learn about the key components and concepts, such as agents and actions in the Cortex Agentic Assistant - [Agentic Assistant Hub](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/onboard-and-configure/post-deployment-steps/configure-the-cortex-agentic-assistant/agents-hub.md): Learn about personal and system agents in in the Agentic Assistant Hub - [Manage actions](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/onboard-and-configure/post-deployment-steps/configure-the-cortex-agentic-assistant/agents-hub/manage-actions.md): Manage actions available to Cortex Agentic Assistant agents. - [Register actions](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/onboard-and-configure/post-deployment-steps/configure-the-cortex-agentic-assistant/agents-hub/register-actions.md): Register actions for use by Cortex Agentic Assistant agents. - [Manage agents](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/onboard-and-configure/post-deployment-steps/configure-the-cortex-agentic-assistant/agents-hub/manage-agents.md): Manage Cortex Agentic Assistant agents and their configurations. - [Build agents](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/onboard-and-configure/post-deployment-steps/configure-the-cortex-agentic-assistant/agents-hub/build-agents.md): Build custom agents for the Cortex Agentic Assistant. - [Manage knowledge sources (preview)](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/onboard-and-configure/post-deployment-steps/configure-the-cortex-agentic-assistant/agents-hub/manage-knowledge-sources-preview.md): Enhance AI agent capabilities by leveraging the Knowledge Center (preview) to provide agents with your business-specific source of truth and built-in Cortex (system) knowledge. - [Expand agent capabilities with MCP integrations](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/onboard-and-configure/post-deployment-steps/configure-the-cortex-agentic-assistant/agents-hub/expand-agent-capabilities-with-mcp-integrations.md): Connect MCP integrations to extend agent capabilities. - [Agentic Assistant role-based access control](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/onboard-and-configure/post-deployment-steps/configure-the-cortex-agentic-assistant/agentic-assistant-role-based-access-control.md): Configure permissions to access Cortex Agentic Assistant features. - [XQL query management](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/onboard-and-configure/post-deployment-steps/xql-query-management.md): Administrators can set controls on running XQL queries. - [Dashboards and reports](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/onboard-and-configure/post-deployment-steps/dashboards-and-reports.md): Use dashboards and reports to monitor Cortex Cloud data. - [Asset management](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/cloud-inventory-and-environment/asset-management.md): View and manage assets across your environment. - [Asset inventory overview](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/cloud-inventory-and-environment/asset-inventory-overview.md): Learn about the core concepts, features, and lifecycle of assets within the Asset Inventory. - [All assets](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/cloud-inventory-and-environment/all-assets.md): Learn about the All Assets page, under Asset Inventory. - [All cloud assets](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/cloud-inventory-and-environment/all-cloud-assets.md): Learn about the All Cloud Assets page to view and assess your cloud footprint. - [Discovery Engine](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/cloud-inventory-and-environment/all-cloud-assets/discovery-engine.md): Discover and update cloud assets in the Unified Asset Inventory. - [Asset hierarchy](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/cloud-inventory-and-environment/all-cloud-assets/asset-hierarchy.md): Use cloud hierarchy paths to filter assets and control access. - [Asset classes](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/cloud-inventory-and-environment/asset-classes.md): Accelerating remediation: Automated fix suggestions and manual remediation guidance enable developers to resolve code weaknesses directly in the source repository without context-switching to external - [AI assets](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/cloud-inventory-and-environment/asset-classes/ai-assets.md): Review AI assets in your environment. - [API assets](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/cloud-inventory-and-environment/asset-classes/api-assets.md): Review API assets in your environment. - [Application assets](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/cloud-inventory-and-environment/asset-classes/application-assets.md): Review application assets in your environment. - [Code and CI/CD assets](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/cloud-inventory-and-environment/asset-classes/code-and-ci-cd-assets.md): Review code repositories and CI/CD assets in your environment. - [IaC resources assets](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/cloud-inventory-and-environment/asset-classes/code-and-ci-cd-assets/iac-resources-assets.md): Review infrastructure-as-code resource assets. - [Repository assets](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/cloud-inventory-and-environment/asset-classes/code-and-ci-cd-assets/repository-assets.md): Review source code repository assets. - [VCS organization assets](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/cloud-inventory-and-environment/asset-classes/code-and-ci-cd-assets/vcs-organization-assets.md): Review version control system organization assets. - [CI/CD pipeline assets](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/cloud-inventory-and-environment/asset-classes/code-and-ci-cd-assets/ci-cd-pipeline-assets.md): Review continuous integration and delivery pipeline assets. - [CI/CD instances assets](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/cloud-inventory-and-environment/asset-classes/code-and-ci-cd-assets/ci-cd-instances-assets.md): Review continuous integration and delivery instance assets. - [Software package assets](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/cloud-inventory-and-environment/asset-classes/code-and-ci-cd-assets/software-package-assets.md): Review software package assets in your environment. - [Compute assets](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/cloud-inventory-and-environment/asset-classes/compute-assets.md): Review compute assets in your environment. - [Container image assets](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/cloud-inventory-and-environment/asset-classes/compute-assets/container-image-assets.md): Review container image assets in your environment. - [Serverless functions assets](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/cloud-inventory-and-environment/asset-classes/compute-assets/serverless-functions-assets.md): Review serverless function assets in your environment. - [VM images assets](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/cloud-inventory-and-environment/asset-classes/compute-assets/vm-images-assets.md): Review virtual machine image assets in your environment. - [Data assets](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/cloud-inventory-and-environment/asset-classes/data-assets.md): Review data assets in your environment. - [Device assets](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/cloud-inventory-and-environment/asset-classes/device-assets.md): Review device assets in your environment. - [External Surface assets](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/cloud-inventory-and-environment/asset-classes/external-surface-assets.md): Review externally exposed assets in your environment. - [Website assets](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/cloud-inventory-and-environment/asset-classes/external-surface-assets/website-assets.md): Review website assets in your external attack surface. - [Service assets](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/cloud-inventory-and-environment/asset-classes/external-surface-assets/service-assets.md): Review service assets in your external attack surface. - [Domain assets](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/cloud-inventory-and-environment/asset-classes/external-surface-assets/domain-assets.md): Review domain assets in your external attack surface. - [Certificate assets](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/cloud-inventory-and-environment/asset-classes/external-surface-assets/certificate-assets.md): Review certificate assets in your external attack surface. - [External Surface attribution evidence](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/cloud-inventory-and-environment/asset-classes/external-surface-assets/external-surface-attribution-evidence.md): Review evidence used to attribute external assets to your organization. - [Identity assets](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/cloud-inventory-and-environment/asset-classes/identity-assets.md): Review identity assets in your environment. - [Network assets](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/cloud-inventory-and-environment/asset-classes/network-assets.md): Review network assets in your environment. - [Security services assets](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/cloud-inventory-and-environment/asset-classes/security-services-assets.md): Review security service assets in your environment. - [Asset groups](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/cloud-inventory-and-environment/asset-groups.md): Group assets based on shared attributes to address them collectively, simplify filtering, and enable strict access control boundaries. - [Manage Risk Scores](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/cloud-inventory-and-environment/manage-asset-scores.md): View and investigate User Scores and Host Scores using the Risk Scores page to identify high-risk assets and detect compromised accounts or malicious activities. - [Asset configurations](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/cloud-inventory-and-environment/asset-configurations.md): Configure how Cortex Cloud identifies and classifies assets. - [Network configurations](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/cloud-inventory-and-environment/asset-configurations/network-configuration.md): Configure your internal network parameters, trusted networks, and external IP ranges to help Cortex Cloud identify and map your network assets. - [Application criteria](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/cloud-inventory-and-environment/asset-configurations/application-criteria.md): Define criteria for identifying application assets. - [Asset Roles](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/cloud-inventory-and-environment/asset-configurations/asset-roles.md): View asset roles and the number of assets that are associated with each role. Learn how to manage asset roles for users and endpoints. - [Manage Asset Roles for Endpoints](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/cloud-inventory-and-environment/asset-configurations/asset-roles/manage-asset-roles-for-endpoints.md): Assign and manage asset roles for endpoints. - [Manage Asset Roles for Users](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/cloud-inventory-and-environment/asset-configurations/asset-roles/manage-asset-roles-for-users.md): Assign and manage asset roles for users. - [Honey user](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/cloud-inventory-and-environment/asset-configurations/asset-roles/manage-asset-roles-for-users/honey-user.md): Configure honey users to detect suspicious identity activity. - [Overview of cases](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/cases-and-issues/overview-of-cases.md): Learn the core concepts and lifecycle of Cortex Cloud cases. - [What are cases?](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/cases-and-issues/overview-of-cases/what-are-cases.md): Understand how Cortex Cloud groups related security activity into cases. - [Resolving cases with AI](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/cases-and-issues/overview-of-cases/resolving-cases-with-ai.md): Use AI capabilities to investigate and resolve cases. - [Case lifecycle](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/cases-and-issues/overview-of-cases/case-lifecycle.md): Understand the stages and status changes in a case lifecycle. - [Case thresholds](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/cases-and-issues/overview-of-cases/case-thresholds.md): Learn how case thresholds determine when cases are created. - [Case scope and impact](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/cases-and-issues/overview-of-cases/case-scope-and-impact.md): Understand how case scope and impact help prioritize investigations. - [Case and issue domains](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/cases-and-issues/overview-of-cases/case-and-issue-domains.md): Learn how domains organize cases and issues by security area. - [Overview of case teams and roles](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/cases-and-issues/overview-of-cases/overview-of-case-teams-and-roles.md): Understand case teams and the roles that support investigations. - [Case concepts](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/cases-and-issues/case-concepts.md): Learn the concepts that govern cases, issues, and investigations. - [Issues, findings, and events](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/cases-and-issues/case-concepts/issues-findings-and-events.md): Understand the relationship between issues, findings, and events. - [Case grouping](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/cases-and-issues/case-concepts/case-grouping.md): Learn how Cortex Cloud groups related issues into cases. - [Case scoring](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/cases-and-issues/case-concepts/case-scoring.md): Understand how Cortex Cloud calculates case scores. - [What is Causality?](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/cases-and-issues/case-concepts/what-is-causality.md): Learn how causality connects related events during investigations. - [Analyze and resolve cases](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/cases-and-issues/analyze-and-resolve-cases.md): Learn how to analyze and resolve cases. - [Review all cases](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/cases-and-issues/analyze-and-resolve-cases/review-all-cases.md): Review and filter cases across your environment. - [Start case analysis](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/cases-and-issues/analyze-and-resolve-cases/start-case-analysis.md): Begin analyzing a case from the Cases page. - [Agentic Assistant- Case Investigation agent](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/cases-and-issues/analyze-and-resolve-cases/start-case-analysis/agentic-assistant-case-investigation-agent.md): Use the Case Investigation agent to analyze a case. - [Establish case context](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/cases-and-issues/analyze-and-resolve-cases/establish-case-context.md): Gather and review the context needed to investigate a case. - [AI-generated case summaries](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/cases-and-issues/analyze-and-resolve-cases/establish-case-context/ai-generated-case-summaries.md): Use AI-generated summaries to quickly understand case details. - [Assess case severity and score](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/cases-and-issues/analyze-and-resolve-cases/establish-case-context/assess-case-severity-and-score.md): Review and adjust a case's severity and score. - [Update case attributes](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/cases-and-issues/analyze-and-resolve-cases/establish-case-context/update-case-attributes.md): Update case attributes to keep investigations accurate. - [Analyze case details](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/cases-and-issues/analyze-and-resolve-cases/analyze-case-details.md): Examine evidence, issues, and related data in a case. - [Grouping graph](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/cases-and-issues/analyze-and-resolve-cases/analyze-case-details/grouping-graph.md): Use the grouping graph to explore related case activity. - [Evidence](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/cases-and-issues/analyze-and-resolve-cases/analyze-case-details/evidence.md): Review evidence associated with a case. - [Issue feed](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/cases-and-issues/analyze-and-resolve-cases/analyze-case-details/issue-feed.md): Review issues associated with a case. - [Associated assets and artifacts](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/cases-and-issues/analyze-and-resolve-cases/analyze-case-details/associated-assets-and-artifacts.md): Review assets and artifacts associated with a case. - [MITRE ATT\&CK tactics and techniques](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/cases-and-issues/analyze-and-resolve-cases/analyze-case-details/mitre-att-and-ck-tactics-and-techniques.md): Review MITRE ATT\&CK tactics and techniques in a case. - [Compliance standards and controls](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/cases-and-issues/analyze-and-resolve-cases/analyze-case-details/compliance-standards-and-controls.md): Review compliance standards and controls associated with a case. - [Case timeline](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/cases-and-issues/analyze-and-resolve-cases/analyze-case-details/case-timeline.md): Review chronological activity and events in a case. - [Detailed view](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/cases-and-issues/analyze-and-resolve-cases/analyze-case-details/detailed-view.md): Open a detailed view of case evidence and activity. - [Resolve the case](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/cases-and-issues/analyze-and-resolve-cases/resolve-the-case.md): Resolve a case and record its outcome. - [Resolution Center](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/cases-and-issues/analyze-and-resolve-cases/resolve-the-case/resolution-center.md): Use Resolution Center to manage case resolution tasks. - [Collaborative notes and comments](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/cases-and-issues/analyze-and-resolve-cases/resolve-the-case/collaborative-notes-and-comments.md): Add notes and comments to collaborate on a case. - [How to resolve a case](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/cases-and-issues/analyze-and-resolve-cases/resolve-the-case/resolve-a-case.md): Complete the steps required to resolve a case. - [Resolution reasons for cases and issues](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/cases-and-issues/analyze-and-resolve-cases/resolve-the-case/resolution-reasons-for-cases-and-issues.md): Select resolution reasons for resolved cases and issues. - [Monitor and track resolution times](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/cases-and-issues/analyze-and-resolve-cases/resolve-the-case/monitor-and-track-resolution-times.md): Track case resolution times against defined goals. - [Additional case actions](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/cases-and-issues/analyze-and-resolve-cases/additional-case-actions.md): Perform additional actions to manage and organize cases. - [Create a case](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/cases-and-issues/analyze-and-resolve-cases/additional-case-actions/create-a-case.md): Create a case for a security investigation. - [Merge a case](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/cases-and-issues/analyze-and-resolve-cases/additional-case-actions/merge-a-case.md): Merge related cases into a single investigation. - [Assign a case team and restrict access](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/cases-and-issues/analyze-and-resolve-cases/additional-case-actions/assign-a-case-team-and-restrict-access.md): Assign a case team and restrict case access. - [Playbook examples](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/cases-and-issues/analyze-and-resolve-cases/additional-case-actions/assign-a-case-team-and-restrict-access/playbook-examples.md): Review playbook examples for case teams and access restrictions. - [Investigation and response](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/cases-and-issues/investigation-and-response.md): Investigate issues, findings, and assets, then automate response actions. - [Investigate issues](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/cases-and-issues/investigation-and-response/investigate-issues.md): Cortex Cloud generates issues to bring your attention to security risks in your framework. - [Overview of the Issues page](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/cases-and-issues/investigation-and-response/investigate-issues/overview-of-the-issues-page.md): Review and manage security issues from the Issues page. - [Issue card](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/cases-and-issues/investigation-and-response/investigate-issues/issue-card.md): Understand the information displayed on an issue card. - [Resolution actions](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/cases-and-issues/investigation-and-response/investigate-issues/resolution-actions.md): Resolve, close, or otherwise act on an issue. - [Link or unlink issues from a case](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/cases-and-issues/investigation-and-response/investigate-issues/link-or-unlink-issues-from-a-case.md): Link issues to a case or remove existing links. - [Run an automation on an issue](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/cases-and-issues/investigation-and-response/investigate-issues/run-an-automation-on-an-issue.md): Run an automation directly from an issue. - [Use the War Room in an investigation](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/cases-and-issues/investigation-and-response/investigate-issues/use-the-war-room-in-an-investigation.md): Use the War Room to collaborate during an issue investigation. - [Use the Work Plan in an investigation](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/cases-and-issues/investigation-and-response/investigate-issues/use-the-work-plan-in-an-investigation.md): Use the Work Plan to track investigation tasks. - [Issue deduplication](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/cases-and-issues/investigation-and-response/investigate-issues/issue-deduplication.md): Understand how Cortex Cloud identifies and merges duplicate issues. - [Issue investigation actions](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/cases-and-issues/investigation-and-response/investigate-issues/issue-investigation-actions.md): Use actions to manage and investigate issues. - [Copy issues](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/cases-and-issues/investigation-and-response/investigate-issues/issue-investigation-actions/copy-issues.md): Copy an issue to create a new investigation record. - [Update issue fields](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/cases-and-issues/investigation-and-response/investigate-issues/issue-investigation-actions/update-issue-fields.md): Update fields on one or more issues. - [Export issue details to a file](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/cases-and-issues/investigation-and-response/investigate-issues/issue-investigation-actions/export-issue-details-to-a-file.md): Export issue details to a file. - [Exclude an issue](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/cases-and-issues/investigation-and-response/investigate-issues/issue-investigation-actions/exclude-an-issue.md): Exclude an issue from further investigation. - [Query case and issue data](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/cases-and-issues/investigation-and-response/investigate-issues/issue-investigation-actions/query-case-and-issue-data.md): Query case and issue data using XQL. - [Issue syncing](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/cases-and-issues/investigation-and-response/investigate-issues/issue-syncing.md): Configure and monitor synchronization of issues with external systems. - [Review findings](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/cases-and-issues/investigation-and-response/review-findings.md): Review findings for an asset to gain insights into an asset’s posture status. - [Findings card](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/cases-and-issues/investigation-and-response/review-findings/findings-card.md): Understand the information displayed on a finding card. - [Investigate artifacts and assets](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/cases-and-issues/investigation-and-response/investigate-artifacts-and-assets.md): You can investigate specific artifacts and assets on dedicated views related to IP address, Network Assets, and File and Process Hash information. - [Investigate an IP address](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/cases-and-issues/investigation-and-response/investigate-artifacts-and-assets/investigate-an-ip-address.md): Investigate an IP address and its related activity. - [Investigate an asset](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/cases-and-issues/investigation-and-response/investigate-artifacts-and-assets/investigate-an-asset.md): Investigate an asset and its related security data. - [Investigate a file and process hash](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/cases-and-issues/investigation-and-response/investigate-artifacts-and-assets/investigate-a-file-and-process-hash.md): Investigate a file or process hash. - [Investigate a user](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/cases-and-issues/investigation-and-response/investigate-artifacts-and-assets/investigate-a-user.md): Investigate a user and related security activity. - [Cortex Assistant](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/cases-and-issues/investigation-and-response/cortex-assistant.md): Cortex Assistant is designed to streamline processes by simplifying case triaging, investigation, and remediation. It enables you to seamlessly uncover new insights on hashes, hosts, and more. You can - [Cortex Assistant layout](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/cases-and-issues/investigation-and-response/cortex-assistant/cortex-assistant-layout.md): Understand the Cortex Assistant interface and layout. - [Cortex Assistant capabilities](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/cases-and-issues/investigation-and-response/cortex-assistant/cortex-assistant-capabilities.md): Explore Cortex Assistant capabilities for investigations and response. - [Automation](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/cases-and-issues/investigation-and-response/automation.md): Automate investigation and response workflows using Cortex Cloud automation. - [Quick Actions](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/cases-and-issues/investigation-and-response/automation/quick-actions.md): Run Quick Actions to respond to cases and issues. - [Automation Exclusion Center](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/cases-and-issues/investigation-and-response/automation/automation-exclusion-center.md): Manage automation exclusions for cases and issues. - [Manage automation exclusion policies](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/cases-and-issues/investigation-and-response/automation/manage-automation-exclusion-policies.md): Create and manage policies that exclude automation runs. - [Playbooks](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/cases-and-issues/investigation-and-response/automation/playbooks.md): Create, manage, and run playbooks for automated response. - [Playbooks overview](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/cases-and-issues/investigation-and-response/automation/playbooks/playbooks-overview.md): Learn how playbooks automate investigation and response workflows. - [Access to playbooks](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/cases-and-issues/investigation-and-response/automation/playbooks/access-to-playbooks.md): Control access to playbooks and their content. - [Playbook development checklist](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/cases-and-issues/investigation-and-response/automation/playbooks/playbook-development-checklist.md): Use a checklist to plan and build effective playbooks. - [Plan your playbook](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/cases-and-issues/investigation-and-response/automation/playbooks/plan-your-playbook.md): Plan a playbook before building its tasks and logic. - [Manage playbooks](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/cases-and-issues/investigation-and-response/automation/playbooks/manage-playbooks.md): Manage existing playbooks and their settings. - [Build your playbook](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/cases-and-issues/investigation-and-response/automation/playbooks/build-your-playbook.md): Build a playbook by adding tasks, inputs, and logic. - [Choose from existing playbooks or create your own](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/cases-and-issues/investigation-and-response/automation/playbooks/build-your-playbook/choose-from-existing-playbooks-or-create-your-own.md): Start with an existing playbook or create a new one. - [Configure playbook settings](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/cases-and-issues/investigation-and-response/automation/playbooks/build-your-playbook/configure-playbook-settings.md): Configure playbook details, inputs, and settings. - [Add objects from the Task Library](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/cases-and-issues/investigation-and-response/automation/playbooks/build-your-playbook/add-objects-from-the-task-library.md): Add Task Library objects to a playbook. - [Add commands and scripts](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/cases-and-issues/investigation-and-response/automation/playbooks/build-your-playbook/add-objects-from-the-task-library/add-commands-and-scripts.md): Add commands and scripts to a playbook. - [Add sub-playbooks](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/cases-and-issues/investigation-and-response/automation/playbooks/build-your-playbook/add-objects-from-the-task-library/add-sub-playbooks.md): Add sub-playbooks to reuse workflows. - [Add AI Prompt tasks](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/cases-and-issues/investigation-and-response/automation/playbooks/build-your-playbook/add-objects-from-the-task-library/add-ai-prompt-tasks.md): Add AI Prompt tasks to a playbook. - [Add manual tasks and blank tasks](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/cases-and-issues/investigation-and-response/automation/playbooks/build-your-playbook/add-objects-from-the-task-library/add-manual-tasks-and-blank-tasks.md): Add manual and blank tasks to a playbook. - [Create a standard task](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/cases-and-issues/investigation-and-response/automation/playbooks/build-your-playbook/add-objects-from-the-task-library/add-manual-tasks-and-blank-tasks/create-a-standard-task.md): Define a Standard task in Cortex Cloud. - [Create a conditional task](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/cases-and-issues/investigation-and-response/automation/playbooks/build-your-playbook/add-objects-from-the-task-library/add-manual-tasks-and-blank-tasks/create-a-conditional-task.md): Create a Conditional task in a playbook. - [Create a communication task](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/cases-and-issues/investigation-and-response/automation/playbooks/build-your-playbook/add-objects-from-the-task-library/add-manual-tasks-and-blank-tasks/create-a-communication-task.md): Communication tasks let you send surveys and collect issue data. - [Create a section header](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/cases-and-issues/investigation-and-response/automation/playbooks/build-your-playbook/create-a-section-header.md): Add section headers to organize playbook tasks. - [Configure script error handling in a playbook](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/cases-and-issues/investigation-and-response/automation/playbooks/build-your-playbook/configure-script-error-handling-in-a-playbook.md): Configure how playbooks handle script errors. - [Customize your playbook](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/cases-and-issues/investigation-and-response/automation/playbooks/build-your-playbook/customize-your-playbook.md): Customize playbook behavior with loops, filters, and transformers. - [Configure a sub-playbook loop](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/cases-and-issues/investigation-and-response/automation/playbooks/build-your-playbook/customize-your-playbook/configure-a-sub-playbook-loop.md): Configure a loop that runs a sub-playbook repeatedly. - [Filter and Transform data](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/cases-and-issues/investigation-and-response/automation/playbooks/build-your-playbook/customize-your-playbook/filter-and-transform-data.md): Filter and transform data used by playbook tasks. - [Create custom filter and transformers](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/cases-and-issues/investigation-and-response/automation/playbooks/build-your-playbook/customize-your-playbook/create-custom-filter-and-transformers.md): Create custom filters and transformers for playbook data. - [Filter considerations, categories, and built-in filters](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/cases-and-issues/investigation-and-response/automation/playbooks/build-your-playbook/customize-your-playbook/filter-considerations-categories-and-built-in-filters.md): Understand built-in filters and filter design considerations. - [Transformer considerations, categories, and built-in transformers](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/cases-and-issues/investigation-and-response/automation/playbooks/build-your-playbook/customize-your-playbook/transformer-considerations-categories-and-built-in-transformers.md): Understand built-in transformers and transformer design considerations. - [Extend context](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/cases-and-issues/investigation-and-response/automation/playbooks/build-your-playbook/customize-your-playbook/extend-context.md): Add data to the playbook context. - [Extract Indicators](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/cases-and-issues/investigation-and-response/automation/playbooks/build-your-playbook/customize-your-playbook/extract-indicators.md): Extract indicators from playbook data. - [Update issue fields with playbook tasks](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/cases-and-issues/investigation-and-response/automation/playbooks/build-your-playbook/customize-your-playbook/update-issue-fields-with-playbook-tasks.md): Update issue fields with playbook tasks. - [Test your playbook](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/cases-and-issues/investigation-and-response/automation/playbooks/build-your-playbook/test-your-playbook.md): Set breakpoints, conditional breakpoints, skips, and input or output overrides in the playbook debugger. - [Troubleshoot playbook performance](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/cases-and-issues/investigation-and-response/automation/playbooks/build-your-playbook/test-your-playbook/troubleshoot-playbook-performance.md): Identify and resolve playbook performance issues. - [Manage playbook content](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/cases-and-issues/investigation-and-response/automation/playbooks/build-your-playbook/manage-playbook-content.md): Manage playbook inputs, outputs, and task content. - [Accelerate playbook development using the Agentic Playbook Builder (preview)](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/cases-and-issues/investigation-and-response/automation/playbooks/accelerate-playbook-development-using-the-agentic-playbook-builder-preview.md): Use the Agentic Playbook Builder (preview) in Cortex Cloud to create, optimize, and troubleshoot playbooks using natural language and security best practices. - [Agentic Playbook Builder prompt examples](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/cases-and-issues/investigation-and-response/automation/playbooks/accelerate-playbook-development-using-the-agentic-playbook-builder-preview/agentic-playbook-builder-prompt-examples.md): Use Agentic Playbook Builder prompt examples to generate Cortex Cloud security response playbooks for triage, enrichment, and remediation. - [Best practices for playbooks](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/cases-and-issues/investigation-and-response/automation/playbooks/best-practices-for-playbooks.md): Apply best practices when designing and maintaining playbooks. - [AI Prompts](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/cases-and-issues/investigation-and-response/automation/ai-prompts.md): Create and manage AI prompts for automations. - [AI prompts role-based access control](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/cases-and-issues/investigation-and-response/automation/ai-prompts/ai-prompts-role-based-access-control.md): Manage AI prompt permissions with role-based access control. - [Use existing prompts](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/cases-and-issues/investigation-and-response/automation/ai-prompts/use-existing-prompts.md): Find, duplicate, and edit prompts from the Prompts Library. - [Create a prompt](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/cases-and-issues/investigation-and-response/automation/ai-prompts/create-a-prompt.md): Create or edit prompts, configure settings, and use them in agents or playbooks. - [Write effective prompts](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/cases-and-issues/investigation-and-response/automation/ai-prompts/write-effective-prompts.md): Tips for creating effective AI prompts. - [Create an automation rule](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/cases-and-issues/investigation-and-response/automation/create-an-automation-rule.md): Learn how to create an automation rule for an issue. - [Scripts](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/cases-and-issues/investigation-and-response/automation/scripts.md): Create, manage, and run scripts in Cortex Cloud. - [Access to scripts](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/cases-and-issues/investigation-and-response/automation/scripts/access-to-scripts.md): Control access to scripts and script content. - [Use existing scripts](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/cases-and-issues/investigation-and-response/automation/scripts/use-existing-scripts.md): Find, review, and use existing scripts. - [Create a script](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/cases-and-issues/investigation-and-response/automation/scripts/create-a-script.md): Create a script to automate investigation or response tasks. - [Accelerate script development using the Automation Engineer agent](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/cases-and-issues/investigation-and-response/automation/scripts/accelerate-script-development-using-the-automation-engineer-agent.md): Use the Automation Engineer agent to accelerate script development. - [Change the Docker image in an integration or script](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/cases-and-issues/investigation-and-response/automation/scripts/change-the-docker-image-in-an-integration-or-script.md): Change the Docker image used by an integration or script. - [Context data](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/cases-and-issues/investigation-and-response/automation/context-data.md): Use context data to assist with the investigation and remediation process. - [Issue context data](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/cases-and-issues/investigation-and-response/automation/context-data/issue-context-data.md): View context data associated with an issue. - [Case context data](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/cases-and-issues/investigation-and-response/automation/context-data/case-context-data.md): View context data associated with a case. - [Search context data](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/cases-and-issues/investigation-and-response/automation/context-data/search-context-data.md): Search available context data. - [Add context data to an issue](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/cases-and-issues/investigation-and-response/automation/context-data/add-context-data-to-an-issue.md): Add context data to an issue. - [Add context data to a case](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/cases-and-issues/investigation-and-response/automation/context-data/add-context-data-to-a-case.md): Add context data to a case. - [Delete context data from a case](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/cases-and-issues/investigation-and-response/automation/context-data/delete-context-data-from-a-case.md): Delete context data from a case. - [Use context data in a playbook](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/cases-and-issues/investigation-and-response/automation/context-data/use-context-data-in-a-playbook.md): Use context data in a playbook. - [Lists](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/cases-and-issues/investigation-and-response/automation/lists.md): Create and manage lists for automation workflows. - [Create a list](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/cases-and-issues/investigation-and-response/automation/lists/create-a-list.md): Create a list for use in scripts and playbooks. - [List commands](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/cases-and-issues/investigation-and-response/automation/lists/list-commands.md): Use commands to manage list contents. - [Use cases: JSON lists](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/cases-and-issues/investigation-and-response/automation/lists/use-cases-json-lists.md): Use JSON lists in automation workflows. - [Transform a list into an array](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/cases-and-issues/investigation-and-response/automation/lists/transform-a-list-into-an-array.md): Transform a list into an array for automation tasks. - [Integrations](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/cases-and-issues/investigation-and-response/automation/integrations.md): Configure and manage integrations used by automation workflows. - [Add an integration instance](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/cases-and-issues/investigation-and-response/automation/integrations/add-an-integration-instance.md): Add an integration instance for automation use. - [Use integration commands in the CLI](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/cases-and-issues/investigation-and-response/automation/integrations/use-integration-commands-in-the-cli.md): Run integration commands from the Cortex CLI. - [Troubleshoot integations](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/cases-and-issues/investigation-and-response/automation/integrations/troubleshoot-integations.md): Troubleshoot integration configuration and execution issues. - [Manage credentials](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/cases-and-issues/investigation-and-response/automation/integrations/manage-credentials.md): Manage credentials used by integrations. - [Engines](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/cases-and-issues/investigation-and-response/automation/engines.md): Install, manage, configure, and troubleshoot engines. - [What is an engine?](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/cases-and-issues/investigation-and-response/automation/engines/what-is-an-engine.md): Learn how engines execute integrations, scripts, and playbooks. - [Engine requirements](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/cases-and-issues/investigation-and-response/automation/engines/engine-requirements.md): Hardware, OS, and required URLs for engines. - [Install an engine](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/cases-and-issues/investigation-and-response/automation/engines/install-an-engine.md): Install, deploy and configure Cortex Cloud engines. - [Docker](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/cases-and-issues/investigation-and-response/automation/engines/install-an-engine/docker.md): Install, configure, secure, and troubleshoot Docker for Cortex Cloud engines. - [Install Docker](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/cases-and-issues/investigation-and-response/automation/engines/install-an-engine/docker/install-docker.md): Install Docker and verify engine user permissions. - [Install Docker distribution for Red Hat](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/cases-and-issues/investigation-and-response/automation/engines/install-an-engine/docker/install-docker-distribution-for-red-hat.md): Configure Docker and SELinux on Red Hat engine servers. - [Docker image security](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/cases-and-issues/investigation-and-response/automation/engines/install-an-engine/docker/docker-image-security.md): Secure, harden, and troubleshoot Docker images and containers. - [Docker FAQs](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/cases-and-issues/investigation-and-response/automation/engines/install-an-engine/docker/docker-faqs.md): Find answers to common Docker questions for engines. - [Troubleshoot Docker Issues](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/cases-and-issues/investigation-and-response/automation/engines/install-an-engine/docker/troubleshoot-docker-issues.md): Troubleshoot Docker issues on Cortex Cloud engines. - [Configure Docker pull rate limit](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/cases-and-issues/investigation-and-response/automation/engines/install-an-engine/docker/configure-docker-pull-rate-limit.md): Configure Docker image pull rate limits for engines. - [Change the Docker Installation folder](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/cases-and-issues/investigation-and-response/automation/engines/install-an-engine/docker/change-the-docker-installation-folder.md): Change the Docker installation folder on an engine. - [Docker hardening guide](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/cases-and-issues/investigation-and-response/automation/engines/install-an-engine/docker/docker-hardening-guide.md): Apply Docker hardening guidance for Cortex Cloud engines. - [Docker network hardening](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/cases-and-issues/investigation-and-response/automation/engines/install-an-engine/docker/docker-hardening-guide/docker-network-hardening.md): Harden Docker network settings for an engine. - [Configure Docker images](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/cases-and-issues/investigation-and-response/automation/engines/install-an-engine/docker/docker-hardening-guide/configure-docker-images.md): Configure Docker images for hardened engine deployments. - [Run Docker with non-root internal users](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/cases-and-issues/investigation-and-response/automation/engines/install-an-engine/docker/docker-hardening-guide/run-docker-with-non-root-internal-users.md): Run Docker with non-root internal users. - [Configure the memory limit support without swap capabilities](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/cases-and-issues/investigation-and-response/automation/engines/install-an-engine/docker/docker-hardening-guide/configure-the-memory-limit-support-without-swap-capabilities.md): Configure memory limits without swap support. - [Configure the memory limitation](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/cases-and-issues/investigation-and-response/automation/engines/install-an-engine/docker/docker-hardening-guide/configure-the-memory-limitation.md): Configure Docker memory limits for an engine. - [Configure the CPU, PIDs, and open the file descriptors limit](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/cases-and-issues/investigation-and-response/automation/engines/install-an-engine/docker/docker-hardening-guide/configure-the-cpu-pids-and-open-the-file-descriptors-limit.md): Configure CPU, PID, and file descriptor limits. - [Check Docker hardening configurations](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/cases-and-issues/investigation-and-response/automation/engines/install-an-engine/docker/docker-hardening-guide/check-docker-hardening-configurations.md): Verify Docker hardening configurations. - [Podman](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/cases-and-issues/investigation-and-response/automation/engines/install-an-engine/podman.md): Install, configure, and troubleshoot Podman for Cortex Cloud engines. - [Change the Container storage](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/cases-and-issues/investigation-and-response/automation/engines/install-an-engine/podman/change-the-container-storage.md): Configure Podman container storage for an engine. - [Install Podman](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/cases-and-issues/investigation-and-response/automation/engines/install-an-engine/podman/install-podman.md): Install and configure Podman for Cortex Cloud engines. - [Migrate from Docker to Podman](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/cases-and-issues/investigation-and-response/automation/engines/install-an-engine/podman/migrate-from-docker-to-podman.md): Migrate an existing engine from Docker to Podman. - [Troubleshoot Podman](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/cases-and-issues/investigation-and-response/automation/engines/install-an-engine/podman/troubleshoot-podman.md): Resolve common Podman issues on Cortex Cloud engines. - [Manage engines](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/cases-and-issues/investigation-and-response/automation/engines/manage-engines.md): Manage engines and load balancing groups. - [Upgrade an engine](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/cases-and-issues/investigation-and-response/automation/engines/upgrade-an-engine.md): Upgrade an engine on Cortex Cloud or directly on the remote machine. - [Remove an engine](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/cases-and-issues/investigation-and-response/automation/engines/remove-an-engine.md): Remove an engine by running the relevant command, depending on your operating system. - [Configure engines](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/cases-and-issues/investigation-and-response/automation/engines/configure-engines.md): Configure Cortex Cloud engines by editing the d1.conf file or modifying the configuration in the UI (for shell installations). - [Configure the engine to use a web proxy](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/cases-and-issues/investigation-and-response/automation/engines/configure-engines/configure-the-engine-to-use-a-web-proxy.md): Configure an engine to connect through a web proxy. - [Configure the engine to call the server without using a proxy](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/cases-and-issues/investigation-and-response/automation/engines/configure-engines/configure-the-engine-to-call-the-server-without-using-a-proxy.md): Configure an engine to reach the server without a proxy. - [Use NGINX as a reverse proxy](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/cases-and-issues/investigation-and-response/automation/engines/configure-engines/use-nginx-as-a-reverse-proxy.md): Use NGINX as a reverse proxy for an engine. - [Configure an engine to use custom certificates](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/cases-and-issues/investigation-and-response/automation/engines/configure-engines/configure-an-engine-to-use-custom-certificates.md): Configure custom certificates for an engine. - [Use an engine in an integration](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/cases-and-issues/investigation-and-response/automation/engines/use-an-engine-in-an-integration.md): Use an engine or a load-balancing group of engines to fetch issues and run commands for an integration. - [Run a script using an engine](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/cases-and-issues/investigation-and-response/automation/engines/run-a-script-using-an-engine.md): Run a script on an engine or load-balancing group to distribute the workload and improve performance. - [Troubleshoot engines](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/cases-and-issues/investigation-and-response/automation/engines/troubleshoot-engines.md): Troubleshoot engines by accessing logs and viewing errors. - [Troubleshoot integrations running on engines](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/cases-and-issues/investigation-and-response/automation/engines/troubleshoot-integrations-running-on-engines.md): Troubleshoot integrations that run on Cortex Cloud engines. - [Build XQL queries](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/cases-and-issues/investigation-and-response/build-xql-queries.md): Learn more about how to build Cortex Query Language (XQL) queries using the Query Builder. - [About the Query Builder](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/cases-and-issues/investigation-and-response/build-xql-queries/about-the-query-builder.md): The Query Builder facilitates threat detection, case expansion, and data analytics for suspected threats. - [How to build XQL queries](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/cases-and-issues/investigation-and-response/build-xql-queries/how-to-build-xql-queries.md): Learn more about how to build XQL queries in the Query Builder. - [Get started with XQL queries](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/cases-and-issues/investigation-and-response/build-xql-queries/how-to-build-xql-queries/get-started-with-xql-queries.md): Get started building XQL queries in the Query Builder. - [Useful XQL user interface features](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/cases-and-issues/investigation-and-response/build-xql-queries/how-to-build-xql-queries/useful-xql-user-interface-features.md): Use Query Builder interface features to build and refine queries. - [XQL Query best practices](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/cases-and-issues/investigation-and-response/build-xql-queries/how-to-build-xql-queries/xql-query-best-practices.md): Apply best practices when writing XQL queries. - [Expected results when querying fields](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/cases-and-issues/investigation-and-response/build-xql-queries/how-to-build-xql-queries/expected-results-when-querying-fields.md): Understand expected results when querying field values. - [Create XQL query](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/cases-and-issues/investigation-and-response/build-xql-queries/how-to-build-xql-queries/create-xql-query.md): Create an XQL query in the Query Builder. - [Review XQL query results](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/cases-and-issues/investigation-and-response/build-xql-queries/how-to-build-xql-queries/review-xql-query-results.md): Review and analyze XQL query results. - [Translate to XQL](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/cases-and-issues/investigation-and-response/build-xql-queries/how-to-build-xql-queries/translate-to-xql.md): Translate search criteria into an XQL query. - [Graph query results](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/cases-and-issues/investigation-and-response/build-xql-queries/how-to-build-xql-queries/graph-query-results.md): Visualize XQL query results in a graph. - [XQL query entities](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/cases-and-issues/investigation-and-response/build-xql-queries/legacy-query-builder.md): Learn more about the entities in the Legacy Query Builder. - [Query across all entities](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/cases-and-issues/investigation-and-response/build-xql-queries/legacy-query-builder/query-across-all-entities.md): Query data across all available entities. - [Overview of the Query Center](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/cases-and-issues/investigation-and-response/build-xql-queries/overview-of-the-query-center.md): View information about the In Progress and Completed queries that that were run on the tenant. - [Edit and run queries in Query Center](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/cases-and-issues/investigation-and-response/build-xql-queries/overview-of-the-query-center/edit-and-run-queries-in-query-center.md): Edit and rerun queries from Query Center. - [Query Center reference information](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/cases-and-issues/investigation-and-response/build-xql-queries/overview-of-the-query-center/query-center-reference-information.md): Review Query Center fields and status information. - [Manage scheduled queries](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/cases-and-issues/investigation-and-response/build-xql-queries/manage-scheduled-queries.md): Learn how to manage your scheduled and recurring queries. - [Scheduled Queries reference information](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/cases-and-issues/investigation-and-response/build-xql-queries/manage-scheduled-queries/scheduled-queries-reference-information.md): Review reference information for scheduled queries. - [Manage your personal query library](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/cases-and-issues/investigation-and-response/build-xql-queries/manage-your-personal-query-library.md): Cortex Cloud provides as part of the Query Library a personal library for saving and managing your own queries. - [XQL macros](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/cases-and-issues/investigation-and-response/build-xql-queries/xql-macros.md): Learn how XQL macros simplify reusable query logic. - [Manage your macros](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/cases-and-issues/investigation-and-response/build-xql-queries/manage-your-macros.md): Create and manage XQL macros. - [Quick Launcher](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/cases-and-issues/investigation-and-response/quick-launcher.md): The Quick Launcher provides a quick, in-context shortcut that you can use to search for information, perform common investigation tasks, or initiate actions. - [Customize cases and issues](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/cases-and-issues/customize-cases-and-issues.md): Customize your cases and issues for specific requirements. - [Set up case scoring](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/cases-and-issues/customize-cases-and-issues/set-up-case-scoring.md): Configure how Cortex Cloud calculates case scores. - [Create a starring configuration](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/cases-and-issues/customize-cases-and-issues/create-a-starring-configuration.md): Create a starring configuration to prioritize important cases and issues. - [Create SLAs for case and issue resolution](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/cases-and-issues/customize-cases-and-issues/create-slas-for-issue-resolution.md): Create SLA rules to set and track issue-resolution timers and time goals. - [Create additional case timers and SLAs](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/cases-and-issues/customize-cases-and-issues/create-slas-for-issue-resolution/create-case-timers-and-slas.md): Create additional case timers and service level agreements. - [Update case timer and SLA fields](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/cases-and-issues/customize-cases-and-issues/create-slas-for-issue-resolution/create-case-timers-and-slas/update-case-timer-and-sla-fields.md): Update fields used by case timers and SLAs. - [Create issue exceptions](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/cases-and-issues/customize-cases-and-issues/create-issue-exceptions.md): Create time-bound exceptions that pause issue SLA timers during approved remediation delays. - [Configure the issue exception approval workflow](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/cases-and-issues/customize-cases-and-issues/create-issue-exceptions/configure-the-issue-exception-approval-workflow.md): Manage approvers and approval requirements for issue exception rules. - [Create issue exception rules](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/cases-and-issues/customize-cases-and-issues/create-issue-exceptions/create-issue-exception-rules.md): Create approval-based rules that temporarily pause SLA timers for selected issues. - [Create an exception rule from an issue](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/cases-and-issues/customize-cases-and-issues/create-issue-exceptions/create-an-exception-rule-from-an-issue.md): Create an issue exception rule from an issue. - [View issue Exception Rules](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/cases-and-issues/customize-cases-and-issues/create-issue-exceptions/view-issue-exception-rules.md): View and manage issue exception rules. - [Disable issue exception rules](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/cases-and-issues/customize-cases-and-issues/create-issue-exceptions/disable-issue-exception-rules.md): Disable issue exception rules that are no longer needed. - [View excepted issues](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/cases-and-issues/customize-cases-and-issues/create-issue-exceptions/view-excepted-issues.md): View issues covered by an active exception rule. - [Create a sync profile](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/cases-and-issues/customize-cases-and-issues/create-a-sync-profile.md): Create a sync profile for external issue management systems. - [Learn more about the Agentic Assistant chat](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/agentic-assistant/agentic-assistant-chat.md): Chat with the Cortex Agentic Assistant using natural language prompts. - [Get started with Agentic Assistant chat](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/agentic-assistant/get-started-with-agentic-assistant-chat.md): Enable Agentic Assistant and access the chat interface. - [Choose an Agentic Assistant agent](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/agentic-assistant/choose-an-agentic-assistant-agent.md): Choose a system or custom agent for your chat. - [Chat with an Agentic Assistant agent](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/agentic-assistant/chat-with-an-agentic-assistant-agent.md): Tips for chatting with the Cortex Agentic Assistant - [Chat with the Agentic Assistant from Slack](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/agentic-assistant/chat-with-the-agentic-assistant-from-slack.md): Enable chatting with an Agentic Assistant agent from Slack. - [Streamline troubleshooting and support with the Help Center agent](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/agentic-assistant/streamline-troubleshooting-and-support-with-the-help-center-agent.md) - [Help Center agent actions](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/agentic-assistant/streamline-troubleshooting-and-support-with-the-help-center-agent/help-center-agent-actions.md) - [Create and run XQL queries with Agentic Assistant chat](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/agentic-assistant/create-and-run-xql-queries-with-agentic-assistant-chat.md): Interact with Cortex Agentic Assistant agents to build and run XQL queries. - [Use natural language to query and visualize your data](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/agentic-assistant/use-natural-language-to-query-and-visualize-your-data.md): Prompt Cortex Agentic Assistant agents to create graphs and charts from its findings. - [Manage chat history](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/agentic-assistant/manage-chat-history.md): Manage and navigate your past chats with the Cortex Agentic Assistant. - [Monitor dashboards and reports](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/dashboards-and-reports/monitor-dashboards-and-reports.md): Monitor security data with Cortex Cloud dashboards and reports. - [Overview of dashboards and reports](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/dashboards-and-reports/monitor-dashboards-and-reports/overview-of-dashboards-and-reports.md): Learn dashboard, report, and widget concepts in Cortex Cloud. - [Dashboard interface basics](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/dashboards-and-reports/monitor-dashboards-and-reports/overview-of-dashboards-and-reports/dashboard-interface-basics.md): Navigate dashboard pages, widgets, filters, and available actions. - [Dashboard types](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/dashboards-and-reports/monitor-dashboards-and-reports/overview-of-dashboards-and-reports/dashboard-types.md): Understand system and custom dashboards and their different uses. - [Report basics](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/dashboards-and-reports/monitor-dashboards-and-reports/overview-of-dashboards-and-reports/report-basics.md): Learn how reports present dashboard data in a shareable format. - [Widget Library](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/dashboards-and-reports/monitor-dashboards-and-reports/overview-of-dashboards-and-reports/widget-library.md): Browse available widgets for dashboards and reports. - [Access and visibility for dashboards and reports](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/dashboards-and-reports/monitor-dashboards-and-reports/access-and-visibility-for-dashboards-and-reports.md): Control who can view, edit, and share dashboards and reports. - [Visibility settings](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/dashboards-and-reports/monitor-dashboards-and-reports/access-and-visibility-for-dashboards-and-reports/visibility-settings.md): Configure visibility settings for dashboards and report templates. - [Access to widgets](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/dashboards-and-reports/monitor-dashboards-and-reports/access-and-visibility-for-dashboards-and-reports/access-to-widgets.md): Manage access to dashboard widgets and their underlying data. - [Sharing icons](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/dashboards-and-reports/monitor-dashboards-and-reports/access-and-visibility-for-dashboards-and-reports/sharing-icons.md): Interpret sharing icons shown for dashboards and report templates. - [Access and sharing cheat sheet](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/dashboards-and-reports/monitor-dashboards-and-reports/access-and-visibility-for-dashboards-and-reports/access-and-sharing-cheat-sheet.md): Use a reference for dashboard and report access and sharing. - [Manage dashboards and reports](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/dashboards-and-reports/monitor-dashboards-and-reports/manage-dashboards-and-reports.md): Manage dashboards, reports, ownership, sharing, and deleted content. - [Dashboard Manager](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/dashboards-and-reports/monitor-dashboards-and-reports/manage-dashboards-and-reports/dashboard-manager.md): Use Dashboard Manager to find and manage dashboards. - [Reports](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/dashboards-and-reports/monitor-dashboards-and-reports/manage-dashboards-and-reports/reports.md): View, manage, and generate reports from report templates. - [Duplicate dashboards and reports](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/dashboards-and-reports/monitor-dashboards-and-reports/manage-dashboards-and-reports/duplicate-dashboards-and-reports.md): Duplicate dashboards and report templates for reuse or customization. - [Share custom dashboards and report templates](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/dashboards-and-reports/monitor-dashboards-and-reports/manage-dashboards-and-reports/share-custom-dashboards-and-report-templates.md): Share custom dashboards and report templates with users or groups. - [Change ownership to dashboards and report templates](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/dashboards-and-reports/monitor-dashboards-and-reports/manage-dashboards-and-reports/change-ownership-to-dashboards-and-report-templates.md): Transfer dashboard and report template ownership to another user. - [Import and export dashboards and report templates](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/dashboards-and-reports/monitor-dashboards-and-reports/manage-dashboards-and-reports/import-and-export-dashboards-and-report-templates.md): Import and export dashboards and report templates between environments. - [Configure the notification rule for a failed report](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/dashboards-and-reports/monitor-dashboards-and-reports/manage-dashboards-and-reports/configure-the-notification-rule-for-a-failed-report.md): Configure notifications when a scheduled report fails. - [Deleted content](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/dashboards-and-reports/monitor-dashboards-and-reports/manage-dashboards-and-reports/deleted-content.md): Restore or permanently remove deleted dashboards and report templates. - [Create dashboards](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/dashboards-and-reports/monitor-dashboards-and-reports/create-dashboards.md): Create custom dashboards to monitor the data that matters. - [Create a dashboard](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/dashboards-and-reports/monitor-dashboards-and-reports/create-dashboards/create-a-dashboard.md): Create and configure a custom Cortex Cloud dashboard. - [Create reports](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/dashboards-and-reports/monitor-dashboards-and-reports/create-reports.md): Create report templates to share dashboard data. - [Create a report template from scratch](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/dashboards-and-reports/monitor-dashboards-and-reports/create-reports/create-a-report-template-from-scratch.md): Create a custom report template from scratch. - [Advanced configuration](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/dashboards-and-reports/monitor-dashboards-and-reports/advanced-configuration.md): Configure widgets, filters, and drilldowns for custom dashboards. - [Create custom widgets](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/dashboards-and-reports/monitor-dashboards-and-reports/advanced-configuration/create-custom-widgets.md): Create custom widgets to display tailored dashboard data. - [Create widgets using AI](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/dashboards-and-reports/monitor-dashboards-and-reports/advanced-configuration/create-custom-widgets/create-widgets-using-ai.md): Use AI to create custom dashboard widgets. - [Create XQL widgets](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/dashboards-and-reports/monitor-dashboards-and-reports/advanced-configuration/create-custom-widgets/create-xql-widgets.md): Create widgets that display XQL query results. - [Add parameters to a custom XQL widget](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/dashboards-and-reports/monitor-dashboards-and-reports/advanced-configuration/create-custom-widgets/add-parameters-to-a-custom-xql-widget.md): Add parameters to customize XQL widget queries. - [Create script-based widgets](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/dashboards-and-reports/monitor-dashboards-and-reports/advanced-configuration/create-custom-widgets/create-script-based-widgets.md): Create widgets that display data from scripts. - [Configure global filters](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/dashboards-and-reports/monitor-dashboards-and-reports/advanced-configuration/configure-global-filters.md): Configure global filters that apply across a dashboard. - [Configure drilldowns](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/dashboards-and-reports/monitor-dashboards-and-reports/advanced-configuration/configure-drilldowns.md): Configure drilldowns to investigate data behind dashboard widgets. - [Dashboard reference](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/dashboards-and-reports/monitor-dashboards-and-reports/dashboard-reference.md): Reference system dashboards, Command Center dashboards, and their metrics. - [Command Center reference](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/dashboards-and-reports/monitor-dashboards-and-reports/dashboard-reference/command-center-reference.md): Reference dashboards available in Cortex Cloud Command Center. - [Cortex Agentic Assistant dashboard](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/dashboards-and-reports/monitor-dashboards-and-reports/dashboard-reference/command-center-reference/cortex-agentic-assistant-dashboard.md): Review metrics and activity for Cortex Agentic Assistant usage. - [Cortex Cloud Command Center](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/dashboards-and-reports/monitor-dashboards-and-reports/dashboard-reference/command-center-reference/cortex-cloud-command-center.md): Review the Cortex Cloud Command Center dashboard and its widgets. - [System dashboards](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/dashboards-and-reports/monitor-dashboards-and-reports/dashboard-reference/system-dashboards.md): Reference built-in dashboards for monitoring Cortex Cloud data. - [Cortex Cloud Consumption](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/dashboards-and-reports/monitor-dashboards-and-reports/dashboard-reference/system-dashboards/cortex-cloud-consumption.md): Monitor Cortex Cloud consumption and usage metrics. - [Cloud Security Operations](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/dashboards-and-reports/monitor-dashboards-and-reports/dashboard-reference/system-dashboards/cloud-security-operations.md): Monitor cloud security operations with the built-in dashboard. - [Monitor and track compliance adherence](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/compliance/monitor-and-track-compliance-adherence.md): Evaluate and track asset compliance against industry standards and organizational policies. - [Choose compliance standards from the compliance catalog](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/compliance/monitor-and-track-compliance-adherence/choose-compliance-standards-from-the-compliance-catalog.md): Select built-in or custom compliance standards and controls from the compliance catalogs. - [Standards catalog](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/compliance/monitor-and-track-compliance-adherence/choose-compliance-standards-from-the-compliance-catalog/standards-catalog.md): Browse available compliance standards. - [Use a built-in or custom standard](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/compliance/monitor-and-track-compliance-adherence/choose-compliance-standards-from-the-compliance-catalog/use-a-built-in-or-custom-standard.md): Use built-in standards or create and edit custom standards for your organization. - [Use a built-in or custom control](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/compliance/monitor-and-track-compliance-adherence/choose-compliance-standards-from-the-compliance-catalog/use-a-built-in-or-custom-control.md): Add built-in controls or create and manage custom controls for custom standards. - [Create a new custom detection rule](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/compliance/monitor-and-track-compliance-adherence/choose-compliance-standards-from-the-compliance-catalog/create-a-new-custom-detection-rule.md): Create custom detection rules to enforce compliance requirements and security best practices. - [Use an assessment profile to run compliance checks on your assets](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/compliance/monitor-and-track-compliance-adherence/use-an-assessment-profile-to-run-compliance-checks-on-your-assets.md): Create assessment profiles to evaluate selected asset groups against compliance standards. - [View and manage compliance assessments and reports](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/compliance/monitor-and-track-compliance-adherence/view-and-manage-compliance-assessments-and-reports.md): Review assessment results and generate or schedule downloadable compliance reports. - [Review compliance assessments](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/compliance/monitor-and-track-compliance-adherence/view-and-manage-compliance-assessments-and-reports/assessments.md): View assessment results and drill into control, rule, and asset compliance details. - [Review compliance reports](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/compliance/monitor-and-track-compliance-adherence/view-and-manage-compliance-assessments-and-reports/reports.md): View, export, and manage historical compliance assessment reports. - [Compliance Overview Dashboard](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/compliance/monitor-and-track-compliance-adherence/compliance-overview-dashboard.md): Monitor organization-wide compliance scores, standards, failed controls, and asset group performance. - [What is Cortex Cloud AI Security?](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/cortex-cloud-ai-security/what-is-cortex-cloud-ai-security.md): A basic overview of the Cortex Cloud AI Security overview page, assets inventory, risks, and benefits. - [Supported services in Cortex Cloud AI Security](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/cortex-cloud-ai-security/supported-services-in-cortex-cloud-ai-security.md): A list of platforms and services that are compatible with Cortex Cloud AI Security. - [Cortex Cloud AI Security concepts](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/cortex-cloud-ai-security/cortex-cloud-ai-security-concepts.md): Basic concepts of Cortex Cloud AI Security. - [Cortex Cloud AI Security use cases](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/cortex-cloud-ai-security/cortex-cloud-ai-security-use-cases.md): Learn about use cases that are relevant for Cortex Cloud AI Security. - [How to perform advanced AI Security investigations using XQL](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/cortex-cloud-ai-security/how-to-perform-advanced-ai-security-investigations-using-xql.md): Working with datasets in Cortex Cloud AI Security. - [About Cortex Cloud Application Security](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/cortex-cloud-application-security/about-cortex-cloud-application-security.md): Learn how Cortex Cloud Application Security protects applications throughout their lifecycle. - [Code-to Cloud](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/code-to-cloud/code-to-cloud.md): Trace software assets from source code to cloud runtime resources. - [How the C2C engine works](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/code-to-cloud/code-to-cloud/how-the-c2c-engine-works.md): Learn how C2C correlates assets across the software delivery lifecycle. - [Identify and investigate gap](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/code-to-cloud/code-to-cloud/identify-and-investigate-gap.md): Identify lineage gaps and investigate affected assets across your software lifecycle. - [Execute remediation workflows](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/code-to-cloud/code-to-cloud/execute-remediation-workflows.md): Close Code-to-Cloud lineage gaps through dashboard, asset, and YOR workflows. - [The Coverage dashboard](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/code-to-cloud/code-to-cloud/the-coverage-dashboard.md): Measure Code-to-Cloud lineage coverage and prioritize remediation actions. - [C2C in Unified Asset Inventory](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/code-to-cloud/code-to-cloud/c2c-in-unified-asset-inventory.md): View Code-to-Cloud lineage and coverage in the Unified Asset Inventory. - [Reference A: Lineage filtering matrix](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/code-to-cloud/code-to-cloud/c2c-in-unified-asset-inventory/reference-a-lineage-filtering-matrix.md) - [Reference B: Essential filtering rules](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/code-to-cloud/code-to-cloud/c2c-in-unified-asset-inventory/reference-b-essential-filtering-rules.md) - [Reference C: Technical background](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/code-to-cloud/code-to-cloud/c2c-in-unified-asset-inventory/reference-c-technical-background.md) - [C2C tab (asset level)](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/code-to-cloud/code-to-cloud/c2c-tab-asset-level.md): Review an asset's Code-to-Cloud trace, coverage gaps, and remediation actions. - [C2C tab (app level)](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/code-to-cloud/code-to-cloud/c2c-tab-app-level.md): Review Code-to-Cloud coverage and lineage across an application's assets. - [Agentix for C2C](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/code-to-cloud/code-to-cloud/agentix-for-c2c.md): Use Agentix to explore Code-to-Cloud coverage, gaps, and lineage. - [Investigate issues with C2C](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/code-to-cloud/code-to-cloud/investigate-issues-with-c2c.md): Investigate security issues using Code-to-Cloud lineage and runtime context. - [C2C in ASPM Command Center](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/code-to-cloud/code-to-cloud/c2c-in-aspm-command-center.md): Monitor Code-to-Cloud lineage and coverage from ASPM Command Center. - [Enforce policies with C2C](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/code-to-cloud/code-to-cloud/enforce-policies-with-c2c.md): Enforce security policies using Code-to-Cloud lineage and runtime conditions. - [Troubleshooting](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/code-to-cloud/code-to-cloud/troubleshooting.md): Resolve common Code-to-Cloud configuration, coverage, and data issues. - [FAQs](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/code-to-cloud/code-to-cloud/faqs.md): Find answers to common Code-to-Cloud questions. - [References](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/code-to-cloud/code-to-cloud/references.md): Reference Code-to-Cloud integrations, calculations, filters, actions, and APIs. - [Reference A: Supported integrations and asset stages](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/code-to-cloud/code-to-cloud/references/reference-a-supported-integrations-and-asset-stages.md): Review supported integrations and the asset stages they cover. - [Reference B: Coverage % calculation and configuration toggles](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/code-to-cloud/code-to-cloud/references/reference-b-coverage-calculation-and-configuration-toggles.md): Understand coverage calculations and the configuration toggles that affect them. - [Reference C: Dashboard filters by view](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/code-to-cloud/code-to-cloud/references/reference-c-dashboard-filters-by-view.md): Review available filters for each Code-to-Cloud dashboard view. - [Reference D: Recommended actions by view and stage](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/code-to-cloud/code-to-cloud/references/reference-d-recommended-actions-by-view-and-stage.md): Review recommended actions by Code-to-Cloud view and lifecycle stage. - [Reference E: Code-to-Cloud Coverage public API](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/code-to-cloud/code-to-cloud/references/reference-e-code-to-cloud-coverage-public-api.md): Retrieve Code-to-Cloud coverage data programmatically with the public API. - [Page Reference F: Call-to-action routing by asset type1](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/code-to-cloud/code-to-cloud/references/page-reference-f-call-to-action-routing-by-asset-type1.md): Review call-to-action routing for Code-to-Cloud assets by asset type. - [Reference G: Unified Asset Inventory fields and deep links](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/code-to-cloud/code-to-cloud/references/reference-g-unified-asset-inventory-fields-and-deep-links.md): Reference Unified Asset Inventory fields and deep links for Code-to-Cloud. - [About Cortex Cloud Data Classification](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/cortex-cloud-data-classification/cortex-cloud-data-classification.md): Learn how Cortex Cloud Data Classification discovers and classifies sensitive data. - [How to create and validate a custom data pattern](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/cortex-cloud-data-classification/how-to-create-and-validate-a-custom-data-pattern.md): Learn how to use Cortex Cloud Data Classification to define specific criteria for identifying sensitive data for your unique needs. - [Custom data patterns: Guardrails and syntax guide](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/cortex-cloud-data-classification/how-to-create-and-validate-a-custom-data-pattern/custom-data-patterns-guardrails-and-syntax-guide.md): Details and examples about the capabilities and limitations with regular expressions in Cortex Cloud Data Classification. - [How to disable and enable data patterns in Data Classification](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/cortex-cloud-data-classification/how-to-disable-and-enable-data-patterns-in-data-classification.md): Enable or disable data patterns used to identify sensitive data. - [How to create and validate a custom data profile](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/cortex-cloud-data-classification/how-to-create-and-validate-a-custom-data-profile.md): Create and validate custom data profiles for sensitive-data discovery. - [How to disable and enable data profiles in Cortex Cloud Data Classification](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/cortex-cloud-data-classification/how-to-disable-and-enable-data-profiles-in-cortex-cloud-data-classification.md): Enable or disable data profiles used for sensitive-data classification. - [How to report a false positive in Cortex Cloud Data Classification](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/cortex-cloud-data-classification/how-to-report-a-false-positive-in-cortex-cloud-data-classification.md): Report incorrectly classified data to improve classification accuracy. - [Topic classification](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/cortex-cloud-data-classification/topic-classification.md): Classify files by topic to assess content sensitivity and apply appropriate controls. - [What is Cortex Data Security?](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/cortex-data-security/what-is-cortex-cloud-data-security.md): Learn about Cortex Cloud Data Security capabilities and benefits. - [What is Cortex Cloud Identity Security?](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/cortex-cloud-identity-security/what-is-cortex-cloud-identity-security.md): Cortex Cloud Identity Security can help you address the security challenges of managing identity in cloud environments. - [Review and improve your Identity Security posture](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/cortex-cloud-identity-security/review-and-improve-your-identity-security-posture.md): Learn how to review and improve your Identity Security posture with the provided use case examples. - [How does Effective Permission Calculation work?](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/cortex-cloud-identity-security/how-does-effective-permission-calculation-work.md): An explanation of how Effective Permission Calculation works in Cortex Cloud Identity Security. - [Cortex Cloud Identity Security functionality](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/cortex-cloud-identity-security/cortex-cloud-identity-security-functionality.md): About the functionalities of Cortex Cloud Identity Security. - [Configure Cortex Cloud Identity Security](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/cortex-cloud-identity-security/configure-cortex-cloud-identity-security.md): Configure trusted domains for Cortex Cloud Identity Security. - [Unified Human Identities](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/cortex-cloud-identity-security/unified-human-identities.md): Correlate accounts into unified identities for complete access visibility. - [Achieve the principle of least privilege access](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/cortex-cloud-identity-security/achieve-the-principle-of-least-privilege-access.md): Use Cortex Cloud Identity Security to achieve the principle of least privilege access. - [Explore permissions using the simple and advanced access tables](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/cortex-cloud-identity-security/explore-permissions-using-the-simple-and-advanced-access-tables.md): Learn how to explore permissions in Cortex Cloud Identity Security using the Simple and Advanced access tables. - [Create a custom detection rule in Cortex Cloud Identity Security](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/cortex-cloud-identity-security/create-a-custom-detection-rule-in-cortex-cloud-identity-security.md): Learn how to create a custom detection rule in Cortex Cloud Identity Security. - [Perform advanced Identity Security investigations using XQL](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/cortex-cloud-identity-security/perform-advanced-identity-security-investigations-using-xql.md): Working with datasets in Cortex Cloud Identity Security. - [Ingest logs and data from Okta](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/cortex-cloud-identity-security/ingest-logs-and-data-from-okta.md): Learn more about Ingesting logs and data from Okta for use in Cortex Cloud. - [Enable inactive human identity logs on Azure in Cortex Cloud Identity Security](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/cortex-cloud-identity-security/enable-inactive-human-identity-logs-on-azure-in-cortex-cloud-identity-security.md): Configuration information for enabling inactive human identity logs on Azure. - [Manage RBAC and SBAC in Cortex Cloud Identity Security](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/cortex-cloud-identity-security/manage-rbac-and-sbac-in-cortex-cloud-identity-security.md): Working with RBAC and SBAC in Cortex Cloud Identity Security. - [Learn about Cloud ASM](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/cloud-attack-surface-management/cloud-asm-concepts.md): Learn about Cloud ASM, including scanning and network mapping. - [What is Cloud ASM?](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/cloud-attack-surface-management/cloud-asm-concepts/what-is-cloud-asm.md): Cloud ASM provides visibility into all the assets in your cloud infrastructure that are exposed to the internet. - [Scanning](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/cloud-attack-surface-management/cloud-asm-concepts/scanning.md): Cortex Cloud provides targeted scanning of customer networks from an attributed scanning infrastructure. - [Network mapping](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/cloud-attack-surface-management/cloud-asm-concepts/network-mapping.md): Through a network mapping process, Cortex Cloud discovers and attributes assets to organizations. - [Enable Cloud ASM](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/cloud-attack-surface-management/enable-cloud-asm.md): Enable Cloud ASM data discovery to discover all your unmanaged cloud services and cloud services exposed to the internet. - [Attack surface management detections](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/cloud-attack-surface-management/attack-surface-management-detections.md): Learn about Attack Surface Management detections, including rules and externally inferred CVEs. - [Attack surface rules](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/cloud-attack-surface-management/attack-surface-management-detections/attack-surface-rules.md): Attack surface rules are used to identify risks in your attack surface. - [Externally inferred CVEs](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/cloud-attack-surface-management/attack-surface-management-detections/externally-inferred-cves.md): Understand CVEs inferred from externally discovered service versions. - [Attack surface assets](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/cloud-attack-surface-management/attack-surface-assets.md): The assets discovered in an attack surface management scan are called attack surface assets or external surface assets. - [Review your unmanaged cloud services](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/cloud-attack-surface-management/review-your-unmanaged-cloud-services.md): Review your unmanaged cloud services in your Attack Surface inventory. - [Review unmanaged cloud issues](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/cloud-attack-surface-management/review-unmanaged-cloud-issues.md): View your unmanaged cloud issues, including service details. - [About Network Exposure Detection](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/network-exposure-detection/network-exposure-detection.md): Learn how Cortex Cloud Posture Management identifies and remediates network exposure risks. - [What is Cloud Network Analyzer?](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/network-exposure-detection/what-is-cloud-network-analyzer.md): Learn how Cortex Cloud Posture Management identifies exposure across cloud accounts. - [Internet exposure detection](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/network-exposure-detection/internet-exposure-detection.md): Learn how Cortex Cloud Posture Management detects publicly reachable cloud assets. - [Outbound exposure detection](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/network-exposure-detection/outbound-exposure-detection.md): Learn how Cortex Cloud Posture Management detects unrestricted outbound internet access. - [East-west exposure detection](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/network-exposure-detection/east-west-exposure-detection.md): Learn how Cortex Cloud Posture Management identifies unrestricted lateral access. - [Investigate an internet exposure](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/network-exposure-detection/investigate-an-internet-exposure.md): Use Cortex Cloud Posture Management to investigate internet exposure through Issues and Graph Search. - [Configure trusted IPs](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/network-exposure-detection/configure-trusted-ips.md): Configure trusted IPs excluded from Cortex Cloud Posture Management exposure evaluations. - [SaaS Security](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/saas-security/saas-security.md): Discover continuous SaaS visibility and control in Cortex Cloud Posture Management across identities, connected applications, and AI agents. - [Setup SaaS Security](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/saas-security/saas-security/setup-saas-security.md): Get started with SaaS Security in Cortex Cloud Posture Management. - [Onboard a Supported SaaS Application](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/saas-security/saas-security/onboard-a-supported-saas-application.md): Connect supported SaaS applications in Cortex Cloud Posture Management to track misconfigurations and compliance violations. - [Onboard Aha.io](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/saas-security/saas-security/onboard-a-supported-saas-application/onboard-aha.io.md): Connect an Aha.io instance in Cortex Cloud Posture Management to detect posture risks and compliance violations. - [Onboard Asana](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/saas-security/saas-security/onboard-a-supported-saas-application/onboard-asana.md): Connect an Asana instance in Cortex Cloud Posture Management to detect posture risks and compliance violations. - [Onboard Atlassian](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/saas-security/saas-security/onboard-a-supported-saas-application/onboard-atlassian.md): Connect an Atlassian instance in Cortex Cloud Posture Management to detect posture risks and compliance violations. - [Onboard Automox](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/saas-security/saas-security/onboard-a-supported-saas-application/onboard-automox.md): Connect an Automox instance in Cortex Cloud Posture Management to detect posture risks and compliance violations. - [Onboard Businessmap](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/saas-security/saas-security/onboard-a-supported-saas-application/onboard-businessmap.md): Connect a Businessmap instance in Cortex Cloud Posture Management to detect posture risks and compliance violations. - [Onboard Celonis](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/saas-security/saas-security/onboard-a-supported-saas-application/onboard-celonis.md): Connect a Celonis instance in Cortex Cloud Posture Management to detect posture risks and compliance violations. - [Onboard Cisco Duo](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/saas-security/saas-security/onboard-a-supported-saas-application/onboard-cisco-duo.md): Connect a Cisco Duo instance in Cortex Cloud Posture Management to detect posture risks and compliance violations. - [Onboard Cisco Meraki](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/saas-security/saas-security/onboard-a-supported-saas-application/onboard-cisco-meraki.md): Connect a Cisco Meraki instance in Cortex Cloud Posture Management to detect posture risks and compliance violations. - [Onboard ClickUp](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/saas-security/saas-security/onboard-a-supported-saas-application/onboard-clickup.md): Connect a ClickUp instance in Cortex Cloud Posture Management to detect posture risks and compliance violations. - [Onboard Contentful](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/saas-security/saas-security/onboard-a-supported-saas-application/onboard-contentful.md): Connect a Contentful instance in Cortex Cloud Posture Management to detect posture risks and compliance violations. - [Onboard Couchbase](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/saas-security/saas-security/onboard-a-supported-saas-application/onboard-couchbase.md): Connect a Couchbase instance in Cortex Cloud Posture Management to detect posture risks and compliance violations. - [Onboard Coveo](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/saas-security/saas-security/onboard-a-supported-saas-application/onboard-coveo.md): Connect a Coveo instance in Cortex Cloud Posture Management to detect posture risks and compliance violations. - [Onboard Databricks](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/saas-security/saas-security/onboard-a-supported-saas-application/onboard-databricks.md): Connect a Databricks instance in Cortex Cloud Posture Management to detect posture risks and compliance violations. - [Onboard Datadog](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/saas-security/saas-security/onboard-a-supported-saas-application/onboard-datadog.md): Connect a Datadog instance in Cortex Cloud Posture Management to detect posture risks and compliance violations. - [Onboard Gainsight PX](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/saas-security/saas-security/onboard-a-supported-saas-application/onboard-gainsight-px.md): Connect a Gainsight PX instance in Cortex Cloud Posture Management to detect posture risks and compliance violations. - [Onboard Grammarly](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/saas-security/saas-security/onboard-a-supported-saas-application/onboard-grammarly.md): Connect a Grammarly instance in Cortex Cloud Posture Management to detect posture risks and compliance violations. - [Onboard Harness](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/saas-security/saas-security/onboard-a-supported-saas-application/onboard-harness.md): Connect a Harness instance in Cortex Cloud Posture Management to detect posture risks and compliance violations. - [Onboard Intercom](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/saas-security/saas-security/onboard-a-supported-saas-application/onboard-intercom.md): Connect an Intercom instance in Cortex Cloud Posture Management to detect posture risks and compliance violations. - [Onboard Jamf Pro](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/saas-security/saas-security/onboard-a-supported-saas-application/onboard-jamf-pro.md): Connect a Jamf Pro instance in Cortex Cloud Posture Management to detect posture risks and compliance violations. - [Onboard JumpCloud](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/saas-security/saas-security/onboard-a-supported-saas-application/onboard-jumpcloud.md): Connect a JumpCloud instance in Cortex Cloud Posture Management to detect posture risks and compliance violations. - [Onboard Kustomer](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/saas-security/saas-security/onboard-a-supported-saas-application/onboard-kustomer.md): Connect a Kustomer instance in Cortex Cloud Posture Management to detect posture risks and compliance violations. - [Onboard Microsoft Entra ID](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/saas-security/saas-security/onboard-a-supported-saas-application/onboard-microsoft-entra-id.md): Connect a Microsoft Entra ID instance in Cortex Cloud Posture Management to detect posture risks and compliance violations. - [Onboard Monday.com](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/saas-security/saas-security/onboard-a-supported-saas-application/onboard-monday.com.md): Connect a Monday.com instance in Cortex Cloud Posture Management to detect posture risks and compliance violations. - [Onboard MongoDB Atlas](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/saas-security/saas-security/onboard-a-supported-saas-application/onboard-mongodb-atlas.md): Connect a MongoDB Atlas instance in Cortex Cloud Posture Management to detect posture risks and compliance violations. - [Onboard MuleSoft](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/saas-security/saas-security/onboard-a-supported-saas-application/onboard-mulesoft.md): Connect a MuleSoft instance in Cortex Cloud Posture Management to detect posture risks and compliance violations. - [Onboard Mural](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/saas-security/saas-security/onboard-a-supported-saas-application/onboard-mural.md): Connect a Mural instance in Cortex Cloud Posture Management to detect posture risks and compliance violations. - [Onboard Office 365](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/saas-security/saas-security/onboard-a-supported-saas-application/onboard-office-365.md): Connect an Office 365 instance in Cortex Cloud Posture Management to detect posture risks and compliance violations. - [Onboard Okta](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/saas-security/saas-security/onboard-a-supported-saas-application/onboard-okta.md): Connect an Okta instance in Cortex Cloud Posture Management to detect posture risks and compliance violations. - [Onboard PagerDuty](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/saas-security/saas-security/onboard-a-supported-saas-application/onboard-pagerduty.md): Connect a PagerDuty instance in Cortex Cloud Posture Management to detect posture risks and compliance violations. - [Onboard Redis Labs](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/saas-security/saas-security/onboard-a-supported-saas-application/onboard-redis-labs.md): Connect a Redis Labs instance in Cortex Cloud Posture Management to detect posture risks and compliance violations. - [Onboard Salesforce](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/saas-security/saas-security/onboard-a-supported-saas-application/onboard-salesforce.md): Connect a Salesforce instance in Cortex Cloud Posture Management to detect posture risks and compliance violations. - [Onboard SAP Ariba](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/saas-security/saas-security/onboard-a-supported-saas-application/onboard-sap-ariba.md): Connect a SAP Ariba instance in Cortex Cloud Posture Management to detect posture risks and compliance violations. - [Onboard Sentry](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/saas-security/saas-security/onboard-a-supported-saas-application/onboard-sentry.md): Connect a Sentry instance in Cortex Cloud Posture Management to detect posture risks and compliance violations. - [Onboard ServiceNow](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/saas-security/saas-security/onboard-a-supported-saas-application/onboard-servicenow.md): Connect a ServiceNow instance in Cortex Cloud Posture Management to detect posture risks and compliance violations. - [Onboard Shopify](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/saas-security/saas-security/onboard-a-supported-saas-application/onboard-shopify.md): Connect a Shopify instance in Cortex Cloud Posture Management to detect posture risks and compliance violations. - [Onboard Slack Enterprise](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/saas-security/saas-security/onboard-a-supported-saas-application/onboard-slack-enterprise.md): Connect a Slack Enterprise instance in Cortex Cloud Posture Management to detect posture risks and compliance violations. - [Onboard Sumo Logic](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/saas-security/saas-security/onboard-a-supported-saas-application/onboard-sumo-logic.md): Connect a Sumo Logic instance in Cortex Cloud Posture Management to detect posture risks and compliance violations. - [Onboard Workday](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/saas-security/saas-security/onboard-a-supported-saas-application/onboard-workday.md): Connect a Workday instance in Cortex Cloud Posture Management to detect posture risks and compliance violations. - [Onboard Wrike](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/saas-security/saas-security/onboard-a-supported-saas-application/onboard-wrike.md): Connect a Wrike instance in Cortex Cloud Posture Management to detect posture risks and compliance violations. - [Onboard YouTrack](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/saas-security/saas-security/onboard-a-supported-saas-application/onboard-youtrack.md): Connect a YouTrack instance in Cortex Cloud Posture Management to detect posture risks and compliance violations. - [SaaS Security Overview](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/saas-security/saas-security/saas-security-overview.md): Use the SaaS Security Overview in Cortex Cloud Posture Management to monitor posture, identity, data, and AI agent security. - [SaaS Security Checks](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/saas-security/saas-security/saas-security-checks.md): Use SaaS Security Checks in Cortex Cloud Posture Management to identify at-risk assets and prioritize remediation. - [Provider Instances Security Check](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/saas-security/saas-security/provider-instances-security-check.md): Use Provider Instances Security Check in Cortex Cloud Posture Management to assess security posture across application instances. - [Detection Rules](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/saas-security/saas-security/detection-rules.md): View SaaS Security detection rules in Cortex Cloud Posture Management to detect application risks. - [Remediation Actions](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/saas-security/saas-security/remediation-actions.md): Use remediation actions in Cortex Cloud Posture Management to resolve SaaS Security issues. - [Create and monitor tickets](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/saas-security/saas-security/create-and-monitor-tickets.md): Create and monitor tickets in Cortex Cloud Posture Management to remediate SaaS Security issues. - [SaaS AI Agent Security](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/saas-security/saas-security/saas-ai-agent-security.md): Use SaaS AI Agent Security in Cortex Cloud Posture Management to secure enterprise SaaS AI agents. - [Setup SaaS Security for AISPM](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/saas-security/saas-security/saas-ai-agent-security/setup-saas-security-for-aispm.md): Get started with SaaS AI Agent Security in Cortex Cloud Posture Management. - [Onboard SaaS AI Agents](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/saas-security/saas-security/saas-ai-agent-security/onboard-saas-ai-agents.md): Learn how to onboard supported SaaS AI agents in Cortex Cloud Posture Management. - [Onboard Atlassian Rovo](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/saas-security/saas-security/saas-ai-agent-security/onboard-saas-ai-agents/onboard-atlassian-rovo.md): Connect Atlassian Rovo in Cortex Cloud Posture Management SaaS AI Agent Security for visibility and control across your AI ecosystem. - [Onboard Box AI Agents](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/saas-security/saas-security/saas-ai-agent-security/onboard-saas-ai-agents/onboard-box-ai-agents.md): Connect Box AI Agents in Cortex Cloud Posture Management SaaS AI Agent Security for visibility and control across your AI ecosystem. - [Onboard ChatGPT Enterprise](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/saas-security/saas-security/saas-ai-agent-security/onboard-saas-ai-agents/onboard-chatgpt-enterprise.md): Connect ChatGPT Enterprise in Cortex Cloud Posture Management SaaS AI Agent Security for visibility and control across your AI ecosystem. - [Onboard Cursor Enterprise](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/saas-security/saas-security/saas-ai-agent-security/onboard-saas-ai-agents/onboard-cursor-enterprise.md): Connect Cursor Enterprise in Cortex Cloud Posture Management SaaS AI Agent Security for visibility and control across your AI ecosystem. - [Onboard Gemini Enterprise](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/saas-security/saas-security/saas-ai-agent-security/onboard-saas-ai-agents/onboard-gemini-enterprise.md): Connect Gemini Enterprise in Cortex Cloud Posture Management SaaS AI Agent Security for visibility and control across your AI ecosystem. - [Onboard M365 Copilot](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/saas-security/saas-security/saas-ai-agent-security/onboard-saas-ai-agents/onboard-m365-copilot.md): Connect M365 Copilot in Cortex Cloud Posture Management SaaS AI Agent Security for visibility and control across your AI ecosystem. - [Onboard Microsoft Copilot Studio](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/saas-security/saas-security/saas-ai-agent-security/onboard-saas-ai-agents/onboard-microsoft-copilot-studio.md): Connect Microsoft Copilot Studio in Cortex Cloud Posture Management SaaS AI Agent Security for visibility and control across your AI ecosystem. - [Onboard Service Now](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/saas-security/saas-security/saas-ai-agent-security/onboard-saas-ai-agents/onboard-service-now.md): Connect ServiceNow in Cortex Cloud Posture Management SaaS AI Agent Security for visibility and control across your AI ecosystem. - [Manage SaaS AI Agents](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/saas-security/saas-security/saas-ai-agent-security/manage-saas-ai-agents.md): Manage SaaS AI agents in Cortex Cloud Posture Management, including agents, datasets, and connected tools. - [View AI Agents](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/saas-security/saas-security/saas-ai-agent-security/manage-saas-ai-agents/view-ai-agents.md): View SaaS AI agents in Cortex Cloud Posture Management to assess their security context. - [View Datasets](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/saas-security/saas-security/saas-ai-agent-security/manage-saas-ai-agents/view-datasets.md): View inference datasets in Cortex Cloud Posture Management SaaS AI Agent Security. - [View Agent Tools](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/saas-security/saas-security/saas-ai-agent-security/manage-saas-ai-agents/view-agent-tools.md): View tools connected to SaaS AI agents in Cortex Cloud Posture Management. - [Vulnerability management in Cortex Cloud](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/vunerability-management/vulnerability-management-in-cortex-cloud.md): Use Cortex Cloud Posture Management to identify, assess, prioritize, and remediate security vulnerabilities across endpoints, code, and cloud. - [Cortex Cloud vulnerability concepts](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/vunerability-management/vulnerability-management-in-cortex-cloud/cortex-cloud-vulnerability-concepts.md): Familiarize yourself with Cortex Cloud Posture Management vulnerability concepts. - [Vulnerability Management dashboard](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/vunerability-management/vulnerability-management-in-cortex-cloud/vulnerability-management-dashboard.md): Visualize your most pressing risks, changes over time, and remediation progress with Cortex Cloud Posture Management. - [Cortex Vulnerability Risk Score](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/vunerability-management/cortex-vulnerability-risk-score.md): Learn how Cortex Cloud calculates and displays CVRS to prioritize vulnerability remediation. - [Vulnerability policies](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/vunerability-management/vulnerability-policies.md): A vulnerability policy defines the action you want to take for a specific set of vulnerability findings. - [Create a vulnerability policy](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/vunerability-management/vulnerability-policies/create-a-vulnerability-policy.md): Create vulnerability policies that create issues or prevent findings based on defined conditions and scope. - [Update the Ignored CVEs, Asset Groups, and Assets policy](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/vunerability-management/vulnerability-policies/update-the-ignored-cves-asset-groups-and-assets-policy.md): Update the ignored CVEs, asset groups, and assets policy to prevent matching vulnerability findings from creating issues. - [Modify a vulnerability policy](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/vunerability-management/vulnerability-policies/modify-a-vulnerability-policy.md): Update vulnerability issue-creation and prevention policies through the policy wizard. - [Configure a block grace period](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/vunerability-management/vulnerability-policies/configure-a-block-grace-period.md): Configure remediation grace periods that delay Kubernetes deployment blocks or build failures after vulnerability disclosure. - [Enable or disable a vulnerability policy](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/vunerability-management/vulnerability-policies/enable-or-disable-a-vulnerability-policy.md): Enable or disable vulnerability issue-creation and prevention policies to control actions for matching findings. - [Investigate and remediate vulnerabilities](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/vunerability-management/investigate-and-remediate-vulnerabilities.md): Investigate, prioritize, and remediate vulnerabilities through issues, findings, and vulnerable assets. - [Vulnerability Intelligence](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/vunerability-management/vulnerability-intelligence.md): Vulnerability Intelligence is an in-product, real-time feed that provides vulnerability data and threat intelligence from a variety of certified upstream sources. - [Emerging Vulnerabilities](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/vunerability-management/emerging-vulnerabilities.md): The Emerging Vulnerabilities page is a a centralized hub for security teams to research, assess, and respond to global, emergent threats and zero-day exploits. - [Recast CVSS scores and CVSS severities](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/vunerability-management/recast-cvss-scores-and-cvss-severities.md): Customize CVSS scores and CVSS severities in the platform to align your risk management approach with your organizational context and priorities. - [Registry scanning](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/registry-scanning/registry-scanning.md): Learn about Registry scanning capability in Cortex Cloud - [Supported container registry integrations](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/registry-scanning/registry-scanning/supported-container-registry-integrations.md): Learn about supported container registry integrations in Cortex Cloud - [How Container Registry Scanning Works](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/registry-scanning/registry-scanning/how-container-registry-scanning-works.md): Learn how Cortex Cloud discovers, scans, and evaluates container images in onboarded registries to identify and continuously monitor security risks. - [Scan re-evaluation process](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/registry-scanning/registry-scanning/scan-re-evaluation-process.md): Understand how Cortex Cloud re-evaluates container registry scan results. - [Configure registry scanning for cloud accounts](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/registry-scanning/configure-registry-scanning-for-cloud-accounts.md): Configure Cortex Cloud to scan container registries in connected cloud accounts. - [Modify the container registry scanning scope](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/registry-scanning/configure-registry-scanning-for-cloud-accounts/modify-the-container-registry-scanning-scope.md) - [Configure registry scanning for third party integrations](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/registry-scanning/configure-registry-scanning-for-third-party-integrations.md): Learn how to configure Cortex Cloud to scan container registries in third-party integrations - [Manage registry scanning with APIs](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/registry-scanning/manage-registry-scanning-with-apis.md): Learn how to onboard and manage registry scanning programatically with APIs for Cortex Cloud. - [About Rules and Policies](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/rules-and-policies/about-rules-and-policies.md): Discover how Cortex Cloud detects security risks across your infrastructure, workloads, and container images, and how policies automate the response. - [Cloud security rules and policies](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/rules-and-policies/cloud-security-rules-and-policies.md): Learn how to use Cortex Cloud Posture Management rules and policies to detect cloud risks and enforce controls. - [Cloud security rules](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/rules-and-policies/cloud-security-rules-and-policies/cloud-security-rules.md): Learn how Cortex Cloud Posture Management cloud security rules detect risks across your environment. - [Cloud security policies](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/rules-and-policies/cloud-security-rules-and-policies/cloud-security-policies.md): Learn how Cortex Cloud Posture Management cloud security policies apply rules to selected assets. - [Create and manage cloud security rules](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/rules-and-policies/cloud-security-rules-and-policies/create-and-manage-cloud-security-rules.md): Create and manage Cortex Cloud Posture Management cloud security rules to detect and prioritize risks. - [Create a graph rule](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/rules-and-policies/cloud-security-rules-and-policies/create-and-manage-cloud-security-rules/create-a-graph-rule.md): Create graph rules in Cortex Cloud Posture Management to identify risky relationships and attack paths. - [Create a configuration rule](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/rules-and-policies/cloud-security-rules-and-policies/create-and-manage-cloud-security-rules/create-a-configuration-rule.md): Create configuration rules in Cortex Cloud Posture Management to detect resource misconfigurations and policy violations. - [Create a data rule](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/rules-and-policies/cloud-security-rules-and-policies/create-and-manage-cloud-security-rules/create-a-data-rule.md): Create data rules in Cortex Cloud Posture Management to detect data risks, malware, and classification issues. - [Create an identity rule](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/rules-and-policies/cloud-security-rules-and-policies/create-and-manage-cloud-security-rules/create-an-identity-rule.md): Create identity rules in Cortex Cloud Posture Management to detect excessive or unused permissions. - [Create a network exposure rule](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/rules-and-policies/cloud-security-rules-and-policies/create-and-manage-cloud-security-rules/create-a-network-exposure-rule.md): Create network exposure rules in Cortex Cloud Posture Management to detect risky network access. - [Create an AI rule](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/rules-and-policies/cloud-security-rules-and-policies/create-and-manage-cloud-security-rules/create-an-ai-rule.md): Create AI rules in Cortex Cloud Posture Management to detect risks across your AI ecosystem. - [Create an attack path (legacy) rule](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/rules-and-policies/cloud-security-rules-and-policies/create-and-manage-cloud-security-rules/create-an-attack-path-rule.md): Create legacy attack path rules in Cortex Cloud Posture Management to identify breach paths to high-value assets. - [View cloud security rule status](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/rules-and-policies/cloud-security-rules-and-policies/create-and-manage-cloud-security-rules/view-cloud-security-rule-status.md): View and filter cloud security rule status in Cortex Cloud Posture Management. - [Edit a cloud security rule](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/rules-and-policies/cloud-security-rules-and-policies/create-and-manage-cloud-security-rules/edit-a-cloud-security-rule.md): Edit cloud security rules in Cortex Cloud Posture Management and review their effect on related issues. - [Enable or disable a rule](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/rules-and-policies/cloud-security-rules-and-policies/create-and-manage-cloud-security-rules/enable-or-disable-a-rule.md): Enable or disable Cortex Cloud Posture Management cloud security rules to control asset evaluations. - [Use an existing rule to create a new one](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/rules-and-policies/cloud-security-rules-and-policies/create-and-manage-cloud-security-rules/use-an-existing-rule-to-create-a-new-one.md): Duplicate Cortex Cloud Posture Management cloud security rules to create tailored detections. - [Delete a custom cloud security rule](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/rules-and-policies/cloud-security-rules-and-policies/create-and-manage-cloud-security-rules/delete-a-custom-cloud-security-rule.md): Delete unneeded custom cloud security rules in Cortex Cloud Posture Management. - [Create and manage cloud security policies](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/rules-and-policies/cloud-security-rules-and-policies/create-and-manage-cloud-security-policies.md): Create and manage Cortex Cloud Posture Management cloud security policies to apply rules to cloud assets. - [Create a cloud security policy](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/rules-and-policies/cloud-security-rules-and-policies/create-and-manage-cloud-security-policies/create-a-cloud-security-policy.md): Create Cortex Cloud Posture Management cloud security policies to apply rules to selected cloud assets. - [Edit a cloud security policy](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/rules-and-policies/cloud-security-rules-and-policies/create-and-manage-cloud-security-policies/edit-a-cloud-security-policy.md): Edit Cortex Cloud Posture Management cloud security policies to update their details, rules, and scopes. - [Enable or disable a policy](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/rules-and-policies/cloud-security-rules-and-policies/create-and-manage-cloud-security-policies/enable-or-disable-a-policy.md): Enable or disable Cortex Cloud Posture Management cloud security policies to control enforcement. - [Use an existing policy to create a new one](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/rules-and-policies/cloud-security-rules-and-policies/create-and-manage-cloud-security-policies/use-an-existing-policy-to-create-a-new-one.md): Clone Cortex Cloud Posture Management cloud security policies to create tailored policies. - [Delete a custom cloud security policy](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/rules-and-policies/cloud-security-rules-and-policies/create-and-manage-cloud-security-policies/delete-a-custom-cloud-security-policy.md): Delete unneeded custom cloud security policies in Cortex Cloud Posture Management. - [Cloud workload policies and rules](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/rules-and-policies/cloud-workload-policies-and-rules.md): Use Cortex Cloud Posture Management policies and rules to detect violations and enforce security controls. - [How policies and rules work together](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/rules-and-policies/cloud-workload-policies-and-rules/how-policies-and-rules-work-together.md): Learn how Cortex Cloud Posture Management policies enforce actions for violations detected by rules. - [Cloud workload policies](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/rules-and-policies/cloud-workload-policies-and-rules/cloud-workload-policies.md): Use Cortex Cloud Posture Management cloud workload policies to detect, prevent, and manage security violations. - [Types of cloud workload policies](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/rules-and-policies/cloud-workload-policies-and-rules/cloud-workload-policies/types-of-cloud-workload-policies.md): Explore Cortex Cloud Posture Management policy types for misconfigurations, malware, secrets, and trusted images. - [Trusted image cloud workload policies](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/rules-and-policies/cloud-workload-policies-and-rules/cloud-workload-policies/types-of-cloud-workload-policies/types-of-cloud-workload-policies.md): Use Cortex Cloud Posture Management trusted image policies to enforce image trust and manage violations. - [Cloud Workload Policies page](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/rules-and-policies/cloud-workload-policies-and-rules/cloud-workload-policies/cloud-workload-policies-page.md): Use Cortex Cloud Posture Management to view, filter, and manage cloud workload policies. - [Enable or disable a cloud workload policy](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/rules-and-policies/cloud-workload-policies-and-rules/cloud-workload-policies/enable-or-disable-a-cloud-workload-policy.md): Enable or disable Cortex Cloud Posture Management cloud workload policies to control their enforcement. - [Create a cloud workload policy](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/rules-and-policies/cloud-workload-policies-and-rules/cloud-workload-policies/create-a-cloud-workload-policy.md): Create Cortex Cloud Posture Management cloud workload policies to address security risks and compliance requirements. - [Use an existing policy to create a new cloud workload policy](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/rules-and-policies/cloud-workload-policies-and-rules/cloud-workload-policies/use-an-existing-policy-to-create-a-new-cloud-workload-policy.md): Reuse a Cortex Cloud Posture Management cloud workload policy to create a new policy. - [Edit a cloud workload policy](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/rules-and-policies/cloud-workload-policies-and-rules/cloud-workload-policies/edit-a-cloud-workload-policy.md): Edit Cortex Cloud Posture Management cloud workload policies to update their settings. - [Delete a cloud workload policy](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/rules-and-policies/cloud-workload-policies-and-rules/cloud-workload-policies/delete-a-cloud-workload-policy.md): Delete Cortex Cloud Posture Management cloud workload policies that are no longer needed. - [Cloud workload preventive action](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/rules-and-policies/cloud-workload-policies-and-rules/cloud-workload-policies/cloud-workload-preventive-action.md): Use Cortex Cloud Posture Management preventive actions to block violations and create issues. - [Cloud workload rules](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/rules-and-policies/cloud-workload-policies-and-rules/cloud-workload-rules.md): Use Cortex Cloud Posture Management cloud workload rules to define criteria for detecting security violations. - [Default (pre-defined) rules](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/rules-and-policies/cloud-workload-policies-and-rules/cloud-workload-rules/default-pre-defined-rules.md): Review predefined Cortex Cloud Posture Management rules that detect cloud runtime security violations. - [Custom (user-defined) rules](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/rules-and-policies/cloud-workload-policies-and-rules/cloud-workload-rules/custom-user-defined-rules.md): Define custom Cortex Cloud Posture Management rules for tailored cloud workload security and compliance checks. - [Cloud Workload Rules page](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/rules-and-policies/cloud-workload-policies-and-rules/cloud-workload-rules/cloud-workload-rules-page.md): Use Cortex Cloud Posture Management to view, filter, and manage cloud workload rules. - [Create a new custom detection rule](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/rules-and-policies/cloud-workload-policies-and-rules/cloud-workload-rules/create-a-new-custom-detection-rule.md): Create custom Cortex Cloud Posture Management detection rules for security and compliance requirements. - [Use an existing rule to create a new custom detection rule](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/rules-and-policies/cloud-workload-policies-and-rules/cloud-workload-rules/use-an-existing-rule-to-create-a-new-custom-detection-rule.md): Reuse a Cortex Cloud Posture Management rule to create a new custom detection rule. - [Edit a custom detection rule](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/rules-and-policies/cloud-workload-policies-and-rules/cloud-workload-rules/edit-a-custom-detection-rule.md): Edit Cortex Cloud Posture Management custom detection rules to update their settings. - [Delete a custom detection rule](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/rules-and-policies/cloud-workload-policies-and-rules/cloud-workload-rules/delete-a-custom-detection-rule.md): Delete Cortex Cloud Posture Management custom detection rules that are no longer needed. - [Base image rules](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/rules-and-policies/base-images-rule.md): Learn how Cortex Cloud Posture Management base image rules map image lineage and vulnerabilities. - [Create a base image rule](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/rules-and-policies/base-images-rule/create-a-base-images-rule.md): Create Cortex Cloud Posture Management base image rules to map derived images to foundational images. - [Find the base image for an asset](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/rules-and-policies/base-images-rule/prerequisites.md): Find an asset's foundational image and lineage in Cortex Cloud Posture Management. - [About serverless function posture security](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/serverless-function-posture-security/serverless-function-posture-security.md): Learn how Cortex Cloud Posture Management scans serverless functions for vulnerabilities, malware, and exposed secrets. - [Onboard cloud providers for serverless functions](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/serverless-function-posture-security/onboard-cloud-providers-for-serverless-functions.md): Connect cloud providers to Cortex Cloud Posture Management for serverless function security scanning. - [Serverless function posture rules](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/serverless-function-posture-security/serverless-function-posture-rules.md): Create and manage Cortex Cloud Posture Management rules for serverless function risks. - [Manage serverless function rules](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/serverless-function-posture-security/serverless-function-posture-rules/manage-serverless-function-rules.md): View, edit, and clone Cortex Cloud Posture Management rules for serverless functions. - [Create serverless function rules](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/serverless-function-posture-security/serverless-function-posture-rules/create-serverless-function-rules.md): Create Cortex Cloud Posture Management rules for serverless attack paths, configurations, and network exposure. - [Create an attack path rule for serverless functions](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/serverless-function-posture-security/serverless-function-posture-rules/create-an-attack-path-rule-for-serverless-functions.md): Create Cortex Cloud Posture Management rules that identify attack paths across serverless functions. - [Create a configuration rule for serverless functions](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/serverless-function-posture-security/serverless-function-posture-rules/create-a-configuration-rule-for-serverless-functions.md): Create Cortex Cloud Posture Management rules that detect serverless function configuration risks. - [Create a network exposure rule for serverless functions](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/serverless-function-posture-security/serverless-function-posture-rules/create-a-network-exposure-rule-for-serverless-functions.md): Create Cortex Cloud Posture Management rules that detect serverless function network exposure. - [Serverless function posture policies](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/serverless-function-posture-security/serverless-function-posture-policies.md): Create and manage Cortex Cloud Posture Management policies for serverless function risks. - [Manage serverless function policies](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/serverless-function-posture-security/serverless-function-posture-policies/manage-serverless-function-policies.md): View, edit, clone, and delete Cortex Cloud Posture Management policies for serverless functions. - [Create serverless function policies](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/serverless-function-posture-security/serverless-function-posture-policies/create-serverless-function-policies.md): Create Cortex Cloud Posture Management policies to detect and remediate serverless function risks. - [Serverless function usage](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/serverless-function-posture-security/serverless-function-usage.md): Use Cortex Cloud Posture Management to investigate serverless function assets, findings, issues, and scan health. - [Broker VM](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/data-management/broker-vm.md): Deploy and manage Cortex Cloud Posture Management Broker VM data collectors. - [What is the Broker VM?](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/data-management/broker-vm/what-is-the-broker-vm.md): Learn how Cortex Cloud Posture Management Broker VM collects and forwards data. - [Set up and configure Broker VM](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/data-management/broker-vm/set-up-and-configure-broker-vm.md): Install and configure a Broker VM to collect data for Cortex Cloud Posture Management. - [Broker VM image installations](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/data-management/broker-vm/set-up-and-configure-broker-vm/broker-vm-image-installations.md): Install Cortex Cloud Posture Management Broker VM on supported cloud and virtual platforms. - [Set up Broker VM on Alibaba Cloud](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/data-management/broker-vm/set-up-and-configure-broker-vm/broker-vm-image-installations/set-up-broker-vm-on-alibaba-cloud.md): Deploy Cortex Cloud Posture Management Broker VM on Alibaba Cloud for data collection. - [Set up Broker VM on Amazon Web Services](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/data-management/broker-vm/set-up-and-configure-broker-vm/broker-vm-image-installations/set-up-broker-vm-on-amazon-web-services.md): Deploy Cortex Cloud Posture Management Broker VM on Amazon Web Services for data collection. - [Set up Broker VM on Google Cloud Platform (GCP)](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/data-management/broker-vm/set-up-and-configure-broker-vm/broker-vm-image-installations/set-up-broker-vm-on-google-cloud-platform-gcp.md): Deploy Cortex Cloud Posture Management Broker VM on Google Cloud Platform for data collection. - [Set up Broker VM on KVM using Ubuntu](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/data-management/broker-vm/set-up-and-configure-broker-vm/broker-vm-image-installations/set-up-broker-vm-on-kvm-using-ubuntu.md): Deploy Cortex Cloud Posture Management Broker VM on KVM with Ubuntu for data collection. - [Set up Broker VM on Microsoft Azure](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/data-management/broker-vm/set-up-and-configure-broker-vm/broker-vm-image-installations/set-up-broker-vm-on-microsoft-azure.md): Deploy Cortex Cloud Posture Management Broker VM on Microsoft Azure for data collection. - [Set up Broker VM on Microsoft Hyper-V](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/data-management/broker-vm/set-up-and-configure-broker-vm/broker-vm-image-installations/set-up-broker-vm-on-microsoft-hyper-v.md): Deploy Cortex Cloud Posture Management Broker VM on Microsoft Hyper-V for data collection. - [Set up Broker VM on Nutanix Hypervisor](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/data-management/broker-vm/set-up-and-configure-broker-vm/broker-vm-image-installations/set-up-broker-vm-on-nutanix-hypervisor.md): Deploy Cortex Cloud Posture Management Broker VM on Nutanix Hypervisor for data collection. - [Set up Broker VM on VMware ESXi using vSphere Client](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/data-management/broker-vm/set-up-and-configure-broker-vm/broker-vm-image-installations/set-up-broker-vm-on-vmware-esxi-using-vsphere-client.md): Deploy Cortex Cloud Posture Management Broker VM on VMware ESXi for data collection. - [Broker VM data collector applets](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/data-management/broker-vm/set-up-and-configure-broker-vm/broker-vm-data-collector-applets.md): Configure Cortex Cloud Posture Management Broker VM data collector applets for supported data sources. - [Manage Broker VM](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/data-management/broker-vm/manage-broker-vm.md): Manage Cortex Cloud Posture Management Broker VM configuration, monitoring, upgrades, and clustering. - [Edit Broker VM Configuration](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/data-management/broker-vm/manage-broker-vm/edit-broker-vm-configuration.md): Update the configuration of an existing Cortex Cloud Posture Management Broker VM. - [Increase Broker VM storage allocated for data caching](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/data-management/broker-vm/manage-broker-vm/increase-broker-vm-storage-allocated-for-data-caching.md): Increase Cortex Cloud Posture Management Broker VM storage for cached data. - [Monitor Broker VM using Prometheus](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/data-management/broker-vm/manage-broker-vm/monitor-broker-vm-using-prometheus.md): Monitor Cortex Cloud Posture Management Broker VM metrics with Prometheus. - [Collect Broker VM Logs](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/data-management/broker-vm/manage-broker-vm/collect-broker-vm-logs.md): Collect logs from Cortex Cloud Posture Management Broker VM for troubleshooting. - [Upgrade Broker VM](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/data-management/broker-vm/manage-broker-vm/upgrade-broker-vm.md): Upgrade Cortex Cloud Posture Management Broker VM to a supported release. - [Update Broker VM applets independently](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/data-management/broker-vm/manage-broker-vm/update-broker-vm-applets-independently.md): Update Cortex Cloud Posture Management Broker VM data collector applets without upgrading the VM. - [Import Broker VM Configuration](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/data-management/broker-vm/manage-broker-vm/import-broker-vm-configuration.md): Import a saved Cortex Cloud Posture Management Broker VM configuration. - [Open Live Terminal](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/data-management/broker-vm/manage-broker-vm/open-live-terminal.md): Open a live terminal session on Cortex Cloud Posture Management Broker VM. - [Add Broker VM to cluster](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/data-management/broker-vm/manage-broker-vm/add-broker-vm-to-cluster.md): Add a Cortex Cloud Posture Management Broker VM node to a high availability cluster. - [Switchover Primary Node in Cluster](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/data-management/broker-vm/manage-broker-vm/switchover-primary-node-in-cluster.md): Switch the primary node in a Cortex Cloud Posture Management Broker VM cluster. - [Remove from Cluster](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/data-management/broker-vm/manage-broker-vm/remove-from-cluster.md): Remove a Cortex Cloud Posture Management Broker VM node from its cluster. - [Manage Broker VM data collector applets](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/data-management/broker-vm/manage-broker-vm-data-collector-applets.md): Manage applets installed on Cortex Cloud Posture Management Broker VM. - [Broker VM High Availability Cluster](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/data-management/broker-vm/broker-vm-high-availability-cluster.md): Configure Cortex Cloud Posture Management Broker VM clusters for high availability. - [Configure High Availability Cluster](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/data-management/broker-vm/broker-vm-high-availability-cluster/configure-high-availability-cluster.md): Configure a high availability cluster for Cortex Cloud Posture Management Broker VM. - [Manage Broker VM clusters](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/data-management/broker-vm/broker-vm-high-availability-cluster/manage-broker-vm-clusters.md): View and manage Cortex Cloud Posture Management Broker VM high availability clusters. - [View cluster details](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/data-management/broker-vm/broker-vm-high-availability-cluster/manage-broker-vm-clusters/view-cluster-details.md): View configuration and status details for a Cortex Cloud Posture Management Broker VM cluster. - [Edit cluster](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/data-management/broker-vm/broker-vm-high-availability-cluster/manage-broker-vm-clusters/edit-cluster.md): Update the configuration of a Cortex Cloud Posture Management Broker VM cluster. - [Add applet to cluster](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/data-management/broker-vm/broker-vm-high-availability-cluster/manage-broker-vm-clusters/add-applet-to-cluster.md): Add a data collector applet to a Cortex Cloud Posture Management Broker VM cluster. - [Add Broker VM to cluster](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/data-management/broker-vm/broker-vm-high-availability-cluster/manage-broker-vm-clusters/add-broker-vm-to-cluster.md): Add a Cortex Cloud Posture Management Broker VM node to an existing cluster. - [Remove cluster](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/data-management/broker-vm/broker-vm-high-availability-cluster/manage-broker-vm-clusters/remove-cluster.md): Remove a Cortex Cloud Posture Management Broker VM high availability cluster. - [Broker VM notifications](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/data-management/broker-vm/broker-vm-notifications.md): Configure and manage Cortex Cloud Posture Management Broker VM notifications. - [Monitor Broker VM activity](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/data-management/broker-vm/monitor-broker-vm-activity.md): Monitor Cortex Cloud Posture Management Broker VM activity and operational status. - [Troubleshoot Broker VM applet errors](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/data-management/broker-vm/troubleshoot-broker-vm-applet-errors.md): Diagnose and resolve Cortex Cloud Posture Management Broker VM data collector applet errors. - [Dataset management](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/data-management/dataset-management.md): Learn more about managing your datasets and understanding your overall data storage, period-based retention. - [What are datasets?](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/data-management/dataset-management/what-are-datasets.md): Learn how to import, delete, and interact with custom or third-party datasets in Cortex Cloud. - [Lookup datasets](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/data-management/dataset-management/lookup-datasets.md): Learn more about lookup datasets to correlate data from a data source with events in your environment. - [Import a lookup dataset](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/data-management/dataset-management/lookup-datasets/import-a-lookup-dataset.md): Import a lookup dataset into Cortex Cloud Posture Management. - [Download JSON file of lookup dataset](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/data-management/dataset-management/lookup-datasets/download-json-file-of-lookup-dataset.md): Download a lookup dataset as a JSON file from Cortex Cloud Posture Management. - [Set time to live for lookup datasets](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/data-management/dataset-management/lookup-datasets/set-time-to-live-for-lookup-datasets.md): Set lookup dataset time-to-live in Cortex Cloud Posture Management. - [Monitor datasets and dataset views activity](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/data-management/dataset-management/monitor-datasets-and-dataset-views-activity.md): Learn more about the monitored Cortex Cloud datasets and dataset views activities. - [Manage compute units](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/data-management/manage-compute-units.md): Learn more about managing and tracking your compute units usage for API and Cold Storage XQL queries. - [Compute units usage](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/data-management/manage-compute-units/compute-units-usage.md): Learn more about how to compute units (CU) works in Cortex Cloud Posture Management according to your license and available options after reaching your quota. - [What are Cortex Cloud data sources and connectors?](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/cortex-cloud-data-sources-and-connectors/what-are-cortex-cloud-data-sources.md): Learn more about Cortex Cloud data sources and connectors with a unified approach to integrations. - [What is the data source and connector catalog?](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/cortex-cloud-data-sources-and-connectors/complete-data-source-catalog.md): Learn more about the complete data source and connector catalog available in Cortex Cloud. - [Vendor-specific data sources and connectors](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/cortex-cloud-data-sources-and-connectors/vendor-specific-data-sources.md) - [AbuseIPDB](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/cortex-cloud-data-sources-and-connectors/vendor-specific-data-sources/abuseipdb.md): Configure the AbuseIPDB connector for Cortex Cloud. - [AbuseIPDB](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/cortex-cloud-data-sources-and-connectors/vendor-specific-data-sources/abuseipdb/abuseipdb.md): Use AbuseIPDB data for Cortex Cloud. - [Aha](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/cortex-cloud-data-sources-and-connectors/vendor-specific-data-sources/aha.md): Configure the Aha connector for Cortex Cloud. - [Aha!](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/cortex-cloud-data-sources-and-connectors/vendor-specific-data-sources/aha/aha.md): Use Aha! data for Cortex Cloud. - [AIOps](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/cortex-cloud-data-sources-and-connectors/vendor-specific-data-sources/aiops.md): Configure the AIOps connector for Cortex Cloud. - [AIOps](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/cortex-cloud-data-sources-and-connectors/vendor-specific-data-sources/aiops/aiops.md): Use AIOps data for Cortex Cloud. - [Amazon](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/cortex-cloud-data-sources-and-connectors/vendor-specific-data-sources/amazon.md): Configure the Amazon data source and connector for Cortex Cloud. - [Amazon Web Services](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/cortex-cloud-data-sources-and-connectors/vendor-specific-data-sources/amazon/amazon-web-services.md): Use Amazon Web Services data with Cortex Cloud. - [AWS Automation and Collection](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/cortex-cloud-data-sources-and-connectors/vendor-specific-data-sources/amazon/aws-automation-and-collection.md): Configure AWS Automation and Collection for Cortex Cloud. - [Anomali](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/cortex-cloud-data-sources-and-connectors/vendor-specific-data-sources/anomali.md): Configure the Anomali connector for Cortex Cloud. - [Anomali](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/cortex-cloud-data-sources-and-connectors/vendor-specific-data-sources/anomali/anomali.md): Use Anomali data for Cortex Cloud. - [Anthropic](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/cortex-cloud-data-sources-and-connectors/vendor-specific-data-sources/anthropic.md): Configure the Anthropic connector for Cortex Cloud. - [Claude](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/cortex-cloud-data-sources-and-connectors/vendor-specific-data-sources/anthropic/claude.md): Use Claude data from Anthropic in Cortex Cloud. - [Apollo.io](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/cortex-cloud-data-sources-and-connectors/vendor-specific-data-sources/apollo.io.md): Configure the Apollo.io connector for Cortex Cloud. - [Apollo.io](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/cortex-cloud-data-sources-and-connectors/vendor-specific-data-sources/apollo.io/apollo.io.md): Use Apollo.io data for Cortex Cloud. - [Articulate Global](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/cortex-cloud-data-sources-and-connectors/vendor-specific-data-sources/articulate-global.md): Configure the Articulate Global connector for Cortex Cloud. - [Articulate Global](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/cortex-cloud-data-sources-and-connectors/vendor-specific-data-sources/articulate-global/articulate-global.md): Use Articulate Global data for Cortex Cloud. - [Asana](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/cortex-cloud-data-sources-and-connectors/vendor-specific-data-sources/asana.md): Configure the Asana connector for Cortex Cloud. - [Asana](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/cortex-cloud-data-sources-and-connectors/vendor-specific-data-sources/asana/asana.md): Use Asana data for Cortex Cloud. - [Atlassian](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/cortex-cloud-data-sources-and-connectors/vendor-specific-data-sources/atlassian.md): Configure the Atlassian connectors for Cortex Cloud. - [Atlassian](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/cortex-cloud-data-sources-and-connectors/vendor-specific-data-sources/atlassian/atlassian.md): Use Atlassian data for Cortex Cloud. - [Atlassian Automation and Collection](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/cortex-cloud-data-sources-and-connectors/vendor-specific-data-sources/atlassian/atlassian-automation-and-collection.md): Configure Atlassian Automation and Collection for Cortex Cloud. - [Automox](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/cortex-cloud-data-sources-and-connectors/vendor-specific-data-sources/automox.md): Configure the Automox connector for Cortex Cloud. - [Automox](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/cortex-cloud-data-sources-and-connectors/vendor-specific-data-sources/automox/automox.md): Use Automox data for Cortex Cloud. - [Box](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/cortex-cloud-data-sources-and-connectors/vendor-specific-data-sources/box.md): Configure the Box connector for Cortex Cloud. - [Box](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/cortex-cloud-data-sources-and-connectors/vendor-specific-data-sources/box/box.md): Use Box data for Cortex Cloud. - [Businessmap](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/cortex-cloud-data-sources-and-connectors/vendor-specific-data-sources/businessmap.md): Configure the Businessmap connector for Cortex Cloud. - [Businessmap](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/cortex-cloud-data-sources-and-connectors/vendor-specific-data-sources/businessmap/businessmap.md): Use Businessmap data for Cortex Cloud. - [Celonis](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/cortex-cloud-data-sources-and-connectors/vendor-specific-data-sources/celonis.md): Configure the Celonis connector for Cortex Cloud. - [Celonis](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/cortex-cloud-data-sources-and-connectors/vendor-specific-data-sources/celonis/celonis.md): Use Celonis data for Cortex Cloud. - [ChatGPT Enterprise](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/cortex-cloud-data-sources-and-connectors/vendor-specific-data-sources/chatgpt-enterprise.md): Configure the ChatGPT Enterprise connector for Cortex Cloud. - [ChatGPT Enterprise](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/cortex-cloud-data-sources-and-connectors/vendor-specific-data-sources/chatgpt-enterprise/chatgpt-enterprise.md): Use ChatGPT Enterprise data for Cortex Cloud. - [Cisco](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/cortex-cloud-data-sources-and-connectors/vendor-specific-data-sources/cisco.md): Configure the Cisco data sources for Cortex Cloud. - [Cisco Duo](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/cortex-cloud-data-sources-and-connectors/vendor-specific-data-sources/cisco/cisco-duo.md): Use Cisco Duo data for Cortex Cloud. - [Cisco Meraki](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/cortex-cloud-data-sources-and-connectors/vendor-specific-data-sources/cisco/cisco-meraki.md): Use Cisco Meraki data for Cortex Cloud. - [ClickUp](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/cortex-cloud-data-sources-and-connectors/vendor-specific-data-sources/clickup.md): Configure the ClickUp connector for Cortex Cloud. - [ClickUp](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/cortex-cloud-data-sources-and-connectors/vendor-specific-data-sources/clickup/clickup.md): Use ClickUp data for Cortex Cloud. - [Contentful](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/cortex-cloud-data-sources-and-connectors/vendor-specific-data-sources/contentful.md): Configure the Contentful connector for Cortex Cloud. - [Contentful](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/cortex-cloud-data-sources-and-connectors/vendor-specific-data-sources/contentful/contentful.md): Use Contentful data for Cortex Cloud. - [Couchbase](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/cortex-cloud-data-sources-and-connectors/vendor-specific-data-sources/couchbase.md): Configure the Couchbase connector for Cortex Cloud. - [Couchbase](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/cortex-cloud-data-sources-and-connectors/vendor-specific-data-sources/couchbase/couchbase.md): Use Couchbase data for Cortex Cloud. - [Coveo](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/cortex-cloud-data-sources-and-connectors/vendor-specific-data-sources/coveo.md): Configure the Coveo connector for Cortex Cloud. - [Coveo](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/cortex-cloud-data-sources-and-connectors/vendor-specific-data-sources/coveo/coveo.md): Use Coveo data for Cortex Cloud. - [Cribl](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/cortex-cloud-data-sources-and-connectors/vendor-specific-data-sources/cribl.md): Configure the Cribl connector for Cortex Cloud. - [Cribl connector](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/cortex-cloud-data-sources-and-connectors/vendor-specific-data-sources/cribl/cribl-connector.md): Use Cribl data for Cortex Cloud. - [Cursor](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/cortex-cloud-data-sources-and-connectors/vendor-specific-data-sources/cursor.md): Configure the Cursor connector for Cortex Cloud. - [Cursor](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/cortex-cloud-data-sources-and-connectors/vendor-specific-data-sources/cursor/cursor.md): Use Cursor data for Cortex Cloud. - [CyberArk](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/cortex-cloud-data-sources-and-connectors/vendor-specific-data-sources/cyberark.md): Configure the CyberArk connector for Cortex Cloud. - [CyberArk](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/cortex-cloud-data-sources-and-connectors/vendor-specific-data-sources/cyberark/cyberark.md): Use CyberArk data for Cortex Cloud. - [Databricks](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/cortex-cloud-data-sources-and-connectors/vendor-specific-data-sources/databricks.md): Configure the Databricks data source and connector for Cortex Cloud. - [How to onboard Databricks](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/cortex-cloud-data-sources-and-connectors/vendor-specific-data-sources/databricks/how-to-onboard-databricks.md): Learn how to onboard the Databricks data source for Cortex Cloud. - [Databricks](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/cortex-cloud-data-sources-and-connectors/vendor-specific-data-sources/databricks/databricks.md): Use Databricks data for Cortex Cloud. - [DataDog](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/cortex-cloud-data-sources-and-connectors/vendor-specific-data-sources/datadog.md): Configure the DataDog connector for Cortex Cloud. - [DataDog](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/cortex-cloud-data-sources-and-connectors/vendor-specific-data-sources/datadog/datadog.md): Use DataDog data for Cortex Cloud. - [Docker](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/cortex-cloud-data-sources-and-connectors/vendor-specific-data-sources/docker.md): Configure the Docker data sources for Cortex Cloud. - [Connect Docker Hub registry](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/cortex-cloud-data-sources-and-connectors/vendor-specific-data-sources/docker/connect-docker-hub-registry.md): Connect a Docker Hub registry to Cortex Cloud for container image scanning. - [Manage a Docker Hub connector](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/cortex-cloud-data-sources-and-connectors/vendor-specific-data-sources/docker/connect-docker-hub-registry/manage-a-docker-hub-connector.md): Manage the Docker Hub registry connector in Cortex Cloud. - [Connect Docker V2 compliant container registry](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/cortex-cloud-data-sources-and-connectors/vendor-specific-data-sources/docker/connect-docker-v2-compliant-container-registry.md): Connect a Docker V2-compliant registry to Cortex Cloud for container image scanning. - [Manage a Docker V2 connector](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/cortex-cloud-data-sources-and-connectors/vendor-specific-data-sources/docker/connect-docker-v2-compliant-container-registry/manage-a-docker-v2-connector.md): Manage the Docker V2-compliant registry connector in Cortex Cloud. - [Elastic](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/cortex-cloud-data-sources-and-connectors/vendor-specific-data-sources/elastic.md): Configure the Elastic connector for Cortex Cloud. - [ElasticSearch](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/cortex-cloud-data-sources-and-connectors/vendor-specific-data-sources/elastic/elasticsearch.md): Use ElasticSearch data for Cortex Cloud. - [Forcepoint](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/cortex-cloud-data-sources-and-connectors/vendor-specific-data-sources/forcepoint.md): Configure the Forcepoint connector for Cortex Cloud. - [Forcepoint](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/cortex-cloud-data-sources-and-connectors/vendor-specific-data-sources/forcepoint/forcepoint.md): Use Forcepoint data for Cortex Cloud. - [Freshworks](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/cortex-cloud-data-sources-and-connectors/vendor-specific-data-sources/freshworks.md): Configure the Freshworks connector for Cortex Cloud. - [Freshworks](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/cortex-cloud-data-sources-and-connectors/vendor-specific-data-sources/freshworks/freshworks.md): Use Freshworks data for Cortex Cloud. - [Gainsight](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/cortex-cloud-data-sources-and-connectors/vendor-specific-data-sources/gainsight.md): Configure the Gainsight connector for Cortex Cloud. - [Gainsight](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/cortex-cloud-data-sources-and-connectors/vendor-specific-data-sources/gainsight/gainsight.md): Use Gainsight data for Cortex Cloud. - [Gemini Enterprise](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/cortex-cloud-data-sources-and-connectors/vendor-specific-data-sources/gemini-enterprise.md): Configure the Gemini Enterprise connector for Cortex Cloud. - [Gemini Enterprise](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/cortex-cloud-data-sources-and-connectors/vendor-specific-data-sources/gemini-enterprise/gemini-enterprise.md): Use Gemini Enterprise data for Cortex Cloud. - [Generic](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/cortex-cloud-data-sources-and-connectors/vendor-specific-data-sources/generic.md): Configure the Generic connectors for Cortex Cloud. - [Generic MCP](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/cortex-cloud-data-sources-and-connectors/vendor-specific-data-sources/generic/generic-mcp.md): Use Generic MCP data for Cortex Cloud. - [Generic SQL](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/cortex-cloud-data-sources-and-connectors/vendor-specific-data-sources/generic/generic-sql.md): Use Generic SQL data for Cortex Cloud. - [GitHub](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/cortex-cloud-data-sources-and-connectors/vendor-specific-data-sources/github.md): Configure the GitHub connector for Cortex Cloud. - [GitHub](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/cortex-cloud-data-sources-and-connectors/vendor-specific-data-sources/github/github.md): Use GitHub data for Cortex Cloud. - [GitLab](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/cortex-cloud-data-sources-and-connectors/vendor-specific-data-sources/gitlab.md): Configure the GitLab data source and connector for Cortex Cloud. - [Connect GitLab container registry](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/cortex-cloud-data-sources-and-connectors/vendor-specific-data-sources/gitlab/connect-gitlab-container-registry.md): Connect a GitLab container registry to Cortex Cloud for image scanning. - [Manage a GitLab Container Registry connector](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/cortex-cloud-data-sources-and-connectors/vendor-specific-data-sources/gitlab/connect-gitlab-container-registry/manage-a-gitlab-container-registry-connector.md): Manage the GitLab Container Registry connector in Cortex Cloud. - [GitLab](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/cortex-cloud-data-sources-and-connectors/vendor-specific-data-sources/gitlab/gitlab.md): Use GitLab data for Cortex Cloud. - [Google](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/cortex-cloud-data-sources-and-connectors/vendor-specific-data-sources/google.md): Configure the Google connector for Cortex Cloud. - [Google Workspace](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/cortex-cloud-data-sources-and-connectors/vendor-specific-data-sources/google/google-workspace.md): Configure Google Workspace connectors for Cortex Cloud. - [Google Workspace connector](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/cortex-cloud-data-sources-and-connectors/vendor-specific-data-sources/google/google-workspace/google-workspace-connector.md): Use Google Workspace data for Cortex Cloud. - [Google Workspace Automation and Collection](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/cortex-cloud-data-sources-and-connectors/vendor-specific-data-sources/google/google-workspace/google-workspace-automation-and-collection.md): Use Google Workspace Automation and Collection data for Cortex Cloud. - [Harbor](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/cortex-cloud-data-sources-and-connectors/vendor-specific-data-sources/harbor.md): Configure the Harbor data source for Cortex Cloud. - [Connect Harbor registry](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/cortex-cloud-data-sources-and-connectors/vendor-specific-data-sources/harbor/connect-harbor-registry.md): Connect a Harbor registry to Cortex Cloud for container image scanning. - [Manage a Harbor connector](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/cortex-cloud-data-sources-and-connectors/vendor-specific-data-sources/harbor/connect-harbor-registry/manage-a-harbor-connector.md): Manage the Harbor registry connector in Cortex Cloud. - [Harness](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/cortex-cloud-data-sources-and-connectors/vendor-specific-data-sources/harness.md): Configure the Harness connector for Cortex Cloud. - [Harness](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/cortex-cloud-data-sources-and-connectors/vendor-specific-data-sources/harness/harness.md): Use Harness data for Cortex Cloud. - [IBM](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/cortex-cloud-data-sources-and-connectors/vendor-specific-data-sources/ibm.md): Configure the IBM connector for Cortex Cloud. - [IBM QRadar](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/cortex-cloud-data-sources-and-connectors/vendor-specific-data-sources/ibm/ibm-qradar.md): Use IBM QRadar data for Cortex Cloud. - [Intercom](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/cortex-cloud-data-sources-and-connectors/vendor-specific-data-sources/intercom.md): Configure the Intercom connector for Cortex Cloud. - [Intercom](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/cortex-cloud-data-sources-and-connectors/vendor-specific-data-sources/intercom/intercom.md): Use Intercom data for Cortex Cloud. - [iZOOlogic](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/cortex-cloud-data-sources-and-connectors/vendor-specific-data-sources/izoologic.md): Configure the iZOOlogic connector for Cortex Cloud. - [iZOOlogic](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/cortex-cloud-data-sources-and-connectors/vendor-specific-data-sources/izoologic/izoologic.md): Use iZOOlogic data for Cortex Cloud. - [Jamf](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/cortex-cloud-data-sources-and-connectors/vendor-specific-data-sources/jamf.md): Configure the Jamf connector for Cortex Cloud. - [Jamf Pro](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/cortex-cloud-data-sources-and-connectors/vendor-specific-data-sources/jamf/jamf-pro.md): Use Jamf Pro data for Cortex Cloud. - [JFrog](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/cortex-cloud-data-sources-and-connectors/vendor-specific-data-sources/jfrog.md): Configure the JFrog data source for Cortex Cloud. - [Connect JFrog container registry](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/cortex-cloud-data-sources-and-connectors/vendor-specific-data-sources/jfrog/connect-jfrog-container-registry.md): Connect a JFrog container registry to Cortex Cloud for image scanning. - [Manage a JFrog connector](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/cortex-cloud-data-sources-and-connectors/vendor-specific-data-sources/jfrog/connect-jfrog-container-registry/manage-a-jfrog-connector.md): Manage the JFrog container registry connector in Cortex Cloud. - [JumpCloud](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/cortex-cloud-data-sources-and-connectors/vendor-specific-data-sources/jumpcloud.md): Configure the JumpCloud connector for Cortex Cloud. - [JumpCloud](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/cortex-cloud-data-sources-and-connectors/vendor-specific-data-sources/jumpcloud/jumpcloud.md): Use JumpCloud data for Cortex Cloud. - [Koi](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/cortex-cloud-data-sources-and-connectors/vendor-specific-data-sources/koi.md): Configure the Koi connector for Cortex Cloud. - [Koi](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/cortex-cloud-data-sources-and-connectors/vendor-specific-data-sources/koi/koi.md): Use Koi data for Cortex Cloud. - [Kubernetes](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/cortex-cloud-data-sources-and-connectors/vendor-specific-data-sources/kubernetes.md): Configure the Kubernetes data source for Cortex Cloud. - [Onboard the Kubernetes connector](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/cortex-cloud-data-sources-and-connectors/vendor-specific-data-sources/kubernetes/onboard-the-kubernetes-connector.md): Onboard the Kubernetes connector for Cortex Cloud. - [What's new in Kubernetes connector](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/cortex-cloud-data-sources-and-connectors/vendor-specific-data-sources/kubernetes/whats-new-in-kubernetes-connector.md): Learn about Kubernetes connector updates in Cortex Cloud. - [Supported Kubernetes distributions](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/cortex-cloud-data-sources-and-connectors/vendor-specific-data-sources/kubernetes/supported-kubernetes-distributions.md): Review supported Kubernetes distributions for Cortex Cloud. - [Kustomer](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/cortex-cloud-data-sources-and-connectors/vendor-specific-data-sources/kustomer.md): Configure the Kustomer connector for Cortex Cloud. - [Kustomer](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/cortex-cloud-data-sources-and-connectors/vendor-specific-data-sources/kustomer/kustomer.md): Use Kustomer data for Cortex Cloud. - [LastPass](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/cortex-cloud-data-sources-and-connectors/vendor-specific-data-sources/lastpass.md): Configure the LastPass connector for Cortex Cloud. - [LastPass](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/cortex-cloud-data-sources-and-connectors/vendor-specific-data-sources/lastpass/lastpass.md): Use LastPass data for Cortex Cloud. - [Mail Utilities](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/cortex-cloud-data-sources-and-connectors/vendor-specific-data-sources/mail-utilities.md): Configure the Mail Utilities connector for Cortex Cloud. - [Mail Utilities](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/cortex-cloud-data-sources-and-connectors/vendor-specific-data-sources/mail-utilities/mail-utilities.md): Use Mail Utilities data for Cortex Cloud. - [Microsoft](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/cortex-cloud-data-sources-and-connectors/vendor-specific-data-sources/microsoft.md): Configure the Microsoft data sources and connectors for Cortex Cloud. - [Microsoft Azure](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/cortex-cloud-data-sources-and-connectors/vendor-specific-data-sources/microsoft/microsoft-azure.md): Configure Microsoft Azure data for Cortex Cloud. - [Microsoft Copilot Studio](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/cortex-cloud-data-sources-and-connectors/vendor-specific-data-sources/microsoft/microsoft-copilot-studio.md): Use Microsoft Copilot Studio data for Cortex Cloud. - [Microsoft Entra ID](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/cortex-cloud-data-sources-and-connectors/vendor-specific-data-sources/microsoft/microsoft-entra-id.md): Use Microsoft Entra ID data for Cortex Cloud. - [Microsoft365 (legacy)](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/cortex-cloud-data-sources-and-connectors/vendor-specific-data-sources/microsoft/microsoft365-legacy.md): Use Microsoft365 data for Cortex Cloud. - [Migrate to new Microsoft 365 connector](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/cortex-cloud-data-sources-and-connectors/vendor-specific-data-sources/microsoft/microsoft365-legacy/migrate-to-new-microsoft-365-connector.md) - [Microsoft 365 (new)](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/cortex-cloud-data-sources-and-connectors/vendor-specific-data-sources/microsoft/microsoft-365-new.md): Use Microsoft 365 data for Cortex Cloud. - [Create a Microsoft Entra ID](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/cortex-cloud-data-sources-and-connectors/vendor-specific-data-sources/microsoft/microsoft-365-new/create-a-microsoft-entra-id.md) - [Microsoft 365 Copilot](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/cortex-cloud-data-sources-and-connectors/vendor-specific-data-sources/microsoft/microsoft-365-copilot.md): Use Microsoft 365 Copilot data for Cortex Cloud. - [Microsoft 365 (Posture)](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/cortex-cloud-data-sources-and-connectors/vendor-specific-data-sources/microsoft/microsoft-365-posture.md): Use Microsoft 365 (Posture) data for Cortex Cloud. - [How to onboard Microsoft 365](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/cortex-cloud-data-sources-and-connectors/vendor-specific-data-sources/microsoft/microsoft-365-posture/how-to-onboard-microsoft-365.md): Onboard Microsoft 365 data for Cortex Cloud. - [Microsoft Teams](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/cortex-cloud-data-sources-and-connectors/vendor-specific-data-sources/microsoft/microsoft-teams.md): Use Microsoft Teams data for Cortex Cloud. - [Azure Log Analytics](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/cortex-cloud-data-sources-and-connectors/vendor-specific-data-sources/microsoft/azure-log-analytics.md): Use Azure Log Analytics data for Cortex Cloud. - [Azure Services](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/cortex-cloud-data-sources-and-connectors/vendor-specific-data-sources/microsoft/azure-services.md): Use Azure Services data for Cortex Cloud. - [Microsoft Active Directory](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/cortex-cloud-data-sources-and-connectors/vendor-specific-data-sources/microsoft/microsoft-active-directory.md): Use Microsoft Active Directory data for Cortex Cloud. - [Microsoft Graph](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/cortex-cloud-data-sources-and-connectors/vendor-specific-data-sources/microsoft/microsoft-graph.md): Use Microsoft Graph data for Cortex Cloud. - [Microsoft Identity](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/cortex-cloud-data-sources-and-connectors/vendor-specific-data-sources/microsoft/microsoft-identity.md): Use Microsoft Identity data for Cortex Cloud. - [Microsoft Security Automation and Collection](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/cortex-cloud-data-sources-and-connectors/vendor-specific-data-sources/microsoft/microsoft-security-automation-and-collection.md): Use Microsoft Security Automation and Collection data for Cortex Cloud. - [M365 Automation and Collection](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/cortex-cloud-data-sources-and-connectors/vendor-specific-data-sources/microsoft/m365-automation-and-collection.md): Use M365 Automation and Collection data for Cortex Cloud. - [Monday](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/cortex-cloud-data-sources-and-connectors/vendor-specific-data-sources/monday.md): Configure the Monday connectors for Cortex Cloud. - [Monday](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/cortex-cloud-data-sources-and-connectors/vendor-specific-data-sources/monday/monday.md): Use Monday data for Cortex Cloud. - [Monday.com](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/cortex-cloud-data-sources-and-connectors/vendor-specific-data-sources/monday/monday.com.md): Use Monday.com data for Cortex Cloud. - [MongoDB](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/cortex-cloud-data-sources-and-connectors/vendor-specific-data-sources/mongodb.md): Configure the MongoDB connector for Cortex Cloud. - [How to onboard MongoDB Atlas (Posture)](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/cortex-cloud-data-sources-and-connectors/vendor-specific-data-sources/mongodb/how-to-onboard-mongodb-atlas.md): Use MongoDB Atlas (Posture) data with Cortex Cloud. - [MongoDB Atlas](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/cortex-cloud-data-sources-and-connectors/vendor-specific-data-sources/mongodb/mongodb-atlas.md): Use MongoDB Atlas data for Cortex Cloud. - [MuleSoft](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/cortex-cloud-data-sources-and-connectors/vendor-specific-data-sources/mulesoft.md): Configure the MuleSoft connector for Cortex Cloud. - [MuleSoft](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/cortex-cloud-data-sources-and-connectors/vendor-specific-data-sources/mulesoft/mulesoft.md): Use MuleSoft data for Cortex Cloud. - [Mural](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/cortex-cloud-data-sources-and-connectors/vendor-specific-data-sources/mural.md): Configure the Mural connector for Cortex Cloud. - [Mural](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/cortex-cloud-data-sources-and-connectors/vendor-specific-data-sources/mural/mural.md): Use Mural data for Cortex Cloud. - [Nintex Workflow Cloud](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/cortex-cloud-data-sources-and-connectors/vendor-specific-data-sources/nintex-workflow-cloud.md): Configure the Nintex Workflow Cloud connector for Cortex Cloud. - [Nintex Workflow Cloud](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/cortex-cloud-data-sources-and-connectors/vendor-specific-data-sources/nintex-workflow-cloud/nintex-workflow-cloud.md): Use Nintex Workflow Cloud data for Cortex Cloud. - [Okta](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/cortex-cloud-data-sources-and-connectors/vendor-specific-data-sources/okta.md): Configure the Okta data source and connectors for Cortex Cloud. - [Ingest logs and data from Okta](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/cortex-cloud-data-sources-and-connectors/vendor-specific-data-sources/okta/ingest-logs-and-data-from-okta.md): Ingest Okta logs and data for Cortex Cloud. - [Okta Automation and Collection](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/cortex-cloud-data-sources-and-connectors/vendor-specific-data-sources/okta/okta-automation-and-collection.md): Use Okta Automation and Collection data for Cortex Cloud. - [Okta connector](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/cortex-cloud-data-sources-and-connectors/vendor-specific-data-sources/okta/okta-connector.md): Use Okta data for Cortex Cloud. - [Oracle](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/cortex-cloud-data-sources-and-connectors/vendor-specific-data-sources/oracle.md): Configure the Oracle data source and connector for Cortex Cloud. - [Oracle Cloud Infrastructure](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/cortex-cloud-data-sources-and-connectors/vendor-specific-data-sources/oracle/oracle-cloud-infrastructure.md): Use Oracle Cloud Infrastructure data for Cortex Cloud. - [Oracle](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/cortex-cloud-data-sources-and-connectors/vendor-specific-data-sources/oracle/oracle.md): Use Oracle data for Cortex Cloud. - [PagerDuty](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/cortex-cloud-data-sources-and-connectors/vendor-specific-data-sources/pagerduty.md): Configure the PagerDuty connectors for Cortex Cloud. - [PagerDuty Automation and Collection](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/cortex-cloud-data-sources-and-connectors/vendor-specific-data-sources/pagerduty/pagerduty-automation-and-collection.md): Use PagerDuty Automation and Collection data for Cortex Cloud. - [PagerDuty](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/cortex-cloud-data-sources-and-connectors/vendor-specific-data-sources/pagerduty/pagerduty.md): Use PagerDuty data for Cortex Cloud. - [Ping Identity](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/cortex-cloud-data-sources-and-connectors/vendor-specific-data-sources/ping-identity.md): Configure the Ping Identity connector for Cortex Cloud. - [Ping Identity](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/cortex-cloud-data-sources-and-connectors/vendor-specific-data-sources/ping-identity/ping-identity.md): Use Ping Identity data for Cortex Cloud. - [Pipedrive](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/cortex-cloud-data-sources-and-connectors/vendor-specific-data-sources/pipedrive.md): Configure the Pipedrive connector for Cortex Cloud. - [Pipedrive](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/cortex-cloud-data-sources-and-connectors/vendor-specific-data-sources/pipedrive/pipedrive.md): Use Pipedrive data for Cortex Cloud. - [Qualtrics](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/cortex-cloud-data-sources-and-connectors/vendor-specific-data-sources/qualtrics.md): Configure the Qualtrics connector for Cortex Cloud. - [Qualtrics](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/cortex-cloud-data-sources-and-connectors/vendor-specific-data-sources/qualtrics/qualtrics.md): Use Qualtrics data for Cortex Cloud. - [Redis Labs](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/cortex-cloud-data-sources-and-connectors/vendor-specific-data-sources/redis-labs.md): Configure the Redis Labs connector for Cortex Cloud. - [Redis Labs](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/cortex-cloud-data-sources-and-connectors/vendor-specific-data-sources/redis-labs/redis-labs.md): Use Redis Labs data for Cortex Cloud. - [Salesforce](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/cortex-cloud-data-sources-and-connectors/vendor-specific-data-sources/salesforce.md): Configure the Salesforce data source and connector for Cortex Cloud. - [Ingest logs and data from Salesforce](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/cortex-cloud-data-sources-and-connectors/vendor-specific-data-sources/salesforce/ingest-logs-and-data-from-salesforce.md): Ingest Salesforce logs and data into Cortex Cloud. - [Salesforce connector](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/cortex-cloud-data-sources-and-connectors/vendor-specific-data-sources/salesforce/ingest-and-run-salesforce-automation-and-remediation.md): Use Salesforce data for Cortex Cloud. - [SAP](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/cortex-cloud-data-sources-and-connectors/vendor-specific-data-sources/sap.md): Configure the SAP connector for Cortex Cloud. - [SAP Ariba](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/cortex-cloud-data-sources-and-connectors/vendor-specific-data-sources/sap/sap-ariba.md): Use SAP Ariba data for Cortex Cloud. - [Sentry](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/cortex-cloud-data-sources-and-connectors/vendor-specific-data-sources/sentry.md): Configure the Sentry connector for Cortex Cloud. - [Sentry](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/cortex-cloud-data-sources-and-connectors/vendor-specific-data-sources/sentry/sentry.md): Use Sentry data for Cortex Cloud. - [ServiceNow](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/cortex-cloud-data-sources-and-connectors/vendor-specific-data-sources/servicenow.md): Configure the ServiceNow connectors for Cortex Cloud. - [ServiceNow Automation and Collection](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/cortex-cloud-data-sources-and-connectors/vendor-specific-data-sources/servicenow/servicenow-automation-and-collection.md): Use ServiceNow Automation and Collection data for Cortex Cloud. - [ServiceNow](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/cortex-cloud-data-sources-and-connectors/vendor-specific-data-sources/servicenow/servicenow.md): Use ServiceNow data for Cortex Cloud. - [Shopify](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/cortex-cloud-data-sources-and-connectors/vendor-specific-data-sources/shopify.md): Configure the Shopify connector for Cortex Cloud. - [Shopify](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/cortex-cloud-data-sources-and-connectors/vendor-specific-data-sources/shopify/shopify.md): Use Shopify data for Cortex Cloud. - [Slack](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/cortex-cloud-data-sources-and-connectors/vendor-specific-data-sources/slack.md): Configure the Slack connectors for Cortex Cloud. - [Slack Automation and Collection](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/cortex-cloud-data-sources-and-connectors/vendor-specific-data-sources/slack/slack-automation-and-collection.md): Use Slack Automation and Collection data for Cortex Cloud. - [Slack Enterprise](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/cortex-cloud-data-sources-and-connectors/vendor-specific-data-sources/slack/slack-enterprise.md): Use Slack Enterprise data for Cortex Cloud. - [SMB](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/cortex-cloud-data-sources-and-connectors/vendor-specific-data-sources/smb.md): Configure the SMB connector for Cortex Cloud. - [SMB](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/cortex-cloud-data-sources-and-connectors/vendor-specific-data-sources/smb/smb.md): Use SMB data for Cortex Cloud. - [Snowflake](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/cortex-cloud-data-sources-and-connectors/vendor-specific-data-sources/snowflake.md): Configure the Snowflake connector for Cortex Cloud. - [How to onboard Snowflake](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/cortex-cloud-data-sources-and-connectors/vendor-specific-data-sources/snowflake/how-to-onboard-snowflake.md): Onboard Snowflake data for Cortex Cloud. - [Sonatype Nexus](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/cortex-cloud-data-sources-and-connectors/vendor-specific-data-sources/sonatype-nexus.md): Configure the Sonatype Nexus connector for Cortex Cloud. - [Connect Sonatype Nexus registry](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/cortex-cloud-data-sources-and-connectors/vendor-specific-data-sources/sonatype-nexus/connect-sonatype-nexus-registry.md): Use Sonatype Nexus registry data in Cortex Cloud for container image scanning. - [Manage a Sonatype connector](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/cortex-cloud-data-sources-and-connectors/vendor-specific-data-sources/sonatype-nexus/connect-sonatype-nexus-registry/manage-a-sonatype-connector.md): Manage the Sonatype registry connector in Cortex Cloud. - [Splunk](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/cortex-cloud-data-sources-and-connectors/vendor-specific-data-sources/splunk.md): Configure the Splunk connectors for Cortex Cloud. - [Splunk Automation and Collection](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/cortex-cloud-data-sources-and-connectors/vendor-specific-data-sources/splunk/splunk-automation-and-collection.md): Use Splunk Automation and Collection data for Cortex Cloud. - [Splunk](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/cortex-cloud-data-sources-and-connectors/vendor-specific-data-sources/splunk/splunk.md): Use Splunk data for Cortex Cloud. - [Sumo Logic](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/cortex-cloud-data-sources-and-connectors/vendor-specific-data-sources/sumo-logic.md): Configure the Sumo Logic connector for Cortex Cloud. - [Sumo Logic](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/cortex-cloud-data-sources-and-connectors/vendor-specific-data-sources/sumo-logic/sumo-logic.md): Use Sumo Logic data for Cortex Cloud. - [Terraform](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/cortex-cloud-data-sources-and-connectors/vendor-specific-data-sources/terraform.md): Configure the Terraform connector for Cortex Cloud. - [Terraform](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/cortex-cloud-data-sources-and-connectors/vendor-specific-data-sources/terraform/terraform.md): Use Terraform data for Cortex Cloud. - [VMware](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/cortex-cloud-data-sources-and-connectors/vendor-specific-data-sources/vmware.md): Configure the VMware connector for Cortex Cloud. - [VMWare](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/cortex-cloud-data-sources-and-connectors/vendor-specific-data-sources/vmware/vmware.md): Use VMWare data for Cortex Cloud. - [Workday](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/cortex-cloud-data-sources-and-connectors/vendor-specific-data-sources/workday.md): Configure the Workday connectors for Cortex Cloud. - [Workday Automation and Collection](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/cortex-cloud-data-sources-and-connectors/vendor-specific-data-sources/workday/workday-automation-and-collection.md): Use Workday Automation and Collection data for Cortex Cloud. - [Workday](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/cortex-cloud-data-sources-and-connectors/vendor-specific-data-sources/workday/workday.md): Use Workday data for Cortex Cloud. - [YouTrack](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/cortex-cloud-data-sources-and-connectors/vendor-specific-data-sources/youtrack.md): Configure the YouTrack connector for Cortex Cloud. - [YouTrack](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/cortex-cloud-data-sources-and-connectors/vendor-specific-data-sources/youtrack/youtrack.md): Use YouTrack data for Cortex Cloud. - [Zendesk](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/cortex-cloud-data-sources-and-connectors/vendor-specific-data-sources/zendesk.md): Configure the Zendesk connector for Cortex Cloud. - [Zendesk](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/cortex-cloud-data-sources-and-connectors/vendor-specific-data-sources/zendesk/zendesk.md): Use Zendesk data for Cortex Cloud. - [Zscaler](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/cortex-cloud-data-sources-and-connectors/vendor-specific-data-sources/zscaler.md): Configure the Zscaler connector for Cortex Cloud. - [Zscaler](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/cortex-cloud-data-sources-and-connectors/vendor-specific-data-sources/zscaler/zscaler.md): Use Zscaler data for Cortex Cloud. - [Connectors](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/cortex-cloud-data-sources-and-connectors/connectors.md) - [Standard data sources](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/cortex-cloud-data-sources-and-connectors/standard-data-sources.md) - [Cloud service provider (CSP) onboarding](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/cortex-cloud-data-sources-and-connectors/cloud-service-provider-csp-onboarding.md): Learn about onboarding your cloud service provider to Cortex Cloud. - [Generic on-premise data collectors](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/cortex-cloud-data-sources-and-connectors/generic-on-premise-data-collectors.md) - [Broker VM data collector applets](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/cortex-cloud-data-sources-and-connectors/generic-on-premise-data-collectors/broker-vm-data-collector-applets.md) - [Activate DSPM Database](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/cortex-cloud-data-sources-and-connectors/generic-on-premise-data-collectors/broker-vm-data-collector-applets/activate-dspm-database.md): Configure the DSPM Database applet for Cortex Cloud. - [Activate DSPM Fileshare](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/cortex-cloud-data-sources-and-connectors/generic-on-premise-data-collectors/broker-vm-data-collector-applets/activate-dspm-fileshare.md): Configure the DSPM Fileshare applet for Cortex Cloud. - [Activate Registry Scanner](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/cortex-cloud-data-sources-and-connectors/generic-on-premise-data-collectors/broker-vm-data-collector-applets/activate-registry-scanner.md) - [Activate Transporter](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/cortex-cloud-data-sources-and-connectors/generic-on-premise-data-collectors/broker-vm-data-collector-applets/activate-transporter.md) - [Palo Alto Networks integrations](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/cortex-cloud-data-sources-and-connectors/palo-alto-networks-integrations.md) - [Cortex Internals](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/cortex-cloud-data-sources-and-connectors/palo-alto-networks-integrations/cortex-internals.md) - [Cloud Next-Generation Firewall](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/cortex-cloud-data-sources-and-connectors/palo-alto-networks-integrations/cloud-next-generation-firewall.md) - [Ingest data from Cloud Next-Generation Firewall](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/cortex-cloud-data-sources-and-connectors/palo-alto-networks-integrations/cloud-next-generation-firewall/ingest-data-from-cloud-next-generation-firewall.md) - [Next-Generation Firewall](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/cortex-cloud-data-sources-and-connectors/palo-alto-networks-integrations/next-generation-firewall.md) - [Panorama](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/cortex-cloud-data-sources-and-connectors/palo-alto-networks-integrations/next-generation-firewall/panorama.md) - [Palo Alto Networks Cortex](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/cortex-cloud-data-sources-and-connectors/palo-alto-networks-integrations/palo-alto-networks-cortex.md) - [Prisma Access](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/cortex-cloud-data-sources-and-connectors/palo-alto-networks-integrations/prisma-access.md) - [Palo Alto Networks Prisma](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/cortex-cloud-data-sources-and-connectors/palo-alto-networks-integrations/prisma-access/palo-alto-networks-prisma.md) - [WildFire Cloud](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/cortex-cloud-data-sources-and-connectors/palo-alto-networks-integrations/wildfire-cloud.md) - [Cloud Posture and Runtime Security data sources](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/cortex-cloud-data-sources-and-connectors/cloud-posture-and-runtime-security-data-sources.md): Learn more about the Cloud Posture and Runtime Security data sources in Cortex Cloud. - [Administration and troubleshooting](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/cortex-cloud-data-sources-and-connectors/administration-and-troubleshooting.md): Learn more about the administration and troubleshooting of the different data collector integrations in Cortex Cloud. - [Manage instances](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/cortex-cloud-data-sources-and-connectors/administration-and-troubleshooting/manage-instances.md) - [Add a new data source or instance](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/cortex-cloud-data-sources-and-connectors/administration-and-troubleshooting/manage-instances/add-a-new-data-source-or-instance.md) - [How to configure the scanning settings for supported services](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/cortex-cloud-data-sources-and-connectors/administration-and-troubleshooting/manage-instances/how-to-configure-the-scanning-settings-for-supported-services.md) - [Manage cloud instances](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/cortex-cloud-data-sources-and-connectors/administration-and-troubleshooting/manage-instances/manage-cloud-instances.md) - [Update cloud permissions after Cortex release updates](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/cortex-cloud-data-sources-and-connectors/administration-and-troubleshooting/manage-instances/update-cloud-permissions-after-cortex-release-updates.md) - [Pending cloud instances](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/cortex-cloud-data-sources-and-connectors/administration-and-troubleshooting/manage-instances/pending-cloud-instances.md) - [Troubleshoot errors on cloud instances](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/cortex-cloud-data-sources-and-connectors/administration-and-troubleshooting/manage-instances/troubleshoot-errors-on-cloud-instances.md) - [Manage Kubernetes Connector instances](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/cortex-cloud-data-sources-and-connectors/administration-and-troubleshooting/manage-instances/manage-kubernetes-connector-instances.md) - [Integrations](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/cortex-cloud-data-sources-and-connectors/administration-and-troubleshooting/integrations.md) - [Add an integration instance](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/cortex-cloud-data-sources-and-connectors/administration-and-troubleshooting/integrations/add-an-integration-instance.md) - [Configure integration permissions](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/cortex-cloud-data-sources-and-connectors/administration-and-troubleshooting/integrations/configure-integration-permissions.md) - [Troubleshoot Integrations](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/cortex-cloud-data-sources-and-connectors/administration-and-troubleshooting/integrations/troubleshoot-integrations.md) - [Verify collector connectivity](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/cortex-cloud-data-sources-and-connectors/administration-and-troubleshooting/verify-collector-connectivity.md) - [About health issues](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/cortex-cloud-data-sources-and-connectors/administration-and-troubleshooting/about-health-issues.md) - [Investigate and resolve health issues](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/cortex-cloud-data-sources-and-connectors/administration-and-troubleshooting/about-health-issues/investigate-and-resolve-health-issues.md) - [Monitor data ingestion health](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/cortex-cloud-data-sources-and-connectors/administration-and-troubleshooting/about-health-issues/monitor-data-ingestion-health.md) - [Cortex Marketplace](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/marketplace/cortex-marketplace.md): Search Cortex Cloud Posture Management Marketplace content by use case, integration, or category. - [Content Pack Support Types](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/marketplace/content-pack-support-types.md): Review Cortex Cloud Posture Management content pack support types, including Cortex, partner, developer, and community support. - [Cortex Cloud content](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/marketplace/cortex-cloud-content.md): Explore content types available in Cortex Cloud Posture Management. - [Manage content packs](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/marketplace/manage-content-packs.md): Install, delete, update, and revert Cortex Cloud Posture Management content packs. - [Marketplace FAQs](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/marketplace/marketplace-faqs.md): Find answers to frequently asked questions about Cortex Cloud Posture Management Marketplace content. - [Content changes when upgrading Cortex Cloud versions](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/marketplace/content-changes-when-upgrading-cortex-cloud-versions.md): Review Cortex Cloud Posture Management content updates when upgrading Cortex Cloud versions. - [About Cortex CLI](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/cortex-cli/cortex-cli.md): The Cortex CLI is a unified command-line tool integrating Cloud Workload Protection, API Security, and Code Security scans into a single executable. - [Connect Cortex CLI](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/cortex-cli/connect-cortex-cli.md): Connect Cortex CLI to Cortex Cloud Posture Management for command-line scanning workflows. - [Installation workflows](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/cortex-cli/connect-cortex-cli/installation-workflows.md): Install Cortex CLI using a package manager, manual download, or the Cortex Cloud interface. - [Manage the CLI after installation](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/cortex-cli/connect-cortex-cli/manage-the-cli-after-installation.md): Upgrade, pin, uninstall, or update Cortex CLI through automated downloads. - [Authenticate credentials](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/cortex-cli/connect-cortex-cli/authenticate-credentials.md): Configure Cortex CLI credentials using a file, environment variables, or command-line flags. - [Self-service API keys for CLI scans](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/cortex-cli/connect-cortex-cli/self-service-api-keys-for-cli-scans.md): Create and manage API keys for Cortex Cloud Posture Management CLI scans. - [Cortex CLI usage](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/cortex-cli/cortex-cli-usage.md): Use Cortex CLI with Cortex Cloud Posture Management to run security scans. - [Exit codes and error handling](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/cortex-cli/exit-codes-and-error-handling.md) - [Cortex CLI common command line reference guide](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/cortex-cli/cortex-cli-common-command-line-reference-guide.md): Reference common Cortex CLI commands for Cortex Cloud Posture Management workflows. - [Cortex CLI for Code Security](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/cortex-cli/cortex-cli-for-code-security.md): Use Cortex CLI with Cortex Cloud Posture Management to scan code for security risks. - [Cortex CLI usage for Cortex Cloud Application Security](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/cortex-cli/cortex-cli-for-code-security/cortex-cli-usage-for-cortex-cloud-application-security.md): Use Cortex CLI to run Cortex Cloud Application Security scans in Cortex Cloud Posture Management. - [Cortex CLI Cortex Cloud Application Security command line reference](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/cortex-cli/cortex-cli-for-code-security/cortex-cli-cortex-cloud-application-security-command-line-reference.md): Reference Cortex CLI commands for Cortex Cloud Application Security in Cortex Cloud Posture Management. - [Custom Cortex checks and signature verification](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/cortex-cli/cortex-cli-for-code-security/cortex-cli-cortex-cloud-application-security-command-line-reference/custom-cortex-checks-and-signature-verification.md): Load custom Cortex checks and optionally verify their signatures. - [Cortex CLI pre-commit hooks](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/cortex-cli/cortex-cli-for-code-security/cortex-cli-pre-commit-hooks.md): Integrate Application Security secrets scanner as pre-commit hooks into your workflows to scan for errors on your machine before local commits. - [Pre-commit hook usage](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/cortex-cli/cortex-cli-for-code-security/cortex-cli-pre-commit-hooks/pre-commit-hook-usage.md): Use Cortex CLI pre-commit hooks in Cortex Cloud Posture Management to scan code before commits. - [Cortex CLI pre-receive hooks](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/cortex-cli/cortex-cli-for-code-security/cortex-cli-pre-receive-hooks.md): Integrate the Application Security secrets scanner as a pre-receive hook into your workflows to scan for errors before code is accepted into your repository. - [Pre-receive hook usage](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/cortex-cli/cortex-cli-for-code-security/cortex-cli-pre-receive-hooks/pre-receive-hook-usage.md): Use Cortex CLI pre-receive hooks in Cortex Cloud Posture Management to scan code before repository acceptance. - [Cortex CLI for Cloud Workload Protection](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/cortex-cli/cortex-cli-for-cloud-workload-protection.md): Use Cortex CLI with Cortex Cloud Posture Management to scan cloud workloads for security risks. - [Cloud Workload Protection command line reference](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/cortex-cli/cortex-cli-for-cloud-workload-protection/cloud-workload-protection-command-line-reference.md): Reference Cortex CLI commands for Cortex Cloud Posture Management cloud workload scans. - [Cortex CLI for API Security](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/cortex-cli/cortex-cli-for-api-security.md): Use Cortex CLI with Cortex Cloud Posture Management to scan APIs for security risks. - [Cortex CLI API Security command line reference guide](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/cortex-cli/cortex-cli-for-api-security/cortex-cli-api-security-command-line-reference-guide.md): Reference Cortex CLI commands for Cortex Cloud Posture Management API Security scans. - [API Security scan report schema](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/cortex-cli/cortex-cli-for-api-security/api-security-scan-report-schema.md): Reference schema for API Security scan reports. - [API Security scan output example](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/cortex-cli/cortex-cli-for-api-security/api-security-scan-output-example.md): Example API Security scan report output. - [About Cortex Cloud XQL](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/cortex-cloud-xql/cortex-cloud-xql.md): Use Cortex Cloud XQL in Cortex Cloud Posture Management to query security data. - [Get started with XQL](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/cortex-cloud-xql/get-started-with-xql.md): XQL is the Palo Alto Networks Cortex Query Language used in Cortex Cloud. - [XQL language features](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/cortex-cloud-xql/get-started-with-xql/xql-language-features.md): Learn more about the Cortex Query Language features to query for raw network and endpoint data. - [XQL Language Structure](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/cortex-cloud-xql/get-started-with-xql/xql-language-structure.md): Learn more about the Cortex Query Language structure when creating a query. - [Supported operators](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/cortex-cloud-xql/get-started-with-xql/supported-operators.md): Cortex Query Language supports specific comparison, boolean, and set operators in Cortex Cloud. - [Datasets and presets](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/cortex-cloud-xql/get-started-with-xql/datasets-and-presets.md): The Cortex Query Language supports built-in datasets, custom datasets, and presets. - [About examples](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/cortex-cloud-xql/get-started-with-xql/about-examples.md): Learn more about the Cortex Query Language (XQL) examples provided. - [JSON functions](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/cortex-cloud-xql/get-started-with-xql/json-functions.md): Learn more about how Cortex Cloud treats JSON functions in the Cortex Query Language. - [How to filter for empty values in the results table](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/cortex-cloud-xql/get-started-with-xql/how-to-filter-for-empty-values-in-the-results-table.md): Learn how to filter for empty values in the results table in Cortex Query Language. - [Understanding string manipulation in XQL](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/cortex-cloud-xql/get-started-with-xql/understanding-string-manipulation-in-xql.md): Learn more about string manipulation in Cortex Query Language (XQL) using double and triple quotes. - [Build XQL queries](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/cortex-cloud-xql/build-xql-queries.md): Learn more about how to build Cortex Query Language (XQL) queries using the Query Builder. - [About the Query Builder](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/cortex-cloud-xql/build-xql-queries/about-the-query-builder.md): The Query Builder facilitates threat detection, case expansion, and data analytics for suspected threats. - [How to build XQL queries](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/cortex-cloud-xql/build-xql-queries/how-to-build-xql-queries.md): Learn more about how to build XQL queries in the Query Builder. - [XQL query entities](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/cortex-cloud-xql/build-xql-queries/xql-query-entities.md): Learn more about the Cortex Query Language (XQL) entities available in the Query Builder. - [Create authentication query](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/cortex-cloud-xql/build-xql-queries/xql-query-entities/create-authentication-query.md): Create authentication queries in Cortex Cloud Posture Management to investigate authentication activity. - [Create event log query](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/cortex-cloud-xql/build-xql-queries/xql-query-entities/create-event-log-query.md): Create event log queries in Cortex Cloud Posture Management to investigate event activity. - [Create file query](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/cortex-cloud-xql/build-xql-queries/xql-query-entities/create-file-query.md): Create file queries in Cortex Cloud Posture Management to investigate file activity. - [Create image load query](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/cortex-cloud-xql/build-xql-queries/xql-query-entities/create-image-load-query.md): Create image load queries in Cortex Cloud Posture Management to investigate loaded images. - [Create network connections query](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/cortex-cloud-xql/build-xql-queries/xql-query-entities/create-network-connections-query.md): Create network connection queries in Cortex Cloud Posture Management to investigate connection activity. - [Create network query](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/cortex-cloud-xql/build-xql-queries/xql-query-entities/create-network-query.md): Create network queries in Cortex Cloud Posture Management to investigate network activity. - [Create process query](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/cortex-cloud-xql/build-xql-queries/xql-query-entities/create-process-query.md): Create process queries in Cortex Cloud Posture Management to investigate process activity. - [Create registry query](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/cortex-cloud-xql/build-xql-queries/xql-query-entities/create-registry-query.md): Create registry queries in Cortex Cloud Posture Management to investigate registry activity. - [Overview of the Query Center](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/cortex-cloud-xql/build-xql-queries/overview-of-the-query-center.md): View information about the In Progress and Completed queries that that were run on the tenant. - [Manage scheduled queries](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/cortex-cloud-xql/build-xql-queries/manage-scheduled-queries.md): Learn how to manage your scheduled and recurring queries. - [Manage your query library](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/cortex-cloud-xql/build-xql-queries/manage-your-query-library.md): Cortex Cloud provides a Query Library for saving and managing your own queries. - [Cortex XQL syntax, parameters, and examples](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/cortex-cloud-xql/cortex-xql-syntax-parameters-and-examples.md): Comprehensive syntax rules and structural requirements for XQL queries - [What is Graph Search?](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/graph-search/what-is-graph-search.md): Learn more about how to use Graph Search to search assets, findings, and their contextual data. - [Get started with Graph Search queries](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/graph-search/get-started-with-graph-search-queries.md): Learn more about how to get started before building a Graph Search query. - [How to build Graph Search queries?](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/graph-search/how-to-build-graph-search-queries.md): Learn more about building Graph Search queries using the built-in query interface. - [Understand Graph Search query results](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/graph-search/understand-graph-search-query-results.md): Learn more about the Graph Search query results. - [Create Graph Search query](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/graph-search/create-graph-search-query.md): Learn how to create Graph Search queries in Cortex Cloud. - [Graph Search examples](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/graph-search/graph-search-examples.md): Learn how to build Graph Search queries by working through a few examples. - [Manage the Graph Search Query Library](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/graph-search/manage-the-graph-search-query-library.md): Learn more about the Cortex Cloud Graph Search Query Library to manage your queries. - [Edit and run queries in Query Center](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/graph-search/edit-and-run-queries-in-query-center.md): Learn more about viewing the results of a query, modifying a query, and rerunning queries from Query Center. - [Query Center reference information](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/graph-search/edit-and-run-queries-in-query-center/query-center-reference-information.md): Descriptions of the fields in the Query Center table. - [FAQ on Graph Search](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/graph-search/faq-on-graph-search.md): Answer some frequently asked questions relating to Graph Search. - [Supported assets and findings](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/graph-search/supported-assets-and-findings.md): Review supported assets and findings in Cortex Cloud Posture Management Graph Search. - [Create detection rules based on graph search](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/graph-search/create-detection-rules-based-on-graph-search.md): Create detection rules in Cortex Cloud Posture Management from Graph Search queries. - [About API specification inventory](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/api-specification-inventory/api-specification-inventory.md): Learn about API specification inventory in Cortex Cloud Posture Management. - [Import API specification](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/api-specification-inventory/import-api-specification.md): Import API specifications into Cortex Cloud Posture Management. - [Learn how to a migrate a new Broker VM image](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/migrate-to-a-new-broker-vm-image/migrating-to-a-new-broker-vm-image.md): Learn more about migrating to the latest broker VM image in Cortex Cloud. - [Standalone Broker VM](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/migrate-to-a-new-broker-vm-image/standalone-broker-vm.md): Learn more about migrating a standalone broker VM image. - [Broker VM high availability cluster node](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/migrate-to-a-new-broker-vm-image/broker-vm-high-availability-cluster-node.md): Learn more about migrating a broker VM High Availability (HA) cluster node. ## Kubernetes Security - [Kubernetes Security](https://cortex-docs.paloaltonetworks.com/kubernetes-security/kubernetes-security.md) - [What's new in Kubernetes Connector?](https://cortex-docs.paloaltonetworks.com/kubernetes-security/whats-new-in-kubernetes-connector.md) - [KSPM limitations and system components](https://cortex-docs.paloaltonetworks.com/kubernetes-security/kspm-limitations-and-system-components.md) - [Configure Kubernetes Connector resource limits](https://cortex-docs.paloaltonetworks.com/kubernetes-security/kspm-limitations-and-system-components/configure-kubernetes-connector-resource-limits.md) - [Supported Kubernetes distributions](https://cortex-docs.paloaltonetworks.com/kubernetes-security/supported-kubernetes-distributions.md) - [Onboard the Kubernetes Connector](https://cortex-docs.paloaltonetworks.com/kubernetes-security/onboard-the-kubernetes-connector.md) - [OpenShift container registry](https://cortex-docs.paloaltonetworks.com/kubernetes-security/onboard-the-kubernetes-connector/openshift-container-registry.md) - [Deploy the Kubernetes Connector via GitOps](https://cortex-docs.paloaltonetworks.com/kubernetes-security/onboard-the-kubernetes-connector/deploy-the-kubernetes-connector-via-gitops.md) - [Repository architecture and tenant management](https://cortex-docs.paloaltonetworks.com/kubernetes-security/onboard-the-kubernetes-connector/deploy-the-kubernetes-connector-via-gitops/repository-architecture-and-tenant-management.md) - [Deploy with Flux CD](https://cortex-docs.paloaltonetworks.com/kubernetes-security/onboard-the-kubernetes-connector/deploy-the-kubernetes-connector-via-gitops/deploy-with-flux-cd.md) - [Deploy with ArgoCD](https://cortex-docs.paloaltonetworks.com/kubernetes-security/onboard-the-kubernetes-connector/deploy-the-kubernetes-connector-via-gitops/deploy-with-argocd.md) - [Mirror connector images to a private registry](https://cortex-docs.paloaltonetworks.com/kubernetes-security/mirror-connector-images-to-a-private-registry.md) - [Use kcli to mirror connector images](https://cortex-docs.paloaltonetworks.com/kubernetes-security/mirror-connector-images-to-a-private-registry/use-kcli-to-mirror-connector-images.md) - [KSPM dashboard](https://cortex-docs.paloaltonetworks.com/kubernetes-security/kspm-dashboard.md) - [KSPM graph](https://cortex-docs.paloaltonetworks.com/kubernetes-security/kspm-graph.md) - [Asset detail card](https://cortex-docs.paloaltonetworks.com/kubernetes-security/kspm-graph/asset-detail-card.md) - [Security finding categories](https://cortex-docs.paloaltonetworks.com/kubernetes-security/kspm-graph/security-finding-categories.md) - [Kubernetes clusters](https://cortex-docs.paloaltonetworks.com/kubernetes-security/kubernetes-clusters.md) - [Agentless Kubernetes security](https://cortex-docs.paloaltonetworks.com/kubernetes-security/agentless-kubernetes-security.md) - [Kubernetes Resources Inventory](https://cortex-docs.paloaltonetworks.com/kubernetes-security/kubernetes-resources-inventory.md) - [Kubernetes pods](https://cortex-docs.paloaltonetworks.com/kubernetes-security/kubernetes-resources-inventory/kubernetes-pods.md) - [Manage Kubernetes Connector instances](https://cortex-docs.paloaltonetworks.com/kubernetes-security/manage-kubernetes-connector-instances.md): You can manage the Kubernetes Connector instances on the Data Sources & Integrations page. You can check the status, edit, or delete Kubernetes Connector instances. - [Run an on-demand Kubernetes cluster scan](https://cortex-docs.paloaltonetworks.com/kubernetes-security/manage-kubernetes-connector-instances/run-an-on-demand-kubernetes-cluster-scan.md): Request an Inventory or Nodes and containers scan for an eligible Kubernetes cluster. - [Cloud workload policies and rules](https://cortex-docs.paloaltonetworks.com/kubernetes-security/cloud-workload-policies-and-rules.md) - [How policies and rules work together](https://cortex-docs.paloaltonetworks.com/kubernetes-security/cloud-workload-policies-and-rules/how-policies-and-rules-work-together.md) - [Cloud workload policies](https://cortex-docs.paloaltonetworks.com/kubernetes-security/cloud-workload-policies-and-rules/cloud-workload-policies.md) - [Types of cloud workload policies](https://cortex-docs.paloaltonetworks.com/kubernetes-security/cloud-workload-policies-and-rules/cloud-workload-policies/types-of-cloud-workload-policies.md) - [Trusted image cloud workload policies](https://cortex-docs.paloaltonetworks.com/kubernetes-security/cloud-workload-policies-and-rules/cloud-workload-policies/types-of-cloud-workload-policies/trusted-image-cloud-workload-policies.md) - [Cloud workload policies page](https://cortex-docs.paloaltonetworks.com/kubernetes-security/cloud-workload-policies-and-rules/cloud-workload-policies/cloud-workload-policies-page.md) - [Widgets panel](https://cortex-docs.paloaltonetworks.com/kubernetes-security/cloud-workload-policies-and-rules/cloud-workload-policies/cloud-workload-policies-page/widgets-panel.md) - [Change the layout of the policies table](https://cortex-docs.paloaltonetworks.com/kubernetes-security/cloud-workload-policies-and-rules/cloud-workload-policies/cloud-workload-policies-page/change-the-layout-of-the-policies-table.md) - [Policy details panel](https://cortex-docs.paloaltonetworks.com/kubernetes-security/cloud-workload-policies-and-rules/cloud-workload-policies/cloud-workload-policies-page/policy-details-panel.md) - [Manage cloud workload policies](https://cortex-docs.paloaltonetworks.com/kubernetes-security/cloud-workload-policies-and-rules/cloud-workload-policies/manage-cloud-workload-policies.md): Create, copy, edit, enable, disable, and delete cloud workload policies. - [Cloud workload preventive action](https://cortex-docs.paloaltonetworks.com/kubernetes-security/cloud-workload-policies-and-rules/cloud-workload-policies/cloud-workload-preventive-action.md) - [Cloud workload rules](https://cortex-docs.paloaltonetworks.com/kubernetes-security/cloud-workload-policies-and-rules/cloud-workload-rules.md) - [Default (pre-defined) rules](https://cortex-docs.paloaltonetworks.com/kubernetes-security/cloud-workload-policies-and-rules/cloud-workload-rules/default-pre-defined-rules.md) - [Custom (user-defined) rules](https://cortex-docs.paloaltonetworks.com/kubernetes-security/cloud-workload-policies-and-rules/cloud-workload-rules/custom-user-defined-rules.md) - [Cloud workload rules page](https://cortex-docs.paloaltonetworks.com/kubernetes-security/cloud-workload-policies-and-rules/cloud-workload-rules/cloud-workload-rules-page.md) - [Filter page results](https://cortex-docs.paloaltonetworks.com/kubernetes-security/cloud-workload-policies-and-rules/cloud-workload-rules/cloud-workload-rules-page/filter-page-results.md) - [Change the layout of the rules table](https://cortex-docs.paloaltonetworks.com/kubernetes-security/cloud-workload-policies-and-rules/cloud-workload-rules/cloud-workload-rules-page/change-the-layout-of-the-rules-table.md) - [Rule details panel](https://cortex-docs.paloaltonetworks.com/kubernetes-security/cloud-workload-policies-and-rules/cloud-workload-rules/cloud-workload-rules-page/rule-details-panel.md) - [Create a new custom detection rule](https://cortex-docs.paloaltonetworks.com/kubernetes-security/cloud-workload-policies-and-rules/cloud-workload-rules/create-a-new-custom-detection-rule.md): Create scanner-specific custom detection rules for Cloud Workload. - [Use an existing rule to create a new custom detection rule](https://cortex-docs.paloaltonetworks.com/kubernetes-security/cloud-workload-policies-and-rules/cloud-workload-rules/use-an-existing-rule-to-create-a-new-custom-detection-rule.md) - [Edit a custom detection rule](https://cortex-docs.paloaltonetworks.com/kubernetes-security/cloud-workload-policies-and-rules/cloud-workload-rules/edit-a-custom-detection-rule.md) - [Delete a custom detection rule](https://cortex-docs.paloaltonetworks.com/kubernetes-security/cloud-workload-policies-and-rules/cloud-workload-rules/delete-a-custom-detection-rule.md) ## Application Security - [Cortex Cloud Application Security](https://cortex-docs.paloaltonetworks.com/application-security/application-security/readme.md) - [Onboard data sources](https://cortex-docs.paloaltonetworks.com/application-security/application-security/onboard-data-sources.md): Onboard VCS, integrate CI tools, registries and ingest third-party data for a comprehensive view of your application and supply chain security. - [Onboard version control systems](https://cortex-docs.paloaltonetworks.com/application-security/application-security/onboard-data-sources/onboard-version-control-systems.md) - [AWS CodeCommit](https://cortex-docs.paloaltonetworks.com/application-security/application-security/onboard-data-sources/onboard-version-control-systems/aws-codecommit.md) - [Onboard AWS CodeCommit](https://cortex-docs.paloaltonetworks.com/application-security/application-security/onboard-data-sources/onboard-version-control-systems/aws-codecommit/onboard-aws-codecommit.md): Connect AWS CodeCommit repositories to Cortex Cloud and manage the integration. - [Reference A: IAM Service Role permissions](https://cortex-docs.paloaltonetworks.com/application-security/application-security/onboard-data-sources/onboard-version-control-systems/aws-codecommit/reference-a-iam-service-role-permissions.md): AWS CodeCommit permissions configured by the CloudFormation integration template - [Azure DevOps](https://cortex-docs.paloaltonetworks.com/application-security/application-security/onboard-data-sources/onboard-version-control-systems/azure-devops.md) - [Onboard Azure DevOps](https://cortex-docs.paloaltonetworks.com/application-security/application-security/onboard-data-sources/onboard-version-control-systems/azure-devops/onboard-azure-devops.md): Connect Azure DevOps repositories to Cortex Cloud and manage the integration. - [Reference A: Subscribed events and permission scopes](https://cortex-docs.paloaltonetworks.com/application-security/application-security/onboard-data-sources/onboard-version-control-systems/azure-devops/reference-a-subscribed-events-and-permission-scopes.md) - [Reference B: Instance-scope troubleshooting](https://cortex-docs.paloaltonetworks.com/application-security/application-security/onboard-data-sources/onboard-version-control-systems/azure-devops/reference-b-instance-scope-troubleshooting.md) - [Reference C: Repository-scope troubleshooting](https://cortex-docs.paloaltonetworks.com/application-security/application-security/onboard-data-sources/onboard-version-control-systems/azure-devops/reference-c-repository-scope-troubleshooting.md) - [Reference D: Azure DevOps onboarding system architecture](https://cortex-docs.paloaltonetworks.com/application-security/application-security/onboard-data-sources/onboard-version-control-systems/azure-devops/reference-d-azure-devops-onboarding-system-architecture.md) - [Bitbucket Cloud](https://cortex-docs.paloaltonetworks.com/application-security/application-security/onboard-data-sources/onboard-version-control-systems/bitbucket-cloud.md): Integrate Bitbucket Cloud to scan for secrets, IaC misconfigurations, vulnerabilities, and license compliance to strengthen your VCS security posture. - [Reference A: Authorization scopes and subscribed events](https://cortex-docs.paloaltonetworks.com/application-security/application-security/onboard-data-sources/onboard-version-control-systems/bitbucket-cloud/authorization-scopes-and-event-architecture.md): Review the OAuth scopes and Bitbucket Cloud events required for the integration. - [Bitbucket Data Center](https://cortex-docs.paloaltonetworks.com/application-security/application-security/onboard-data-sources/onboard-version-control-systems/bitbucket-data-center.md) - [Onboard Bitbucket Data Center](https://cortex-docs.paloaltonetworks.com/application-security/application-security/onboard-data-sources/onboard-version-control-systems/bitbucket-data-center/onboard-bitbucket-data-center.md): Connect Bitbucket Data Center to Cortex Cloud Application Security. - [Reference C: Bitbucket Data Center events](https://cortex-docs.paloaltonetworks.com/application-security/application-security/onboard-data-sources/onboard-version-control-systems/bitbucket-data-center/reference-c-bitbucket-data-center-events.md): Events Cortex Cloud subscribes to for Bitbucket Data Center. - [Reference B: Rotate Bitbucket Data Center tokens](https://cortex-docs.paloaltonetworks.com/application-security/application-security/onboard-data-sources/onboard-version-control-systems/bitbucket-data-center/reference-b-rotate-bitbucket-data-center-tokens.md): Rotate the PAT used by a Bitbucket Data Center integration. - [Reference A: Create a Bitbucket Data Center PAT](https://cortex-docs.paloaltonetworks.com/application-security/application-security/onboard-data-sources/onboard-version-control-systems/bitbucket-data-center/reference-a-create-a-bitbucket-data-center-pat.md): Create a Personal Access Token for Bitbucket Data Center integration. - [GitHub SaaS](https://cortex-docs.paloaltonetworks.com/application-security/application-security/onboard-data-sources/onboard-version-control-systems/github-cloud.md) - [Onboard the shared Cortex GitHub App](https://cortex-docs.paloaltonetworks.com/application-security/application-security/onboard-data-sources/onboard-version-control-systems/github-cloud/onboard-a-cortex-github-app.md) - [Onboard a new customer-owned GitHub App](https://cortex-docs.paloaltonetworks.com/application-security/application-security/onboard-data-sources/onboard-version-control-systems/github-cloud/onboard-a-new-customer-owned-github-app.md) - [Onboard an existing Customer-Owned GitHub App](https://cortex-docs.paloaltonetworks.com/application-security/application-security/onboard-data-sources/onboard-version-control-systems/github-cloud/reuse-an-existing-customer-owned-github-app.md) - [Verify and manage VCS integrations.](https://cortex-docs.paloaltonetworks.com/application-security/application-security/onboard-data-sources/onboard-version-control-systems/github-cloud/post-onboarding-management-and-verification.md) - [Reference A: Shared Cortex GitHub App permissions](https://cortex-docs.paloaltonetworks.com/application-security/application-security/onboard-data-sources/onboard-version-control-systems/github-cloud/reference-a-shared-cortex-github-app-permissions.md) - [Reference B: Customer Owned GitHub App permissions](https://cortex-docs.paloaltonetworks.com/application-security/application-security/onboard-data-sources/onboard-version-control-systems/github-cloud/reference-b-customer-owned-github-app-permissions.md) - [Reference C: Feature permission requirements](https://cortex-docs.paloaltonetworks.com/application-security/application-security/onboard-data-sources/onboard-version-control-systems/github-cloud/reference-c-feature-permission-requirements.md) - [Reference D: Ownership model comparison](https://cortex-docs.paloaltonetworks.com/application-security/application-security/onboard-data-sources/onboard-version-control-systems/github-cloud/reference-d-ownership-model-comparison.md) - [Reference E: Subscribed GitHub events](https://cortex-docs.paloaltonetworks.com/application-security/application-security/onboard-data-sources/onboard-version-control-systems/github-cloud/reference-e-subscribed-github-events.md) - [GitHub Enterprise (On-Prem)](https://cortex-docs.paloaltonetworks.com/application-security/application-security/onboard-data-sources/onboard-version-control-systems/github-enterprise-on-prem.md) - [Onboard GitHub Enterprise (On-Prem)](https://cortex-docs.paloaltonetworks.com/application-security/application-security/onboard-data-sources/onboard-version-control-systems/github-enterprise-on-prem/onboard-github-enterprise-on-prem.md): Connect GitHub Enterprise Server repositories to Cortex Cloud. - [Reference A: GitHub Enterprise OAuth scopes](https://cortex-docs.paloaltonetworks.com/application-security/application-security/onboard-data-sources/onboard-version-control-systems/github-enterprise-on-prem/reference-a-github-enterprise-oauth-scopes.md): OAuth scopes required for GitHub Enterprise Server onboarding. - [Reference B: Egress proxy IP addresses](https://cortex-docs.paloaltonetworks.com/application-security/application-security/onboard-data-sources/onboard-version-control-systems/github-enterprise-on-prem/reference-b-egress-proxy-ip-addresses.md): Egress proxy IP addresses for GitHub Enterprise Server allow lists. - [Reference C: GitHub Enterprise subscribed events](https://cortex-docs.paloaltonetworks.com/application-security/application-security/onboard-data-sources/onboard-version-control-systems/github-enterprise-on-prem/reference-c-github-enterprise-subscribed-events.md): Events Cortex Cloud monitors for GitHub Enterprise Server. - [GitLab SaaS](https://cortex-docs.paloaltonetworks.com/application-security/application-security/onboard-data-sources/onboard-version-control-systems/gitlab-saas.md) - [Reference A: Subscribed events](https://cortex-docs.paloaltonetworks.com/application-security/application-security/onboard-data-sources/onboard-version-control-systems/gitlab-saas/reference-a-subscribed-events.md): Events Cortex Cloud subscribes to for GitLab SaaS. - [GitLab Self Managed (On-Prem)](https://cortex-docs.paloaltonetworks.com/application-security/application-security/onboard-data-sources/onboard-version-control-systems/gitlab-self-managed-on-prem.md) - [Onboard CI/CD systems](https://cortex-docs.paloaltonetworks.com/application-security/application-security/onboard-data-sources/onboard-cicd-systems.md) - [CircleCI for CI/CD pipeline scans](https://cortex-docs.paloaltonetworks.com/application-security/application-security/onboard-data-sources/onboard-cicd-systems/circleci-for-cicd-pipeline-scans.md) - [Jenkins for CI/CD pipeline scans](https://cortex-docs.paloaltonetworks.com/application-security/application-security/onboard-data-sources/onboard-cicd-systems/jenkins-for-cicd-pipeline-scans.md) - [Integrate CI tools](https://cortex-docs.paloaltonetworks.com/application-security/application-security/onboard-data-sources/integrate-ci-tools.md) - [AWS CodeBuild](https://cortex-docs.paloaltonetworks.com/application-security/application-security/onboard-data-sources/integrate-ci-tools/aws-codebuild.md) - [AWS CodeBuild code scan workflow template](https://cortex-docs.paloaltonetworks.com/application-security/application-security/onboard-data-sources/integrate-ci-tools/aws-codebuild/aws-codebuild-code-scan-workflow-template.md): Configure Cortex CLI code scanning in an AWS CodeBuild buildspec. - [CircleCI for code scans](https://cortex-docs.paloaltonetworks.com/application-security/application-security/onboard-data-sources/integrate-ci-tools/circleci-for-code-scans.md) - [CircleCI code scan workflow template](https://cortex-docs.paloaltonetworks.com/application-security/application-security/onboard-data-sources/integrate-ci-tools/circleci-for-code-scans/circleci-code-scan-workflow-template.md): Configure Cortex CLI code scanning in a CircleCI workflow. - [Cortex CLI](https://cortex-docs.paloaltonetworks.com/application-security/application-security/onboard-data-sources/integrate-ci-tools/connect-cortex-cli.md) - [GitHub Actions](https://cortex-docs.paloaltonetworks.com/application-security/application-security/onboard-data-sources/integrate-ci-tools/github-actions.md) - [GitHub Actions code scan workflow template](https://cortex-docs.paloaltonetworks.com/application-security/application-security/onboard-data-sources/integrate-ci-tools/github-actions/github-actions-code-scan-workflow-template.md): Configure Cortex CLI code scanning in a GitHub Actions workflow. - [Jenkins for code scans](https://cortex-docs.paloaltonetworks.com/application-security/application-security/onboard-data-sources/integrate-ci-tools/jenkins-for-code-scans.md) - [Reference A: Jenkins code scan workflow template without checkout](https://cortex-docs.paloaltonetworks.com/application-security/application-security/onboard-data-sources/integrate-ci-tools/jenkins-for-code-scans/reference-a-jenkins-code-scan-workflow-template-without-checkout.md): Configure a Jenkins code scan workflow without repository checkout. - [Reference B: Jenkins code scan workflow template with checkout](https://cortex-docs.paloaltonetworks.com/application-security/application-security/onboard-data-sources/integrate-ci-tools/jenkins-for-code-scans/reference-b-jenkins-code-scan-workflow-template-with-checkout.md): Configure a Jenkins code scan workflow with repository checkout. - [Terraform Cloud (Run Tasks)](https://cortex-docs.paloaltonetworks.com/application-security/application-security/onboard-data-sources/integrate-ci-tools/terraform-cloud-run-tasks.md) - [Terraform workflow for Run Tasks enforcement](https://cortex-docs.paloaltonetworks.com/application-security/application-security/onboard-data-sources/integrate-ci-tools/terraform-cloud-run-tasks/terraform-workflow-for-run-tasks-enforcement.md): Configure policy-based Terraform Run Tasks enforcement. - [Terraform Enterprise (Run Tasks)](https://cortex-docs.paloaltonetworks.com/application-security/application-security/onboard-data-sources/integrate-ci-tools/terraform-enterprise-run-tasks.md) - [Terraform workflow for Run Tasks enforcement](https://cortex-docs.paloaltonetworks.com/application-security/application-security/onboard-data-sources/integrate-ci-tools/terraform-enterprise-run-tasks/terraform-workflow-for-run-tasks-enforcement.md): Configure policy-based Terraform Run Tasks enforcement. - [CLI pipeline code snippets](https://cortex-docs.paloaltonetworks.com/application-security/application-security/onboard-data-sources/cli-pipeline-code-snippets.md): Add Cortex CLI code scans to supported CI/CD pipelines. - [AWS CodeBuild](https://cortex-docs.paloaltonetworks.com/application-security/application-security/onboard-data-sources/cli-pipeline-code-snippets/aws-codebuild.md): Configure Cortex CLI code scanning in AWS CodeBuild. - [Azure Pipelines](https://cortex-docs.paloaltonetworks.com/application-security/application-security/onboard-data-sources/cli-pipeline-code-snippets/azure-pipelines.md): Configure Cortex CLI code scanning in Azure Pipelines. - [Bitbucket](https://cortex-docs.paloaltonetworks.com/application-security/application-security/onboard-data-sources/cli-pipeline-code-snippets/bitbucket.md): Configure Cortex CLI code scanning in Bitbucket Pipelines. - [CircleCI](https://cortex-docs.paloaltonetworks.com/application-security/application-security/onboard-data-sources/cli-pipeline-code-snippets/circleci.md): Configure Cortex CLI code scanning in CircleCI. - [GitHub Actions](https://cortex-docs.paloaltonetworks.com/application-security/application-security/onboard-data-sources/cli-pipeline-code-snippets/github-actions.md): Configure Cortex CLI code scanning in GitHub Actions. - [GitLab Runner](https://cortex-docs.paloaltonetworks.com/application-security/application-security/onboard-data-sources/cli-pipeline-code-snippets/gitlab-runner.md): Configure Cortex CLI code scanning in GitLab Runner. - [Jenkins](https://cortex-docs.paloaltonetworks.com/application-security/application-security/onboard-data-sources/cli-pipeline-code-snippets/jenkins.md): Configure Cortex CLI code scanning in Jenkins. - [Onboard private package registries](https://cortex-docs.paloaltonetworks.com/application-security/application-security/onboard-data-sources/onboard-private-package-registries.md) - [JFrog Artifactory](https://cortex-docs.paloaltonetworks.com/application-security/application-security/onboard-data-sources/onboard-private-package-registries/jfrog-artifactory.md) - [Onboard JFrog Artifactory](https://cortex-docs.paloaltonetworks.com/application-security/application-security/onboard-data-sources/onboard-private-package-registries/onboard-jfrog-artifactory.md) - [Ingest third-party data sources](https://cortex-docs.paloaltonetworks.com/application-security/application-security/onboard-data-sources/ingest-third-party-data-sources.md): Centralize findings from supported third-party or SARIF-compatible scanners into Cortex Cloud. Unified triage, Urgency-based priority, and policy enforcement in one view. - [Checkmarx](https://cortex-docs.paloaltonetworks.com/application-security/application-security/onboard-data-sources/ingest-third-party-data-sources/checkmarx.md) - [Configure Checkmarx One ingestion](https://cortex-docs.paloaltonetworks.com/application-security/application-security/onboard-data-sources/ingest-third-party-data-sources/checkmarx/tenant-ui-workflow.md) - [Reference A: Checkmarx troubleshooting](https://cortex-docs.paloaltonetworks.com/application-security/application-security/onboard-data-sources/ingest-third-party-data-sources/checkmarx/troubleshooting.md) - [Reference B: Checkmarx frequently asked questions](https://cortex-docs.paloaltonetworks.com/application-security/application-security/onboard-data-sources/ingest-third-party-data-sources/checkmarx/frequently-asked-questions.md) - [Semgrep](https://cortex-docs.paloaltonetworks.com/application-security/application-security/onboard-data-sources/ingest-third-party-data-sources/semgrep.md): Cortex Cloud AppSec integrates with Semgrep to ingest SCA and SAST findings into the unified AppSec data model. - [Configure Semgrep ingestion](https://cortex-docs.paloaltonetworks.com/application-security/application-security/onboard-data-sources/ingest-third-party-data-sources/semgrep/configure-semgrep-ingestion.md): Connect Semgrep to Cortex Cloud, select findings, and manage the integration. - [Snyk](https://cortex-docs.paloaltonetworks.com/application-security/application-security/onboard-data-sources/ingest-third-party-data-sources/snyk.md): Configure the Snyk integration to ingest SAST and SCA vulnerability findings into Cortex Cloud, unifying your software package assets and security code. - [Configure Snyk ingestion](https://cortex-docs.paloaltonetworks.com/application-security/application-security/onboard-data-sources/ingest-third-party-data-sources/snyk/configure-snyk-ingestion.md): Connect Snyk to Cortex Cloud, select findings, and manage the integration. - [SonarQube](https://cortex-docs.paloaltonetworks.com/application-security/application-security/onboard-data-sources/ingest-third-party-data-sources/sonarqube.md) - [Configure SonarQube ingestion](https://cortex-docs.paloaltonetworks.com/application-security/application-security/onboard-data-sources/ingest-third-party-data-sources/sonarqube/onboard-via-tenant-ui.md) - [Troubleshoot SonarQube integrations](https://cortex-docs.paloaltonetworks.com/application-security/application-security/onboard-data-sources/ingest-third-party-data-sources/sonarqube/troubleshoot.md) - [Veracode](https://cortex-docs.paloaltonetworks.com/application-security/application-security/onboard-data-sources/ingest-third-party-data-sources/veracode.md) - [Generic 3rd Party AppSec Collector](https://cortex-docs.paloaltonetworks.com/application-security/application-security/onboard-data-sources/ingest-third-party-data-sources/generic-3rd-party-appsec-collector.md): Streamline security by ingesting SARIF findings from any tool into Cortex Cloud. Achieve unified visibility and risk-based prioritization for all AppSec scans. - [Configure the Generic 3rd Party AppSec Collector](https://cortex-docs.paloaltonetworks.com/application-security/application-security/onboard-data-sources/ingest-third-party-data-sources/generic-3rd-party-appsec-collector/tenant-console-workflow.md) - [Upload findings from CI/CD pipelines](https://cortex-docs.paloaltonetworks.com/application-security/application-security/onboard-data-sources/ingest-third-party-data-sources/generic-3rd-party-appsec-collector/upload-findings-from-ci-cd-pipelines.md) - [Troubleshooting](https://cortex-docs.paloaltonetworks.com/application-security/application-security/onboard-data-sources/ingest-third-party-data-sources/generic-3rd-party-appsec-collector/troubleshooting.md) - [References](https://cortex-docs.paloaltonetworks.com/application-security/application-security/onboard-data-sources/ingest-third-party-data-sources/generic-3rd-party-appsec-collector/references.md) - [Reference A: System requirements](https://cortex-docs.paloaltonetworks.com/application-security/application-security/onboard-data-sources/ingest-third-party-data-sources/generic-3rd-party-appsec-collector/references/technical-requirements-and-sarif-specifications.md): Review system requirements before uploading SARIF findings. - [Reference B: SARIF format and mapping](https://cortex-docs.paloaltonetworks.com/application-security/application-security/onboard-data-sources/ingest-third-party-data-sources/generic-3rd-party-appsec-collector/references/reference-b-sarif-format-and-mapping.md): Required and optional SARIF fields for collector uploads. - [Reference C: Severity mapping](https://cortex-docs.paloaltonetworks.com/application-security/application-security/onboard-data-sources/ingest-third-party-data-sources/generic-3rd-party-appsec-collector/references/reference-c-severity-mapping.md): How SARIF severity levels map to Cortex Cloud severity values. - [Reference D: Repository mapping](https://cortex-docs.paloaltonetworks.com/application-security/application-security/onboard-data-sources/ingest-third-party-data-sources/generic-3rd-party-appsec-collector/references/reference-d-repository-mapping.md): Map uploaded SARIF findings to Cortex Cloud repository assets. - [Reference E: Validation statuses](https://cortex-docs.paloaltonetworks.com/application-security/application-security/onboard-data-sources/ingest-third-party-data-sources/generic-3rd-party-appsec-collector/references/reference-e-validation-statuses.md): Interpret SARIF validation results before uploading findings. - [Third-party integrations lifecycle administration and automation](https://cortex-docs.paloaltonetworks.com/application-security/application-security/onboard-data-sources/ingest-third-party-data-sources/third-party-integrations-lifecycle-administration-and-automation.md) - [Reference A: Programmatic automation and key rotation](https://cortex-docs.paloaltonetworks.com/application-security/application-security/onboard-data-sources/ingest-third-party-data-sources/third-party-integrations-lifecycle-administration-and-automation/reference-a-programmatic-automation-and-key-rotation.md): Reference for third-party integration API operations. - [Reference B: GitOps and infrastructure-as-code (IaC)](https://cortex-docs.paloaltonetworks.com/application-security/application-security/onboard-data-sources/ingest-third-party-data-sources/third-party-integrations-lifecycle-administration-and-automation/reference-b-gitops-and-infrastructure-as-code-iac.md) - [Transporter over Broker VM](https://cortex-docs.paloaltonetworks.com/application-security/application-security/onboard-data-sources/transporter-over-broker-vm.md): Transporter over Broker VM sets up a secure communication channel between your VCS and Cortex. - [Set up a Transporter applet on Broker VM](https://cortex-docs.paloaltonetworks.com/application-security/application-security/onboard-data-sources/transporter-over-broker-vm/set-up-a-transporter-applet-on-broker-vm.md): Setup a Transporter applet on Broker VM. - [Set up a Transporter on your VCS](https://cortex-docs.paloaltonetworks.com/application-security/application-security/onboard-data-sources/transporter-over-broker-vm/set-up-a-transporter-on-your-vcs.md): Setup a Transporter on your version control system. - [Manage integrations via data source APIs](https://cortex-docs.paloaltonetworks.com/application-security/application-security/onboard-data-sources/manage-integrations-via-data-source-apis.md) - [Application Security dashboard](https://cortex-docs.paloaltonetworks.com/application-security/application-security/cortex-cloud-application-security-dashboard.md): Monitor and analyze your Application Security posture with the Application Security dashboard. - [AppSec Objectives with Agentix](https://cortex-docs.paloaltonetworks.com/application-security/application-security/appsec-objectives-with-agentix.md) - [Track objectives](https://cortex-docs.paloaltonetworks.com/application-security/application-security/appsec-objectives-with-agentix/track-objectives.md) - [Vulnerability objectives](https://cortex-docs.paloaltonetworks.com/application-security/application-security/appsec-objectives-with-agentix/vulnerability-objectives.md) - [References](https://cortex-docs.paloaltonetworks.com/application-security/application-security/appsec-objectives-with-agentix/references.md) - [Reference A: Objective scope filters](https://cortex-docs.paloaltonetworks.com/application-security/application-security/appsec-objectives-with-agentix/references/reference-a-objective-scope-filters.md) - [Reference B: Objective condition filters](https://cortex-docs.paloaltonetworks.com/application-security/application-security/appsec-objectives-with-agentix/references/reference-b-objective-condition-filters.md) - [Reference C: Metric calculations](https://cortex-docs.paloaltonetworks.com/application-security/application-security/appsec-objectives-with-agentix/references/reference-c-metric-calculations.md) - [Code-to-Cloud](https://cortex-docs.paloaltonetworks.com/application-security/code-to-cloud/code-to-cloud.md) - [How the C2C engine works](https://cortex-docs.paloaltonetworks.com/application-security/code-to-cloud/code-to-cloud/how-the-c2c-engine-works.md) - [Identify and investigate gap](https://cortex-docs.paloaltonetworks.com/application-security/code-to-cloud/code-to-cloud/identify-and-investigate-gap.md) - [Execute remediation workflows](https://cortex-docs.paloaltonetworks.com/application-security/code-to-cloud/code-to-cloud/execute-remediation-workflows.md) - [The Coverage dashboard](https://cortex-docs.paloaltonetworks.com/application-security/code-to-cloud/code-to-cloud/the-coverage-dashboard.md) - [C2C in the UAI](https://cortex-docs.paloaltonetworks.com/application-security/code-to-cloud/code-to-cloud/c2c-in-the-uai.md) - [Reference A: Lineage filtering matrix](https://cortex-docs.paloaltonetworks.com/application-security/code-to-cloud/code-to-cloud/c2c-in-the-uai/reference-a-lineage-filtering-matrix.md) - [Reference B: Essential filtering rules](https://cortex-docs.paloaltonetworks.com/application-security/code-to-cloud/code-to-cloud/c2c-in-the-uai/reference-b-essential-filtering-rules.md) - [Reference C: Technical background](https://cortex-docs.paloaltonetworks.com/application-security/code-to-cloud/code-to-cloud/c2c-in-the-uai/reference-c-technical-background.md) - [C2C tab (asset level)](https://cortex-docs.paloaltonetworks.com/application-security/code-to-cloud/code-to-cloud/c2c-tab-asset-level.md) - [C2C tab (app level)](https://cortex-docs.paloaltonetworks.com/application-security/code-to-cloud/code-to-cloud/c2c-tab-app-level.md) - [Agentix for C2C](https://cortex-docs.paloaltonetworks.com/application-security/code-to-cloud/code-to-cloud/agentix-for-c2c.md) - [Investigate issues with C2C](https://cortex-docs.paloaltonetworks.com/application-security/code-to-cloud/code-to-cloud/investigate-issues-with-c2c.md) - [C2C in ASPM Command Center](https://cortex-docs.paloaltonetworks.com/application-security/code-to-cloud/code-to-cloud/c2c-in-aspm-command-center.md) - [Enforce policies with C2C](https://cortex-docs.paloaltonetworks.com/application-security/code-to-cloud/code-to-cloud/enforce-policies-with-c2c.md) - [API endpoints for C2C](https://cortex-docs.paloaltonetworks.com/application-security/code-to-cloud/code-to-cloud/api-endpoints-for-c2c.md): Retrieve Code-to-Cloud coverage programmatically. - [Troubleshooting](https://cortex-docs.paloaltonetworks.com/application-security/code-to-cloud/code-to-cloud/troubleshooting.md) - [FAQs](https://cortex-docs.paloaltonetworks.com/application-security/code-to-cloud/code-to-cloud/faqs.md) - [References](https://cortex-docs.paloaltonetworks.com/application-security/code-to-cloud/code-to-cloud/references.md) - [Reference A: Supported integrations and asset stages](https://cortex-docs.paloaltonetworks.com/application-security/code-to-cloud/code-to-cloud/references/reference-a-supported-integrations-and-asset-stages.md) - [Reference B: Coverage % calculation and configuration toggles](https://cortex-docs.paloaltonetworks.com/application-security/code-to-cloud/code-to-cloud/references/reference-b-coverage-calculation-and-configuration-toggles.md) - [Reference C: Dashboard filters by view](https://cortex-docs.paloaltonetworks.com/application-security/code-to-cloud/code-to-cloud/references/reference-c-dashboard-filters-by-view.md) - [Reference D: Recommended actions by view and stage](https://cortex-docs.paloaltonetworks.com/application-security/code-to-cloud/code-to-cloud/references/reference-d-recommended-actions-by-view-and-stage.md) - [Reference E: Code-to-Cloud Coverage public API](https://cortex-docs.paloaltonetworks.com/application-security/code-to-cloud/code-to-cloud/references/reference-e-code-to-cloud-coverage-public-api.md) - [Page Reference F: Call-to-action routing by asset type1](https://cortex-docs.paloaltonetworks.com/application-security/code-to-cloud/code-to-cloud/references/page-reference-f-call-to-action-routing-by-asset-type1.md) - [What is Application Security Posture Management (ASPM)](https://cortex-docs.paloaltonetworks.com/application-security/application-security-posture-management-aspm/application-security-posture-management-aspm.md): ASPM centralizes AppSec monitoring across the SDLC. It aggregates findings from tools such as IaC and SCA to provide a holistic view and prioritize risks. - [Code-to-Cloud](https://cortex-docs.paloaltonetworks.com/application-security/application-security-posture-management-aspm/code-to-cloud.md): Code-to-Cloud context maps asset lineage across the SDLC. By connecting repos, pipelines, and infra, it provides end-to-end traceability from code to runtime. - [Core components and mechanisms](https://cortex-docs.paloaltonetworks.com/application-security/application-security-posture-management-aspm/code-to-cloud/core-components-and-mechanisms.md): Code-to-Cloud context maps asset lineage across the SDLC. By connecting repos, pipelines, and infra, it provides end-to-end traceability from code to runtime. - [Supported integrations](https://cortex-docs.paloaltonetworks.com/application-security/application-security-posture-management-aspm/code-to-cloud/supported-integrations.md) - [Code-to-Cloud context and visibility](https://cortex-docs.paloaltonetworks.com/application-security/application-security-posture-management-aspm/code-to-cloud/code-to-cloud-context-and-visibility.md): Manage security risk across the SDLC by tracing technical asset lineage. View asset dependencies and runtime context in assets, issues, and policies. - [Code to Cloud troubleshooting](https://cortex-docs.paloaltonetworks.com/application-security/application-security-posture-management-aspm/code-to-cloud/code-to-cloud-troubleshooting.md) - [ASPM Command Center](https://cortex-docs.paloaltonetworks.com/application-security/application-security-posture-management-aspm/aspm-command-center.md): The ASPM Command Center is your central hub for real-time application security posture management across the SDLC. It offers critical insights to identify risks, track compliance, and enable secure de - [Operational workflows](https://cortex-docs.paloaltonetworks.com/application-security/application-security-posture-management-aspm/aspm-command-center/operational-workflows.md) - [Business applications](https://cortex-docs.paloaltonetworks.com/application-security/application-security-posture-management-aspm/applications.md): Build and manage applications as holistic entities. Gain centralized visibility across the SDLC to monitor assets and remediate threats based on business risk. - [Define business applications by Criteria](https://cortex-docs.paloaltonetworks.com/application-security/application-security-posture-management-aspm/applications/defining-business-applications.md) - [Define applications by code Criteria](https://cortex-docs.paloaltonetworks.com/application-security/application-security-posture-management-aspm/applications/defining-business-applications/define-applications-by-code-criteria.md) - [Reference A: Code Criteria grouping and unification](https://cortex-docs.paloaltonetworks.com/application-security/application-security-posture-management-aspm/applications/defining-business-applications/define-applications-by-code-criteria/reference-a-code-criteria-grouping-and-unification.md): Understand Code Criteria grouping, scope filters, and application unification. - [Reference B: Code Criteria references and examples](https://cortex-docs.paloaltonetworks.com/application-security/application-security-posture-management-aspm/applications/defining-business-applications/define-applications-by-code-criteria/reference-b-code-criteria-references-and-examples.md): Examples and reference rules for Code Criteria grouping, unification, and scope. - [Define applications by cloud Criteria](https://cortex-docs.paloaltonetworks.com/application-security/application-security-posture-management-aspm/applications/defining-business-applications/define-applications-by-cloud-criteria.md) - [View and manage Criteria via the tenant (UI)](https://cortex-docs.paloaltonetworks.com/application-security/application-security-posture-management-aspm/applications/defining-business-applications/view-and-manage-criteria-via-the-tenant-ui.md) - [Manage Criteria via the public API](https://cortex-docs.paloaltonetworks.com/application-security/application-security-posture-management-aspm/applications/defining-business-applications/manage-criteria-via-the-public-api.md) - [Reference: Core concepts](https://cortex-docs.paloaltonetworks.com/application-security/application-security-posture-management-aspm/applications/defining-business-applications/reference-core-concepts.md): Reference details for Application Criteria types, evaluation, business context, and application scope. - [Manually build an application](https://cortex-docs.paloaltonetworks.com/application-security/application-security-posture-management-aspm/applications/manually-build-an-application.md) - [View and manage applications (UI)](https://cortex-docs.paloaltonetworks.com/application-security/application-security-posture-management-aspm/applications/application-management-and-visibility.md) - [Manage applications via public APIs](https://cortex-docs.paloaltonetworks.com/application-security/application-security-posture-management-aspm/applications/manage-applications-via-public-apis.md): Automate application lifecycle management by creating, updating, and deleting applications programmatically via the Cortex Cloud public API endpoints. - [Scope user access to applications (Application SBAC)](https://cortex-docs.paloaltonetworks.com/application-security/application-security-posture-management-aspm/applications/scope-user-access-to-applications-application-sbac.md) - [Business application assets](https://cortex-docs.paloaltonetworks.com/application-security/application-security-posture-management-aspm/applications/business-application-assets.md) - [Repository as an asset](https://cortex-docs.paloaltonetworks.com/application-security/application-security-posture-management-aspm/repository-as-an-asset.md) - [Manage repository assets through the tenant (UI)](https://cortex-docs.paloaltonetworks.com/application-security/application-security-posture-management-aspm/repository-as-an-asset/understanding-repository-assets-via-the-ui.md) - [Investigate repository assets](https://cortex-docs.paloaltonetworks.com/application-security/application-security-posture-management-aspm/repository-as-an-asset/understanding-repository-assets-via-the-ui/investigate-repository-assets.md) - [Reference: Repositories asset attributes](https://cortex-docs.paloaltonetworks.com/application-security/application-security-posture-management-aspm/repository-as-an-asset/understanding-repository-assets-via-the-ui/reference-repositories-asset-attributes.md) - [Manage repositories via API](https://cortex-docs.paloaltonetworks.com/application-security/application-security-posture-management-aspm/repository-as-an-asset/manage-repositories-via-api.md) - [Coverage](https://cortex-docs.paloaltonetworks.com/application-security/application-security-posture-management-aspm/coverage.md): The AppSec Coverage page provides centralized visibility into security scanner deployment across the SDLC. Monitor asset health, identify gaps, and orchestrate onboarding. - [Coverage in the tenant (UI)](https://cortex-docs.paloaltonetworks.com/application-security/application-security-posture-management-aspm/coverage/coverage-in-the-user-interface.md) - [Urgency](https://cortex-docs.paloaltonetworks.com/application-security/application-security-posture-management-aspm/urgency.md): Prioritize issues using Urgency, a context-aware risk score that dynamically evaluates runtime exposure, business impact, and protection status. - [Review Application Security posture and remediate issues by Urgency](https://cortex-docs.paloaltonetworks.com/application-security/application-security-posture-management-aspm/urgency/view-urgency-in-the-tenant.md) - [Understand Urgency and Code-to-Cloud traceability](https://cortex-docs.paloaltonetworks.com/application-security/application-security-posture-management-aspm/urgency/urgency-and-code-to-cloud-traceability.md) - [Understand Urgency metrics](https://cortex-docs.paloaltonetworks.com/application-security/application-security-posture-management-aspm/urgency/urgency-metrics.md) - [Scan issue types by Urgency level](https://cortex-docs.paloaltonetworks.com/application-security/application-security-posture-management-aspm/urgency/prioritize-issues-by-urgency-levels.md) - [Backlog baseline](https://cortex-docs.paloaltonetworks.com/application-security/application-security-posture-management-aspm/backlog-baseline.md): Backlog represents pre-existing code issues discovered by a scanner's first run or by new rules. - [Backlog use cases](https://cortex-docs.paloaltonetworks.com/application-security/application-security-posture-management-aspm/backlog-baseline/backlog-use-cases.md) - [Issue/Finding classification by scanner](https://cortex-docs.paloaltonetworks.com/application-security/application-security-posture-management-aspm/backlog-baseline/issuefinding-classification-by-scanner.md) - [Using Backlog](https://cortex-docs.paloaltonetworks.com/application-security/application-security-posture-management-aspm/backlog-baseline/using-backlog.md) - [Service Lead Agreements (SLA)](https://cortex-docs.paloaltonetworks.com/application-security/application-security-posture-management-aspm/service-lead-agreements-sla.md): Application Security SLA defines deadlines for fixing security issues based on severity, ensuring timely remediation and improving team performance. - [Configure and monitor Cortex Cloud Application Security SLAs](https://cortex-docs.paloaltonetworks.com/application-security/application-security-posture-management-aspm/service-lead-agreements-sla/configure-and-monitor-cortex-cloud-application-security-slas.md) - [Compliance for Cortex Cloud Application Security](https://cortex-docs.paloaltonetworks.com/application-security/application-security-posture-management-aspm/compliance-for-cortex-cloud-application-security.md) - [Monitor and track compliance adherence](https://cortex-docs.paloaltonetworks.com/application-security/application-security-posture-management-aspm/compliance-for-cortex-cloud-application-security/monitor-and-track-compliance-adherence.md) - [Infrastructure-as-Code (IaC) compliance](https://cortex-docs.paloaltonetworks.com/application-security/application-security-posture-management-aspm/compliance-for-cortex-cloud-application-security/infrastructure-as-code-iac-compliance.md) - [Manage IaC compliance](https://cortex-docs.paloaltonetworks.com/application-security/application-security-posture-management-aspm/compliance-for-cortex-cloud-application-security/manage-iac-compliance.md) - [CI/CD Compliance](https://cortex-docs.paloaltonetworks.com/application-security/application-security-posture-management-aspm/compliance-for-cortex-cloud-application-security/cicd-compliance.md): CI/CD compliance ensures adherence to industry standards: CIS GitLab/GitHub and OWASP Top 10. - [Terraform workflow for Compliance assessments](https://cortex-docs.paloaltonetworks.com/application-security/application-security-posture-management-aspm/compliance-for-cortex-cloud-application-security/terraform-workflow-for-compliance-assessments.md) - [Unified Application Security policies](https://cortex-docs.paloaltonetworks.com/application-security/application-security-posture-management-aspm/unified-application-security-policies.md): AppSec policies define threat responses by setting conditions, scope, and actions. Use out-of-the-box policies or clone them to create custom ones. - [Tenant (UI) workflow](https://cortex-docs.paloaltonetworks.com/application-security/application-security-posture-management-aspm/unified-application-security-policies/tenant-ui-workflow.md) - [Create a policy](https://cortex-docs.paloaltonetworks.com/application-security/application-security-posture-management-aspm/unified-application-security-policies/tenant-ui-workflow/create-a-policy.md) - [API workflow](https://cortex-docs.paloaltonetworks.com/application-security/application-security-posture-management-aspm/unified-application-security-policies/api-workflow.md) - [Cortex CLI workflow](https://cortex-docs.paloaltonetworks.com/application-security/application-security-posture-management-aspm/unified-application-security-policies/cortex-cli-workflow.md) - [IDE workflow](https://cortex-docs.paloaltonetworks.com/application-security/application-security-posture-management-aspm/unified-application-security-policies/ide-workflow.md) - [Terraform workflow](https://cortex-docs.paloaltonetworks.com/application-security/application-security-posture-management-aspm/unified-application-security-policies/terraform-workflow-for-policies.md) - [View and manage policy details](https://cortex-docs.paloaltonetworks.com/application-security/application-security-posture-management-aspm/unified-application-security-policies/view-and-manage-policy-details.md) - [References](https://cortex-docs.paloaltonetworks.com/application-security/application-security-posture-management-aspm/unified-application-security-policies/references.md) - [Reference: Core concepts](https://cortex-docs.paloaltonetworks.com/application-security/application-security-posture-management-aspm/unified-application-security-policies/references/core-concepts.md) - [Reference A: Finding type details](https://cortex-docs.paloaltonetworks.com/application-security/application-security-posture-management-aspm/unified-application-security-policies/references/reference-a-finding-type-details.md) - [Reference B: Condition filters and logic](https://cortex-docs.paloaltonetworks.com/application-security/application-security-posture-management-aspm/unified-application-security-policies/references/reference-b-condition-filters-and-logic.md) - [Reference C: Scope mapping details](https://cortex-docs.paloaltonetworks.com/application-security/application-security-posture-management-aspm/unified-application-security-policies/references/reference-c-scope-mapping-details.md) - [Reference D: Trigger and actions mapping](https://cortex-docs.paloaltonetworks.com/application-security/application-security-posture-management-aspm/unified-application-security-policies/references/reference-d-trigger-and-actions-mapping.md) - [Reference E: Grace period logic and configuration](https://cortex-docs.paloaltonetworks.com/application-security/application-security-posture-management-aspm/unified-application-security-policies/references/reference-e-grace-period-logic-and-configuration.md) - [Reference F: Engine evaluation and Urgency logic](https://cortex-docs.paloaltonetworks.com/application-security/application-security-posture-management-aspm/unified-application-security-policies/references/reference-f-engine-evaluation-and-urgency-logic.md) - [Reference G: Finding type to trigger mapping](https://cortex-docs.paloaltonetworks.com/application-security/application-security-posture-management-aspm/unified-application-security-policies/references/reference-g-finding-type-to-trigger-mapping.md) - [Reference H: Action availability by trigger](https://cortex-docs.paloaltonetworks.com/application-security/application-security-posture-management-aspm/unified-application-security-policies/references/reference-h-action-availability-by-trigger.md) - [Reference I: Audit logging](https://cortex-docs.paloaltonetworks.com/application-security/application-security-posture-management-aspm/unified-application-security-policies/references/reference-i-audit-logging.md) - [Application Security Rules](https://cortex-docs.paloaltonetworks.com/application-security/application-security-posture-management-aspm/application-security-rules.md): AppSec rules detect security threats using predefined criteria based on standard compliance frameworks and best practices. Custom rules are supported. - [Tenant (UI) workflow](https://cortex-docs.paloaltonetworks.com/application-security/application-security-posture-management-aspm/application-security-rules/tenant-ui-workflow.md): Manage Application Security rules through the Cortex Cloud tenant. - [Understand and investigate rules](https://cortex-docs.paloaltonetworks.com/application-security/application-security-posture-management-aspm/application-security-rules/tenant-ui-workflow/rules-inventory.md) - [Create custom Cortex Cloud Application Security rules](https://cortex-docs.paloaltonetworks.com/application-security/application-security-posture-management-aspm/application-security-rules/tenant-ui-workflow/create-custom-cortex-cloud-application-security-rules.md) - [Configure YAML file properties](https://cortex-docs.paloaltonetworks.com/application-security/application-security-posture-management-aspm/application-security-rules/tenant-ui-workflow/create-custom-cortex-cloud-application-security-rules/configure-yaml-file-properties.md) - [API workflows for rules](https://cortex-docs.paloaltonetworks.com/application-security/application-security-posture-management-aspm/application-security-rules/api-workflows-for-rules.md): Manage Application Security rule definitions through the public API. - [Terraform workflows for rules](https://cortex-docs.paloaltonetworks.com/application-security/application-security-posture-management-aspm/application-security-rules/terraform-workflows-for-rules.md) - [Manage custom rules](https://cortex-docs.paloaltonetworks.com/application-security/application-security-posture-management-aspm/application-security-rules/manage-custom-rules.md) - [Manage SAST code weakness issues](https://cortex-docs.paloaltonetworks.com/application-security/application-security-posture-management-aspm/manage-code-weakness-issues.md): Ingest third-party SAST findings to create actionable issues, enabling you to prioritize and track remediation and enhancing your security posture. - [Navigate to SAST code weakness issues](https://cortex-docs.paloaltonetworks.com/application-security/application-security-posture-management-aspm/manage-code-weakness-issues/navigate-to-sast-code-weakness-issues.md) - [Understand the Code Weaknesses table](https://cortex-docs.paloaltonetworks.com/application-security/application-security-posture-management-aspm/manage-code-weakness-issues/understand-the-code-weaknesses-table.md) - [Investigate and remediate code weakness issues](https://cortex-docs.paloaltonetworks.com/application-security/application-security-posture-management-aspm/manage-code-weakness-issues/investigate-and-remediate-code-weakness-issues.md) - [Code weakness findings](https://cortex-docs.paloaltonetworks.com/application-security/application-security-posture-management-aspm/manage-code-weakness-issues/code-weakness-findings.md) - [Manage the third-party data lifecycle](https://cortex-docs.paloaltonetworks.com/application-security/application-security-posture-management-aspm/manage-the-third-party-data-lifecycle.md) - [Software Supply Chain Security](https://cortex-docs.paloaltonetworks.com/application-security/software-supply-chain-security/software-supply-chain-security.md): Software supply chain security protects the integrity and trustworthiness of all components, tools, and processes across the SDLC to proactively prevent risk. - [Supply Chain Attacks](https://cortex-docs.paloaltonetworks.com/application-security/software-supply-chain-security/supply-chain-attacks.md) - [Tenant (UI) workflow](https://cortex-docs.paloaltonetworks.com/application-security/software-supply-chain-security/supply-chain-attacks/tenant-ui-workflow.md) - [CLI workflow](https://cortex-docs.paloaltonetworks.com/application-security/software-supply-chain-security/supply-chain-attacks/cli-workflow.md) - [Referenecs](https://cortex-docs.paloaltonetworks.com/application-security/software-supply-chain-security/supply-chain-attacks/referenecs.md) - [Reference A: Supply Chain Attacks filters](https://cortex-docs.paloaltonetworks.com/application-security/software-supply-chain-security/supply-chain-attacks/referenecs/reference-a-supply-chain-attacks-filters.md) - [Reference B: Exposure determination matrix](https://cortex-docs.paloaltonetworks.com/application-security/software-supply-chain-security/supply-chain-attacks/referenecs/reference-b-exposure-determination-matrix.md) - [Reference C: Attack catalog and data freshness](https://cortex-docs.paloaltonetworks.com/application-security/software-supply-chain-security/supply-chain-attacks/referenecs/reference-c-attack-catalog-and-data-freshness.md) - [Visibililty and inventory](https://cortex-docs.paloaltonetworks.com/application-security/software-supply-chain-security/visibililty-and-inventory.md) - [Supply Chain assets](https://cortex-docs.paloaltonetworks.com/application-security/software-supply-chain-security/visibililty-and-inventory/supply-chain-assets.md): Manage software supply chain assets like VCS organizations, code identities, and CI/CD pipelines to gain deep visibility and remediate risks directly. - [VCS organization assets](https://cortex-docs.paloaltonetworks.com/application-security/software-supply-chain-security/visibililty-and-inventory/supply-chain-assets/vcs-organization-assets.md) - [Understand and prioritize VCS organization assets](https://cortex-docs.paloaltonetworks.com/application-security/software-supply-chain-security/visibililty-and-inventory/supply-chain-assets/vcs-organization-assets/understand-and-prioritize-vcs-organization-assets.md): Access, review, filter, and prioritize VCS organization assets. - [Investigate and manage VCS organization assets](https://cortex-docs.paloaltonetworks.com/application-security/software-supply-chain-security/visibililty-and-inventory/supply-chain-assets/vcs-organization-assets/investigate-and-manage-vcs-organization-assets.md): Investigate VCS organization security posture, remediate issues, and manage asset data. - [VCS collaborators as assets](https://cortex-docs.paloaltonetworks.com/application-security/software-supply-chain-security/visibililty-and-inventory/supply-chain-assets/vcs-collaborators-as-assets.md) - [Repository as an asset](https://cortex-docs.paloaltonetworks.com/application-security/software-supply-chain-security/visibililty-and-inventory/supply-chain-assets/repository-as-an-asset.md) - [Manage repository assets through the tenant (UI)](https://cortex-docs.paloaltonetworks.com/application-security/software-supply-chain-security/visibililty-and-inventory/supply-chain-assets/repository-as-an-asset/manage-repository-assets-through-the-tenant-ui.md) - [Investigate repository assets](https://cortex-docs.paloaltonetworks.com/application-security/software-supply-chain-security/visibililty-and-inventory/supply-chain-assets/repository-as-an-asset/manage-repository-assets-through-the-tenant-ui/investigate-repository-assets.md) - [Reference: Repositories asset attributes](https://cortex-docs.paloaltonetworks.com/application-security/software-supply-chain-security/visibililty-and-inventory/supply-chain-assets/repository-as-an-asset/manage-repository-assets-through-the-tenant-ui/reference-repositories-asset-attributes.md) - [Manage repositories via API](https://cortex-docs.paloaltonetworks.com/application-security/software-supply-chain-security/visibililty-and-inventory/supply-chain-assets/repository-as-an-asset/manage-repositories-via-api.md) - [Technologies as assets](https://cortex-docs.paloaltonetworks.com/application-security/software-supply-chain-security/visibililty-and-inventory/supply-chain-assets/technologies-as-assets.md) - [Troubleshoot repository technology detection](https://cortex-docs.paloaltonetworks.com/application-security/software-supply-chain-security/visibililty-and-inventory/supply-chain-assets/technologies-as-assets/troubleshoot-repository-technology-detection.md): Resolve technology detection issues and review common questions. - [Software packages as assets](https://cortex-docs.paloaltonetworks.com/application-security/software-supply-chain-security/visibililty-and-inventory/supply-chain-assets/software-packages-as-assets.md) - [Understand software package assets](https://cortex-docs.paloaltonetworks.com/application-security/software-supply-chain-security/visibililty-and-inventory/supply-chain-assets/software-packages-as-assets/understand-software-package-assets.md): Access, filter, investigate, and manage software package assets. - [Investigate software package assets and security issues](https://cortex-docs.paloaltonetworks.com/application-security/software-supply-chain-security/visibililty-and-inventory/supply-chain-assets/software-packages-as-assets/investigate-software-package-assets-and-security-issues.md): Investigate dependency context and remediate software package security issues. - [CI/CD instance as an asset](https://cortex-docs.paloaltonetworks.com/application-security/software-supply-chain-security/visibililty-and-inventory/supply-chain-assets/cicd-instance-as-an-asset.md) - [Understand and prioritize CI/CD instance assets](https://cortex-docs.paloaltonetworks.com/application-security/software-supply-chain-security/visibililty-and-inventory/supply-chain-assets/cicd-instance-as-an-asset/understand-and-prioritize-ci-cd-instance-assets.md): Access, review, filter, and prioritize CI/CD instance assets. - [Investigate and manage CI/CD instance assets](https://cortex-docs.paloaltonetworks.com/application-security/software-supply-chain-security/visibililty-and-inventory/supply-chain-assets/cicd-instance-as-an-asset/investigate-and-manage-ci-cd-instance-assets.md): Investigate CI/CD instance security posture, remediate issues, and manage asset data. - [CI/CD pipeline as an asset](https://cortex-docs.paloaltonetworks.com/application-security/software-supply-chain-security/visibililty-and-inventory/supply-chain-assets/cicd-pipeline-as-an-asset.md) - [Understand and prioritize CI/CD pipeline assets](https://cortex-docs.paloaltonetworks.com/application-security/software-supply-chain-security/visibililty-and-inventory/supply-chain-assets/cicd-pipeline-as-an-asset/understand-and-prioritize-ci-cd-pipeline-assets.md): Access, review, filter, and prioritize CI/CD pipeline assets. - [Investigate and manage CI/CD pipeline assets](https://cortex-docs.paloaltonetworks.com/application-security/software-supply-chain-security/visibililty-and-inventory/supply-chain-assets/cicd-pipeline-as-an-asset/investigate-and-manage-ci-cd-pipeline-assets.md): Investigate CI/CD pipeline security posture, remediate issues, and manage asset data. - [Tools as an asset](https://cortex-docs.paloaltonetworks.com/application-security/software-supply-chain-security/visibililty-and-inventory/supply-chain-assets/tools-as-an-asset.md): Supply Chain: Gain full visibility by tracking detected tools in your environment and cross-referencing them against a catalog of Cortex-recognized, trusted technologies. - [Supply Chain tools](https://cortex-docs.paloaltonetworks.com/application-security/software-supply-chain-security/visibililty-and-inventory/supply-chain-assets/tools-as-an-asset/supply-chain-tools.md) - [Supply Chain catalog](https://cortex-docs.paloaltonetworks.com/application-security/software-supply-chain-security/visibililty-and-inventory/supply-chain-assets/tools-as-an-asset/supply-chain-catalog.md) - [Package Explorer](https://cortex-docs.paloaltonetworks.com/application-security/software-supply-chain-security/visibililty-and-inventory/package-explorer.md) - [Tenant (UI) workflow](https://cortex-docs.paloaltonetworks.com/application-security/software-supply-chain-security/visibililty-and-inventory/package-explorer/tenant-ui-workflow.md) - [Agentix package recommendations](https://cortex-docs.paloaltonetworks.com/application-security/software-supply-chain-security/visibililty-and-inventory/package-explorer/agentix-package-recommendations.md) - [API workflow](https://cortex-docs.paloaltonetworks.com/application-security/software-supply-chain-security/visibililty-and-inventory/package-explorer/api-workflow.md) - [References](https://cortex-docs.paloaltonetworks.com/application-security/software-supply-chain-security/visibililty-and-inventory/package-explorer/references.md) - [Reference A: Package table columns](https://cortex-docs.paloaltonetworks.com/application-security/software-supply-chain-security/visibililty-and-inventory/package-explorer/references/reference-a-package-table-columns.md) - [Reference B: Used In table columns](https://cortex-docs.paloaltonetworks.com/application-security/software-supply-chain-security/visibililty-and-inventory/package-explorer/references/reference-b-used-in-table-columns.md) - [Artifact Trust Score](https://cortex-docs.paloaltonetworks.com/application-security/software-supply-chain-security/visibililty-and-inventory/artifact-trust-score.md) - [Tenant (UI) workflow](https://cortex-docs.paloaltonetworks.com/application-security/software-supply-chain-security/visibililty-and-inventory/artifact-trust-score/tenant-ui-workflow.md) - [References](https://cortex-docs.paloaltonetworks.com/application-security/software-supply-chain-security/visibililty-and-inventory/artifact-trust-score/references.md) - [Reference A: Trust Level bands](https://cortex-docs.paloaltonetworks.com/application-security/software-supply-chain-security/visibililty-and-inventory/artifact-trust-score/references/reference-a-trust-level-bands.md) - [Reference B: Supply Chain Security Category values](https://cortex-docs.paloaltonetworks.com/application-security/software-supply-chain-security/visibililty-and-inventory/artifact-trust-score/references/reference-b-supply-chain-security-category-values.md) - [Risk and remediation](https://cortex-docs.paloaltonetworks.com/application-security/software-supply-chain-security/risk-and-remediation.md) - [Software Composition Analysis (SCA )](https://cortex-docs.paloaltonetworks.com/application-security/software-supply-chain-security/risk-and-remediation/software-composition-analysis-sca-scanners.md) - [Supported Software Composition Analysis (SCA) frameworks and languages](https://cortex-docs.paloaltonetworks.com/application-security/software-supply-chain-security/risk-and-remediation/software-composition-analysis-sca-scanners/supported-software-composition-analysis-sca-frameworks-and-languages.md) - [Software Composition Analysis (SCA) vulnerability issues](https://cortex-docs.paloaltonetworks.com/application-security/software-supply-chain-security/risk-and-remediation/software-composition-analysis-sca-scanners/software-composition-analysis-sca-vulnerability-issues.md): SCA scanners detect known CVEs in open-source dependencies, protecting your organization by keeping vulnerable third-party code out of production. - [Understand the Vulnerabilities table](https://cortex-docs.paloaltonetworks.com/application-security/software-supply-chain-security/risk-and-remediation/software-composition-analysis-sca-scanners/software-composition-analysis-sca-vulnerability-issues/understand-the-vulnerabilities-table.md) - [Investigate, prioritize and remediate vulnerability issues](https://cortex-docs.paloaltonetworks.com/application-security/software-supply-chain-security/risk-and-remediation/software-composition-analysis-sca-scanners/software-composition-analysis-sca-vulnerability-issues/investigate-prioritize-and-remediate-vulnerability-issues.md) - [View and understand CVE findings](https://cortex-docs.paloaltonetworks.com/application-security/software-supply-chain-security/risk-and-remediation/software-composition-analysis-sca-scanners/software-composition-analysis-sca-vulnerability-issues/view-and-understand-cve-findings.md): Review the findings associated with CVE vulnerability issues. - [References](https://cortex-docs.paloaltonetworks.com/application-security/software-supply-chain-security/risk-and-remediation/software-composition-analysis-sca-scanners/software-composition-analysis-sca-vulnerability-issues/references.md) - [Reference A: Prioritization metrics](https://cortex-docs.paloaltonetworks.com/application-security/software-supply-chain-security/risk-and-remediation/software-composition-analysis-sca-scanners/software-composition-analysis-sca-vulnerability-issues/references/reference-a-prioritization-metrics.md) - [Reference B: Investigation details](https://cortex-docs.paloaltonetworks.com/application-security/software-supply-chain-security/risk-and-remediation/software-composition-analysis-sca-scanners/software-composition-analysis-sca-vulnerability-issues/references/reference-b-investigation-details.md) - [License miscompliance issues](https://cortex-docs.paloaltonetworks.com/application-security/software-supply-chain-security/risk-and-remediation/software-composition-analysis-sca-scanners/license-miscompliance-issues.md) - [Ingest third-party SCA data](https://cortex-docs.paloaltonetworks.com/application-security/software-supply-chain-security/risk-and-remediation/software-composition-analysis-sca-scanners/ingest-third-party-sca-data.md) - [CI/CD Risks](https://cortex-docs.paloaltonetworks.com/application-security/software-supply-chain-security/risk-and-remediation/cicd-risks.md): CI/CD risks identify vulnerabilities and misconfigurations in pipelines, then prioritize them into actionable issues for efficient remediation. - [Understand the CI/CD Risks table](https://cortex-docs.paloaltonetworks.com/application-security/software-supply-chain-security/risk-and-remediation/cicd-risks/understand-the-ci-cd-risks-table.md) - [Investigate, prioritize, and remediate CI/CD risk issues](https://cortex-docs.paloaltonetworks.com/application-security/software-supply-chain-security/risk-and-remediation/cicd-risks/investigate-prioritize-and-remediate-ci-cd-risk-issues.md) - [View and understand VCS and CI/CD pipeline risk findings](https://cortex-docs.paloaltonetworks.com/application-security/software-supply-chain-security/risk-and-remediation/cicd-risks/vcs-and-cicd-pipeline-risk-findings.md) - [Malicious packages](https://cortex-docs.paloaltonetworks.com/application-security/software-supply-chain-security/risk-and-remediation/malicious-packages.md) - [Tenant (UI) workflow](https://cortex-docs.paloaltonetworks.com/application-security/software-supply-chain-security/risk-and-remediation/malicious-packages/tenant-ui-workflow.md) - [API Workflow](https://cortex-docs.paloaltonetworks.com/application-security/software-supply-chain-security/risk-and-remediation/malicious-packages/api-workflow.md) - [CLI workflow](https://cortex-docs.paloaltonetworks.com/application-security/software-supply-chain-security/risk-and-remediation/malicious-packages/cli-workflow.md) - [Pull request workflow](https://cortex-docs.paloaltonetworks.com/application-security/software-supply-chain-security/risk-and-remediation/malicious-packages/pull-request-workflow.md) - [IDE workflow](https://cortex-docs.paloaltonetworks.com/application-security/software-supply-chain-security/risk-and-remediation/malicious-packages/ide-workflow.md) - [Reference A: Workflows](https://cortex-docs.paloaltonetworks.com/application-security/software-supply-chain-security/risk-and-remediation/malicious-packages/reference-a-workflows.md) - [Reference B: RBAC permission levels by capability](https://cortex-docs.paloaltonetworks.com/application-security/software-supply-chain-security/risk-and-remediation/malicious-packages/reference-b-rbac-permission-levels-by-capability.md) - [Reference C: Supported ecosystems](https://cortex-docs.paloaltonetworks.com/application-security/software-supply-chain-security/risk-and-remediation/malicious-packages/reference-c-supported-ecosystems.md) - [Reference D: Malicious package finding and issue fields](https://cortex-docs.paloaltonetworks.com/application-security/software-supply-chain-security/risk-and-remediation/malicious-packages/reference-d-malicious-package-finding-and-issue-fields.md) - [Governance and enforcement](https://cortex-docs.paloaltonetworks.com/application-security/software-supply-chain-security/governance-and-enforcement.md) - [CI/CD Rules](https://cortex-docs.paloaltonetworks.com/application-security/software-supply-chain-security/governance-and-enforcement/cicd-rules.md): CI/CD rules detect security threats within your pipelines. - [CI/CD rules roles and permissions](https://cortex-docs.paloaltonetworks.com/application-security/software-supply-chain-security/governance-and-enforcement/cicd-rules/cicd-rules-roles-and-permissions.md) - [CI/CD rules inventory](https://cortex-docs.paloaltonetworks.com/application-security/software-supply-chain-security/governance-and-enforcement/cicd-rules/cicd-rules-inventory.md) - [CI/CD Policies](https://cortex-docs.paloaltonetworks.com/application-security/software-supply-chain-security/governance-and-enforcement/cicd-policies.md): Control CI/CD security: view system & custom policies. Create and manage policies to ensure pipeline integrity and compliance. - [CI/CD policies user roles and permissions](https://cortex-docs.paloaltonetworks.com/application-security/software-supply-chain-security/governance-and-enforcement/cicd-policies/cicd-policies-user-roles-and-permissions.md) - [CI/CD policies inventory](https://cortex-docs.paloaltonetworks.com/application-security/software-supply-chain-security/governance-and-enforcement/cicd-policies/cicd-policies-inventory.md) - [Create CI/CD configuration policies](https://cortex-docs.paloaltonetworks.com/application-security/software-supply-chain-security/governance-and-enforcement/cicd-policies/create-cicd-configuration-policies.md) - [Manage CI/CD policies](https://cortex-docs.paloaltonetworks.com/application-security/software-supply-chain-security/governance-and-enforcement/cicd-policies/manage-cicd-policies.md) - [Reference A: CI/CD policy Condition attributes](https://cortex-docs.paloaltonetworks.com/application-security/software-supply-chain-security/governance-and-enforcement/cicd-policies/reference-a-ci-cd-policy-condition-attributes.md): Supported CI/CD policy condition attributes and values. - [Reference B: Scope Asset Types](https://cortex-docs.paloaltonetworks.com/application-security/software-supply-chain-security/governance-and-enforcement/cicd-policies/reference-b-scope-asset-types.md): Supported asset types and values for CI/CD policy scope. - [About Code security](https://cortex-docs.paloaltonetworks.com/application-security/code-security/about-code-security.md) - [Code Security assets](https://cortex-docs.paloaltonetworks.com/application-security/code-security/code-security-assets.md) - [Software packages as assets](https://cortex-docs.paloaltonetworks.com/application-security/code-security/code-security-assets/software-packages-as-assets.md) - [Supported Software Composition Analysis (SCA) frameworks and languages](https://cortex-docs.paloaltonetworks.com/application-security/code-security/code-security-assets/software-packages-as-assets/supported-software-composition-analysis-sca-frameworks-and-languages.md) - [SCA support matrix by language](https://cortex-docs.paloaltonetworks.com/application-security/code-security/code-security-assets/software-packages-as-assets/supported-software-composition-analysis-sca-frameworks-and-languages/sca-support-matrix-by-language.md) - [Understand software package assets](https://cortex-docs.paloaltonetworks.com/application-security/code-security/code-security-assets/software-packages-as-assets/understanding-software-package-assets.md) - [Investigate software package assets and security issues](https://cortex-docs.paloaltonetworks.com/application-security/code-security/code-security-assets/software-packages-as-assets/investigate-software-package-assets-and-security-issues.md) - [Infrastructure-as-Code (IaC) resources as assets](https://cortex-docs.paloaltonetworks.com/application-security/code-security/code-security-assets/infrastructure-as-code-iac-resources-as-assets.md): Infrastructure-as-Code (IaC) assets provide a governed inventory of cloud templates, enabling teams to detect misconfigurations and map code-to-cloud lineage. - [Supported frameworks and languages](https://cortex-docs.paloaltonetworks.com/application-security/code-security/code-security-assets/infrastructure-as-code-iac-resources-as-assets/supported-frameworks-and-languages.md) - [Access and filter IaC assets](https://cortex-docs.paloaltonetworks.com/application-security/code-security/code-security-assets/infrastructure-as-code-iac-resources-as-assets/access-and-filter-iac-assets.md) - [Investigate IaC assets](https://cortex-docs.paloaltonetworks.com/application-security/code-security/code-security-assets/infrastructure-as-code-iac-resources-as-assets/investigate-iac-assets.md) - [Code Security scanners](https://cortex-docs.paloaltonetworks.com/application-security/code-security/code-security-scanners.md) - [Software Composition Analysis (SCA ) scanners](https://cortex-docs.paloaltonetworks.com/application-security/code-security/code-security-scanners/software-composition-analysis-sca-scanners.md) - [Supported Software Composition Analysis (SCA) frameworks and languages](https://cortex-docs.paloaltonetworks.com/application-security/code-security/code-security-scanners/software-composition-analysis-sca-scanners/supported-software-composition-analysis-sca-frameworks-and-languages.md) - [Software Composition Analysis (SCA) vulnerability issues](https://cortex-docs.paloaltonetworks.com/application-security/code-security/code-security-scanners/software-composition-analysis-sca-scanners/software-composition-analysis-sca-vulnerability-issues.md): SCA scanners detect known CVEs in open-source dependencies, protecting your organization by keeping vulnerable third-party code out of production. - [Understand the Vulnerabilities table](https://cortex-docs.paloaltonetworks.com/application-security/code-security/code-security-scanners/software-composition-analysis-sca-scanners/software-composition-analysis-sca-vulnerability-issues/understand-the-vulnerabilities-table.md) - [Investigate, prioritize and remediate vulnerability issues](https://cortex-docs.paloaltonetworks.com/application-security/code-security/code-security-scanners/software-composition-analysis-sca-scanners/software-composition-analysis-sca-vulnerability-issues/investigate-and-remediate-cve-vulnerability-issues.md) - [View and understand CVE findings](https://cortex-docs.paloaltonetworks.com/application-security/code-security/code-security-scanners/software-composition-analysis-sca-scanners/software-composition-analysis-sca-vulnerability-issues/investigate-cve-vulnerabilities-findings.md): Review the findings associated with CVE vulnerability issues. - [References](https://cortex-docs.paloaltonetworks.com/application-security/code-security/code-security-scanners/software-composition-analysis-sca-scanners/software-composition-analysis-sca-vulnerability-issues/navigate-to-cve-vulnerability-issues.md) - [Reference A: Prioritization metrics](https://cortex-docs.paloaltonetworks.com/application-security/code-security/code-security-scanners/software-composition-analysis-sca-scanners/software-composition-analysis-sca-vulnerability-issues/navigate-to-cve-vulnerability-issues/reference-a-prioritization-metrics.md) - [Reference B: Investigation details](https://cortex-docs.paloaltonetworks.com/application-security/code-security/code-security-scanners/software-composition-analysis-sca-scanners/software-composition-analysis-sca-vulnerability-issues/navigate-to-cve-vulnerability-issues/reference-b-investigation-details.md) - [License miscompliance issues](https://cortex-docs.paloaltonetworks.com/application-security/code-security/code-security-scanners/software-composition-analysis-sca-scanners/license-miscompliance-issues.md) - [Understand the Licenses misconfigurations table](https://cortex-docs.paloaltonetworks.com/application-security/code-security/code-security-scanners/software-composition-analysis-sca-scanners/license-miscompliance-issues/understand-the-licenses-table.md) - [Investigate, prioritize, and remediate license miscompliance issues](https://cortex-docs.paloaltonetworks.com/application-security/code-security/code-security-scanners/software-composition-analysis-sca-scanners/license-miscompliance-issues/navigate-to-license-miscompliance-issues.md) - [Understand license micompliance findings](https://cortex-docs.paloaltonetworks.com/application-security/code-security/code-security-scanners/software-composition-analysis-sca-scanners/license-miscompliance-issues/understand-license-micompliance-findings.md) - [Open-source software license categories](https://cortex-docs.paloaltonetworks.com/application-security/code-security/code-security-scanners/software-composition-analysis-sca-scanners/license-miscompliance-issues/open-source-software-license-categories.md) - [Package operational risks](https://cortex-docs.paloaltonetworks.com/application-security/code-security/code-security-scanners/software-composition-analysis-sca-scanners/package-operational-risk-scanner.md) - [Understand the package operational risk table](https://cortex-docs.paloaltonetworks.com/application-security/code-security/code-security-scanners/software-composition-analysis-sca-scanners/package-operational-risk-scanner/understand-the-package-operational-risk-table.md) - [Investigate, prioritize and remediate package operational risk issues](https://cortex-docs.paloaltonetworks.com/application-security/code-security/code-security-scanners/software-composition-analysis-sca-scanners/package-operational-risk-scanner/investigate-and-remediate-package-operational-risk-issues.md) - [Understand package operational risk findings](https://cortex-docs.paloaltonetworks.com/application-security/code-security/code-security-scanners/software-composition-analysis-sca-scanners/package-operational-risk-scanner/understand-package-operational-risk-findings.md) - [Package operational risks findings reference](https://cortex-docs.paloaltonetworks.com/application-security/code-security/code-security-scanners/software-composition-analysis-sca-scanners/package-operational-risk-scanner/understand-package-operational-risk-findings/package-operational-risks-findings-reference.md) - [Reference A: Findings tab columns](https://cortex-docs.paloaltonetworks.com/application-security/code-security/code-security-scanners/software-composition-analysis-sca-scanners/package-operational-risk-scanner/understand-package-operational-risk-findings/package-operational-risks-findings-reference/reference-a-findings-tab-columns.md) - [Reference B: Finding side panel fields](https://cortex-docs.paloaltonetworks.com/application-security/code-security/code-security-scanners/software-composition-analysis-sca-scanners/package-operational-risk-scanner/understand-package-operational-risk-findings/package-operational-risks-findings-reference/reference-b-finding-side-panel-fields.md) - [Reference C: Operational risk finding field model](https://cortex-docs.paloaltonetworks.com/application-security/code-security/code-security-scanners/software-composition-analysis-sca-scanners/package-operational-risk-scanner/understand-package-operational-risk-findings/package-operational-risks-findings-reference/reference-c-operational-risk-finding-field-model.md) - [Reference: How package operational risk issues fit in the Application Security ecosystem](https://cortex-docs.paloaltonetworks.com/application-security/code-security/code-security-scanners/software-composition-analysis-sca-scanners/package-operational-risk-scanner/how-package-operational-risk-issues-fit-in-the-application-security-ecosystem.md) - [Secrets scans](https://cortex-docs.paloaltonetworks.com/application-security/code-security/code-security-scanners/secrets-scans.md): Protect your organization by detecting hardcoded credentials, API keys, and tokens in source code. Secrets scanning prevents credential theft and lateral movement by closing security gaps from develop - [Understand the secrets issues table](https://cortex-docs.paloaltonetworks.com/application-security/code-security/code-security-scanners/secrets-scans/understand-the-secrets-issues-table.md) - [Investigate, prioritize, and remediate secrets issues](https://cortex-docs.paloaltonetworks.com/application-security/code-security/code-security-scanners/secrets-scans/investigate-and-remediate-secrets-issues.md) - [Secrets findings](https://cortex-docs.paloaltonetworks.com/application-security/code-security/code-security-scanners/secrets-scans/secrets-findings.md) - [Secrets findings inventory](https://cortex-docs.paloaltonetworks.com/application-security/code-security/code-security-scanners/secrets-scans/secrets-findings/secrets-findings-inventory.md) - [Infrastructure as Code (IaC) misconfiguration scanner](https://cortex-docs.paloaltonetworks.com/application-security/code-security/code-security-scanners/infrastructure-as-code-iac-misconfiguration-scanner.md): IaC scanners safeguard cloud infrastructure by identifying misconfigurations before deployment, preventing vulnerabilities in your operational environment. - [Understand the IaC misconfigurations table](https://cortex-docs.paloaltonetworks.com/application-security/code-security/code-security-scanners/infrastructure-as-code-iac-misconfiguration-scanner/understand-the-iac-misconfigurations-table.md) - [Investigate, prioritize, and remediate IaC misconfiguration issues](https://cortex-docs.paloaltonetworks.com/application-security/code-security/code-security-scanners/infrastructure-as-code-iac-misconfiguration-scanner/investigate-and-remediate-iac-misconfiguration-issues.md) - [IaC misconfiguration findings](https://cortex-docs.paloaltonetworks.com/application-security/code-security/code-security-scanners/infrastructure-as-code-iac-misconfiguration-scanner/iac-misconfiguration-findings.md) - [Supported frameworks and languages](https://cortex-docs.paloaltonetworks.com/application-security/code-security/code-security-scanners/infrastructure-as-code-iac-misconfiguration-scanner/supported-frameworks-and-languages.md): Supported infrastructure-as-code frameworks for IaC misconfiguration scanning. - [IaC Drift Detection scans](https://cortex-docs.paloaltonetworks.com/application-security/code-security/code-security-scanners/iac-drift-detection-scans.md): IaC Drift Detection identifies runtime configurations that diverge from code. It flags security-critical discrepancies to focus remediation efforts. - [Understand the IaC drift detection table](https://cortex-docs.paloaltonetworks.com/application-security/code-security/code-security-scanners/iac-drift-detection-scans/understand-the-iac-drift-detection-table.md) - [Investigate, prioritize and remediate IaC drift issues](https://cortex-docs.paloaltonetworks.com/application-security/code-security/code-security-scanners/iac-drift-detection-scans/investigate-and-remediate-iac-drift-issues.md) - [Investigate IaC drift detection findings](https://cortex-docs.paloaltonetworks.com/application-security/code-security/code-security-scanners/iac-drift-detection-scans/investigate-iac-drift-detection-findings.md) - [Malicious packages](https://cortex-docs.paloaltonetworks.com/application-security/code-security/code-security-scanners/malicious-packages.md) - [Tenant (UI) workflow](https://cortex-docs.paloaltonetworks.com/application-security/code-security/code-security-scanners/malicious-packages/tenant-ui-workflow.md) - [API Workflow](https://cortex-docs.paloaltonetworks.com/application-security/code-security/code-security-scanners/malicious-packages/api-workflow.md) - [CLI workflow](https://cortex-docs.paloaltonetworks.com/application-security/code-security/code-security-scanners/malicious-packages/cli-workflow.md) - [Pull request workflow](https://cortex-docs.paloaltonetworks.com/application-security/code-security/code-security-scanners/malicious-packages/pull-request-workflow.md) - [IDE workflow](https://cortex-docs.paloaltonetworks.com/application-security/code-security/code-security-scanners/malicious-packages/ide-workflow.md) - [Reference A: Workflows](https://cortex-docs.paloaltonetworks.com/application-security/code-security/code-security-scanners/malicious-packages/reference-a-workflows.md) - [Reference B: RBAC permission levels by capability](https://cortex-docs.paloaltonetworks.com/application-security/code-security/code-security-scanners/malicious-packages/reference-b-rbac-permission-levels-by-capability.md) - [Reference C: Supported ecosystems](https://cortex-docs.paloaltonetworks.com/application-security/code-security/code-security-scanners/malicious-packages/reference-c-supported-ecosystems.md) - [Reference D: Malicious package finding and issue fields](https://cortex-docs.paloaltonetworks.com/application-security/code-security/code-security-scanners/malicious-packages/reference-d-malicious-package-finding-and-issue-fields.md) - [Issue table attributes reference](https://cortex-docs.paloaltonetworks.com/application-security/code-security/code-security-scanners/issue-table-attributes-reference.md) - [API workflows for Code Security issues](https://cortex-docs.paloaltonetworks.com/application-security/code-security/api-workflows-for-code-security-issues.md) - [Manage Application Security scans](https://cortex-docs.paloaltonetworks.com/application-security/code-security/application-security-scans-management.md) - [Manage scans through the tenant (UI)](https://cortex-docs.paloaltonetworks.com/application-security/code-security/application-security-scans-management/manage-scans-through-the-tenant-ui.md) - [Branch periodic scans](https://cortex-docs.paloaltonetworks.com/application-security/code-security/application-security-scans-management/manage-scans-through-the-tenant-ui/branch-periodic-scans.md) - [Branch periodic scan workflow](https://cortex-docs.paloaltonetworks.com/application-security/code-security/application-security-scans-management/manage-scans-through-the-tenant-ui/branch-periodic-scans/branch-periodic-scan-workflow.md) - [Configure repository scan coverage](https://cortex-docs.paloaltonetworks.com/application-security/code-security/application-security-scans-management/manage-scans-through-the-tenant-ui/branch-periodic-scans/branch-periodic-scan-workflow/configure-repository-scan-coverage.md) - [Assess scan coverage and health across the portfolio](https://cortex-docs.paloaltonetworks.com/application-security/code-security/application-security-scans-management/manage-scans-through-the-tenant-ui/branch-periodic-scans/branch-periodic-scan-workflow/assess-scan-coverage-and-health-across-the-portfolio.md) - [Investigate a scan result, prioritize the issues, and remediate](https://cortex-docs.paloaltonetworks.com/application-security/code-security/application-security-scans-management/manage-scans-through-the-tenant-ui/branch-periodic-scans/branch-periodic-scan-workflow/investigate-a-scan-result-prioritize-the-issues-and-remediate.md) - [Triage a scan that failed or completed partially](https://cortex-docs.paloaltonetworks.com/application-security/code-security/application-security-scans-management/manage-scans-through-the-tenant-ui/branch-periodic-scans/branch-periodic-scan-workflow/triage-a-scan-that-failed-or-completed-partially.md) - [Diagnose a scan failure through data source instance health](https://cortex-docs.paloaltonetworks.com/application-security/code-security/application-security-scans-management/manage-scans-through-the-tenant-ui/branch-periodic-scans/branch-periodic-scan-workflow/diagnose-a-scan-failure-through-data-source-instance-health.md) - [References](https://cortex-docs.paloaltonetworks.com/application-security/code-security/application-security-scans-management/manage-scans-through-the-tenant-ui/branch-periodic-scans/references.md) - [Reference A: Branch periodic scan concepts](https://cortex-docs.paloaltonetworks.com/application-security/code-security/application-security-scans-management/manage-scans-through-the-tenant-ui/branch-periodic-scans/references/reference-a-branch-periodic-scan-concepts.md): Detailed concepts for interpreting branch periodic scans. - [Reference B: Inventory columns](https://cortex-docs.paloaltonetworks.com/application-security/code-security/application-security-scans-management/manage-scans-through-the-tenant-ui/branch-periodic-scans/references/reference-b-inventory-columns.md) - [Reference C: Scan health values](https://cortex-docs.paloaltonetworks.com/application-security/code-security/application-security-scans-management/manage-scans-through-the-tenant-ui/branch-periodic-scans/references/reference-c-scan-health-values.md) - [Reference D: Issue category routing](https://cortex-docs.paloaltonetworks.com/application-security/code-security/application-security-scans-management/manage-scans-through-the-tenant-ui/branch-periodic-scans/references/reference-d-issue-category-routing.md) - [Reference E: Instance health error types](https://cortex-docs.paloaltonetworks.com/application-security/code-security/application-security-scans-management/manage-scans-through-the-tenant-ui/branch-periodic-scans/references/reference-e-instance-health-error-types.md) - [Reference F: Scan configuration settings](https://cortex-docs.paloaltonetworks.com/application-security/code-security/application-security-scans-management/manage-scans-through-the-tenant-ui/branch-periodic-scans/references/reference-f-scan-configuration-settings.md) - [Reference G: Scanner to issue category mapping](https://cortex-docs.paloaltonetworks.com/application-security/code-security/application-security-scans-management/manage-scans-through-the-tenant-ui/branch-periodic-scans/references/reference-g-scanner-to-issue-category-mapping.md) - [Reference H: Permissions](https://cortex-docs.paloaltonetworks.com/application-security/code-security/application-security-scans-management/manage-scans-through-the-tenant-ui/branch-periodic-scans/references/reference-h-permissions.md) - [Pull Request scans](https://cortex-docs.paloaltonetworks.com/application-security/code-security/application-security-scans-management/manage-scans-through-the-tenant-ui/pull-request-scans.md) - [Pull request scan workflow](https://cortex-docs.paloaltonetworks.com/application-security/code-security/application-security-scans-management/manage-scans-through-the-tenant-ui/pull-request-scans/pull-request-scan-workflow.md) - [References](https://cortex-docs.paloaltonetworks.com/application-security/code-security/application-security-scans-management/manage-scans-through-the-tenant-ui/pull-request-scans/references.md) - [Reference A: Pull request scan concepts](https://cortex-docs.paloaltonetworks.com/application-security/code-security/application-security-scans-management/manage-scans-through-the-tenant-ui/pull-request-scans/references/reference-a-pull-request-scan-concepts.md) - [Reference B: Inventory columns](https://cortex-docs.paloaltonetworks.com/application-security/code-security/application-security-scans-management/manage-scans-through-the-tenant-ui/pull-request-scans/references/reference-b-inventory-columns.md) - [Reference C: Scan health values](https://cortex-docs.paloaltonetworks.com/application-security/code-security/application-security-scans-management/manage-scans-through-the-tenant-ui/pull-request-scans/references/reference-c-scan-health-values.md) - [Reference D: PR status values](https://cortex-docs.paloaltonetworks.com/application-security/code-security/application-security-scans-management/manage-scans-through-the-tenant-ui/pull-request-scans/references/reference-d-pr-status-values.md) - [Reference E: Issue category routing](https://cortex-docs.paloaltonetworks.com/application-security/code-security/application-security-scans-management/manage-scans-through-the-tenant-ui/pull-request-scans/references/reference-e-issue-category-routing.md) - [Reference F: Pull request scan configuration settings](https://cortex-docs.paloaltonetworks.com/application-security/code-security/application-security-scans-management/manage-scans-through-the-tenant-ui/pull-request-scans/references/reference-f-pull-request-scan-configuration-settings.md) - [Reference G: Scanner to issue category mapping](https://cortex-docs.paloaltonetworks.com/application-security/code-security/application-security-scans-management/manage-scans-through-the-tenant-ui/pull-request-scans/references/reference-g-scanner-to-issue-category-mapping.md) - [Reference H: Pull request comment feedback](https://cortex-docs.paloaltonetworks.com/application-security/code-security/application-security-scans-management/manage-scans-through-the-tenant-ui/pull-request-scans/references/reference-h-pull-request-comment-feedback.md) - [Reference I: Permissions](https://cortex-docs.paloaltonetworks.com/application-security/code-security/application-security-scans-management/manage-scans-through-the-tenant-ui/pull-request-scans/references/reference-i-permissions.md) - [CI scans](https://cortex-docs.paloaltonetworks.com/application-security/code-security/application-security-scans-management/manage-scans-through-the-tenant-ui/ci-scans.md) - [CI scan workflow](https://cortex-docs.paloaltonetworks.com/application-security/code-security/application-security-scans-management/manage-scans-through-the-tenant-ui/ci-scans/ci-scan-workflow.md) - [References](https://cortex-docs.paloaltonetworks.com/application-security/code-security/application-security-scans-management/manage-scans-through-the-tenant-ui/ci-scans/references.md) - [Reference A: CI scan concepts](https://cortex-docs.paloaltonetworks.com/application-security/code-security/application-security-scans-management/manage-scans-through-the-tenant-ui/ci-scans/references/reference-a-ci-scan-concepts.md) - [Reference B: Inventory columns](https://cortex-docs.paloaltonetworks.com/application-security/code-security/application-security-scans-management/manage-scans-through-the-tenant-ui/ci-scans/references/reference-b-inventory-columns.md) - [Reference C: Scan health values](https://cortex-docs.paloaltonetworks.com/application-security/code-security/application-security-scans-management/manage-scans-through-the-tenant-ui/ci-scans/references/reference-c-scan-health-values.md) - [Reference D: CI status values](https://cortex-docs.paloaltonetworks.com/application-security/code-security/application-security-scans-management/manage-scans-through-the-tenant-ui/ci-scans/references/reference-d-ci-status-values.md) - [Reference E: Issue category routing](https://cortex-docs.paloaltonetworks.com/application-security/code-security/application-security-scans-management/manage-scans-through-the-tenant-ui/ci-scans/references/reference-e-issue-category-routing.md) - [Reference F: CI scan sources](https://cortex-docs.paloaltonetworks.com/application-security/code-security/application-security-scans-management/manage-scans-through-the-tenant-ui/ci-scans/references/reference-f-ci-scan-sources.md) - [Reference G: Scanner to issue category mapping](https://cortex-docs.paloaltonetworks.com/application-security/code-security/application-security-scans-management/manage-scans-through-the-tenant-ui/ci-scans/references/reference-g-scanner-to-issue-category-mapping.md) - [Reference H: Permissions](https://cortex-docs.paloaltonetworks.com/application-security/code-security/application-security-scans-management/manage-scans-through-the-tenant-ui/ci-scans/references/reference-h-permissions.md) - [Scan health and status reference](https://cortex-docs.paloaltonetworks.com/application-security/code-security/application-security-scans-management/manage-scans-through-the-tenant-ui/scan-health-and-status-reference.md) - [Manage repository scan configurations](https://cortex-docs.paloaltonetworks.com/application-security/code-security/application-security-scans-management/manage-scans-through-the-tenant-ui/manage-repository-scan-configurations.md) - [Monitor data source instances health](https://cortex-docs.paloaltonetworks.com/application-security/code-security/application-security-scans-management/manage-scans-through-the-tenant-ui/monitor-data-source-instances-health.md) - [How to view an instance health](https://cortex-docs.paloaltonetworks.com/application-security/code-security/application-security-scans-management/manage-scans-through-the-tenant-ui/monitor-data-source-instances-health/how-to-view-an-instance-health.md) - [Manage scans through public APIs](https://cortex-docs.paloaltonetworks.com/application-security/code-security/application-security-scans-management/manage-scans-through-public-apis.md) - [Prerequisites](https://cortex-docs.paloaltonetworks.com/application-security/code-security/application-security-scans-management/manage-scans-through-public-apis/prerequisites.md) - [Application Security Cortex CLI](https://cortex-docs.paloaltonetworks.com/application-security/code-security/application-security-cli.md) - [IDE](https://cortex-docs.paloaltonetworks.com/application-security/code-security/ide.md): Integrating the AppSec IDE security plugin to scan for IaC misconfigurations, SCA vulnerabilities, license miscompliance and exposed secrets while coding, with in-IDE fixes. - [System requirements](https://cortex-docs.paloaltonetworks.com/application-security/code-security/ide/system-requirements.md) - [Visual Studio (VS) Code and VS Code compatible IDEs](https://cortex-docs.paloaltonetworks.com/application-security/code-security/ide/visual-studio-vs-code-and-vs-code-compatible-ides.md) - [How to use the Cortex Cloud extension](https://cortex-docs.paloaltonetworks.com/application-security/code-security/ide/visual-studio-vs-code-and-vs-code-compatible-ides/how-to-use-the-cortex-cloud-extension-in-vs-code.md) - [JetBrains](https://cortex-docs.paloaltonetworks.com/application-security/code-security/ide/jetbrains.md) - [How to use the JetBrains Cortex Cloud extension](https://cortex-docs.paloaltonetworks.com/application-security/code-security/ide/jetbrains/how-to-use-the-jetbrains-cortex-cloud-extension.md) - [Developer suppressions](https://cortex-docs.paloaltonetworks.com/application-security/code-security/developer-suppressions.md) - [Pre-commit hooks](https://cortex-docs.paloaltonetworks.com/application-security/code-security/pre-commit-hooks.md) - [Pre-receive hooks](https://cortex-docs.paloaltonetworks.com/application-security/code-security/pre-receive-hooks.md) - [About API endpoints](https://cortex-docs.paloaltonetworks.com/application-security/api-endpoints/api-endpoints.md) - [Data source integrations](https://cortex-docs.paloaltonetworks.com/application-security/api-endpoints/data-source-integrations.md) - [Unified Application Security policies](https://cortex-docs.paloaltonetworks.com/application-security/api-endpoints/unified-application-security-policies.md) - [Application criteria](https://cortex-docs.paloaltonetworks.com/application-security/api-endpoints/application-criteria.md) - [Manage applications](https://cortex-docs.paloaltonetworks.com/application-security/api-endpoints/manage-applications.md) - [Repositories and scan configurations](https://cortex-docs.paloaltonetworks.com/application-security/api-endpoints/repositories-and-scan-configurations.md) - [Business applications](https://cortex-docs.paloaltonetworks.com/application-security/api-endpoints/business-applications.md) - [Scans, issues, and findings](https://cortex-docs.paloaltonetworks.com/application-security/api-endpoints/scans-issues-and-findings.md) - [About Terraform workflows](https://cortex-docs.paloaltonetworks.com/application-security/terraform-workflows/terraform-workflows.md) - [Authentication and configuration](https://cortex-docs.paloaltonetworks.com/application-security/terraform-workflows/authentication-and-configuration.md) - [Manage resources](https://cortex-docs.paloaltonetworks.com/application-security/terraform-workflows/manage-resources.md) - [Manage Asset Groups](https://cortex-docs.paloaltonetworks.com/application-security/terraform-workflows/manage-resources/manage-asset-groups.md): Manage Application Security asset groups with Terraform. - [Manage Terraform Run Tasks enforcement](https://cortex-docs.paloaltonetworks.com/application-security/terraform-workflows/manage-resources/manage-terraform-run-tasks-enforcement.md): Enforce Application Security guardrails during Terraform planning. - [Manage policies](https://cortex-docs.paloaltonetworks.com/application-security/terraform-workflows/manage-resources/manage-policies.md): Manage Application Security policies, rules, and compliance profiles with Terraform. - [Manage custom rules](https://cortex-docs.paloaltonetworks.com/application-security/terraform-workflows/manage-resources/manage-custom-rules.md): Manage custom Application Security detection rules with Terraform. - [Manage compliance assessment profiles](https://cortex-docs.paloaltonetworks.com/application-security/terraform-workflows/manage-resources/manage-compliance-assessment-profiles.md): Automate Application Security compliance assessments with Terraform. - [Leverage Terraform data sources](https://cortex-docs.paloaltonetworks.com/application-security/terraform-workflows/manage-resources/leverage-terraform-data-sources.md): Look up Application Security configuration with Terraform data sources. ## Cortex AgentiX Documentation - [Navigate the Cortex AgentiX docs](https://cortex-docs.paloaltonetworks.com/cortex-agentix/learn-about-cortex-agentix/readme.md): Start here for a visual overview of the main Cortex AgentiX documentation areas. - [Get Started with Cortex AgentiX](https://cortex-docs.paloaltonetworks.com/cortex-agentix/learn-about-cortex-agentix/get-started-with-cortex-agentix.md): Learn about Cortex AgentiX and the key integrated capabilities. - [Understand Cortex AgentiX licenses](https://cortex-docs.paloaltonetworks.com/cortex-agentix/learn-about-cortex-agentix/understand-cortex-agentix-licenses.md): The Cortex AgentiX license is downloaded from Cortex Gateway and determines which components users can use and how many users can access the tenant. - [Agentic AI in Cortex AgentiX](https://cortex-docs.paloaltonetworks.com/cortex-agentix/learn-about-cortex-agentix/agentic-ai-in-cortex-agentix.md): Use AI agents to investigate threats, automate security tasks, and streamline operations in Cortex AgentiX. - [Manage Cortex AgentiX agents](https://cortex-docs.paloaltonetworks.com/cortex-agentix/learn-about-cortex-agentix/agentic-ai-in-cortex-agentix/manage-cortex-agentix-agents.md): Learn about personal and system agents in Cortex AgentiX. - [Cortex AgentiX use cases](https://cortex-docs.paloaltonetworks.com/cortex-agentix/learn-about-cortex-agentix/agentic-ai-in-cortex-agentix/cortex-agentix-use-cases.md): Recommended prompts to automate your SOC in Cortex AgentiX. - [Agentic Assistant security](https://cortex-docs.paloaltonetworks.com/cortex-agentix/learn-about-cortex-agentix/agentic-ai-in-cortex-agentix/agentic-assistant-security.md): Learn how the Agentic Assistant protects data through RBAC, approvals, regional processing, and action auditing in Cortex AgentiX, - [Key components and concepts](https://cortex-docs.paloaltonetworks.com/cortex-agentix/learn-about-cortex-agentix/key-components-and-concepts.md): Learn about the key components and concepts, such as agents and actions in Cortex AgentiX. - [Data retention policy](https://cortex-docs.paloaltonetworks.com/cortex-agentix/learn-about-cortex-agentix/data-retention-policy.md): Learn more about the default retention periods for all Cortex AgentiX licenses and the available retention add-ons. - [Supported ciphers](https://cortex-docs.paloaltonetworks.com/cortex-agentix/learn-about-cortex-agentix/supported-ciphers.md): Review the TLS 1.2 and TLS 1.3 cipher suites supported by Cortex AgentiX. - [Supported web browsers](https://cortex-docs.paloaltonetworks.com/cortex-agentix/learn-about-cortex-agentix/supported-web-browsers.md): Review supported browser versions and HTTP/2 guidance for optimal Cortex AgentiX performance. - [How to onboard Cortex AgentiX](https://cortex-docs.paloaltonetworks.com/cortex-agentix/onboard-cortex-agentix/onboard-cortex-agentix.md): Follow the steps to successfully onboard and configure Cortex AgentiX. - [Plan and prepare your deployment](https://cortex-docs.paloaltonetworks.com/cortex-agentix/onboard-cortex-agentix/plan-and-prepare-your-deployment.md): Plan your Cortex AgentiX deployment by selecting a region, data sources, agents, licensing, and access controls. - [Deployment steps](https://cortex-docs.paloaltonetworks.com/cortex-agentix/onboard-cortex-agentix/deployment-steps.md): Review the plan and prepare considerations, and then follow the steps in the onboarding checklist to successfully deploy and onboard Cortex AgentiX. - [Onboarding checklist](https://cortex-docs.paloaltonetworks.com/cortex-agentix/onboard-cortex-agentix/deployment-steps/onboarding-checklist.md): Activate, provision, grant access, and configure Cortex AgentiX. - [Activate Cortex AgentiX](https://cortex-docs.paloaltonetworks.com/cortex-agentix/onboard-cortex-agentix/deployment-steps/activate-cortex-agentix.md): Activate a Cortex AgentiX tenant through Cortex Gateway and configure its name, region, and subdomain. - [Cortex AgentiX supported regions](https://cortex-docs.paloaltonetworks.com/cortex-agentix/onboard-cortex-agentix/deployment-steps/activate-cortex-agentix/cortex-agentix-supported-regions.md): Supported regions in which you want to host Cortex AgentiX and any associated services. - [Enable access to Palo Alto Networks resources](https://cortex-docs.paloaltonetworks.com/cortex-agentix/onboard-cortex-agentix/deployment-steps/activate-cortex-agentix/enable-access-to-palo-alto-networks-resources.md): Depending on your network environment settings, you may need to enable network access to the Cortex AgentiX resources. - [Install and configure content](https://cortex-docs.paloaltonetworks.com/cortex-agentix/onboard-cortex-agentix/deployment-steps/install-and-configure-content.md): Learn how content works in Cortex AgentiX. - [Post-deployment steps](https://cortex-docs.paloaltonetworks.com/cortex-agentix/onboard-cortex-agentix/post-deployment-steps.md): Complete post-deployment configuration for automation, integrations, users, roles, and access in Cortex AgentiX. - [Post-deployment checklist](https://cortex-docs.paloaltonetworks.com/cortex-agentix/onboard-cortex-agentix/post-deployment-steps/post-deployment-checklist.md): Complete your Cortex AgentiX post-deployment checklist for automations, integrations, users, dashboards, engines, and security settings. - [Set up users, groups, and roles](https://cortex-docs.paloaltonetworks.com/cortex-agentix/onboard-cortex-agentix/post-deployment-steps/set-up-users-and-roles.md): Set up Cortex AgentiX and Cortex Gateway users, user groups, roles, role-based access control (RBAC), and SAML SSO authentication. - [Configure server settings](https://cortex-docs.paloaltonetworks.com/cortex-agentix/onboard-cortex-agentix/post-deployment-steps/configure-server-settings.md): Configure Cortex AgentiX server settings for user preferences, security controls, AI features, access, and tenant operations. - [Configure security settings](https://cortex-docs.paloaltonetworks.com/cortex-agentix/onboard-cortex-agentix/post-deployment-steps/configure-security-settings.md): Configure Cortex AgentiX login sessions, approved domains and IP ranges, user expiration, and cookie security policies. - [Set up an engine](https://cortex-docs.paloaltonetworks.com/cortex-agentix/onboard-cortex-agentix/post-deployment-steps/set-up-an-engine.md): Set up a Cortex AgentiX engine on a remote machine. - [Log forwarding](https://cortex-docs.paloaltonetworks.com/cortex-agentix/onboard-cortex-agentix/post-deployment-steps/log-forwarding.md): Configure Cortex AgentiX log forwarding and notifications for email, Slack, and syslog receivers. - [Forward Cortex AgentiX logs and data to external services](https://cortex-docs.paloaltonetworks.com/cortex-agentix/onboard-cortex-agentix/post-deployment-steps/log-forwarding/forward-logs-and-data-from-cortex-agentix-to-external-services.md): Forward Cortex AgentiX logs, cases, and issues to Slack, syslog, email, Splunk, Amazon SQS, Amazon S3, and webhooks. - [Configure external applications for forwarding](https://cortex-docs.paloaltonetworks.com/cortex-agentix/onboard-cortex-agentix/post-deployment-steps/log-forwarding/forward-logs-and-data-from-cortex-agentix-to-external-services/configure-external-applications-for-forwarding.md): Configure Cortex AgentiX external applications and Cortex Gateway egress for forwarding cases, issues, and logs to third-party services. - [Forward notifications to Amazon SQS](https://cortex-docs.paloaltonetworks.com/cortex-agentix/onboard-cortex-agentix/post-deployment-steps/log-forwarding/forward-logs-and-data-from-cortex-agentix-to-external-services/configure-external-applications-for-forwarding/forward-notifications-to-amazon-sqs.md): Configure Cortex XSIAM notification forwarding to Amazon SQS with Cortex Gateway egress, an AWS SQS queue, IAM role or access keys, and queue permissions. - [Forward notifications to Amazon S3](https://cortex-docs.paloaltonetworks.com/cortex-agentix/onboard-cortex-agentix/post-deployment-steps/log-forwarding/forward-logs-and-data-from-cortex-agentix-to-external-services/configure-external-applications-for-forwarding/forward-notifications-to-amazon-s3.md): Configure Cortex XSIAM notification forwarding to Amazon S3 with Cortex Gateway egress, AWS IAM roles, bucket permissions, and file rollup. - [Forward notifications to Splunk](https://cortex-docs.paloaltonetworks.com/cortex-agentix/onboard-cortex-agentix/post-deployment-steps/log-forwarding/forward-logs-and-data-from-cortex-agentix-to-external-services/configure-external-applications-for-forwarding/forward-notifications-to-splunk.md): Configure Cortex XSIAM notification forwarding to Splunk with firewall access, Cortex Gateway egress, HTTPS Event Collector, and authentication tokens. - [Forward notifications to webhook](https://cortex-docs.paloaltonetworks.com/cortex-agentix/onboard-cortex-agentix/post-deployment-steps/log-forwarding/forward-logs-and-data-from-cortex-agentix-to-external-services/configure-external-applications-for-forwarding/forward-notifications-to-webhook.md): Configure Cortex XSIAM case and issue notifications to HTTPS webhooks with firewall access, Gateway egress, authentication, and JSON payload support. - [Integrate a syslog receiver](https://cortex-docs.paloaltonetworks.com/cortex-agentix/onboard-cortex-agentix/post-deployment-steps/log-forwarding/forward-logs-and-data-from-cortex-agentix-to-external-services/configure-external-applications-for-forwarding/integrate-a-syslog-receiver.md): Configure a Cortex AgentiX syslog receiver to forward logs and issues, allow regional IP addresses, and set TCP, UDP, or TLS connection settings. - [Integrate Slack for outbound notifications](https://cortex-docs.paloaltonetworks.com/cortex-agentix/onboard-cortex-agentix/post-deployment-steps/log-forwarding/forward-logs-and-data-from-cortex-agentix-to-external-services/configure-external-applications-for-forwarding/integrate-slack-for-outbound-notifications.md): Integrate Cortex AgentiX with a Slack workspace to forward issue and report notifications to dedicated Slack channels. - [Configure notification forwarding](https://cortex-docs.paloaltonetworks.com/cortex-agentix/onboard-cortex-agentix/post-deployment-steps/log-forwarding/forward-logs-and-data-from-cortex-agentix-to-external-services/configure-notification-forwarding.md): Configure Cortex AgentiX notification forwarding for issues, cases, and audit logs to email, Slack, syslog, Splunk, Amazon S3, Amazon SQS, and webhooks. - [Set up email notifications for tenant updates](https://cortex-docs.paloaltonetworks.com/cortex-agentix/onboard-cortex-agentix/post-deployment-steps/log-forwarding/forward-logs-and-data-from-cortex-agentix-to-external-services/set-up-email-notifications-for-tenant-updates.md): Set up Cortex AgentiX email notifications for tenant upgrades, hotfixes, downtime warnings, and Management Audit Log events. - [Monitor administrative activity](https://cortex-docs.paloaltonetworks.com/cortex-agentix/onboard-cortex-agentix/post-deployment-steps/log-forwarding/forward-logs-and-data-from-cortex-agentix-to-external-services/monitor-administrative-activity.md): Monitor Cortex AgentiX management audit logs for administrative and investigative activity, filter log entries, and forward audit notifications to email, syslog, or Slack. - [Data and log notification formats](https://cortex-docs.paloaltonetworks.com/cortex-agentix/onboard-cortex-agentix/post-deployment-steps/log-forwarding/data-and-log-notification-formats.md): Learn about Cortex AgentiX notification formats for forwarded cases, issues, and logs, including alert-format issue notifications for email, syslog, and Slack. - [Issue notification format](https://cortex-docs.paloaltonetworks.com/cortex-agentix/onboard-cortex-agentix/post-deployment-steps/log-forwarding/data-and-log-notification-formats/issue-notification-format.md): Review Cortex AgentiX issue notification formats for email, Slack, Splunk, Amazon S3, Amazon SQS, webhooks, and CEF-formatted syslog messages. - [Management Audit log notification format](https://cortex-docs.paloaltonetworks.com/cortex-agentix/onboard-cortex-agentix/post-deployment-steps/log-forwarding/data-and-log-notification-formats/management-audit-log-notification-format.md): Review Cortex AgentiX Management Audit log notification formats for email and CEF-formatted syslog forwarding, including field mappings. - [Learn how to configure Cortex AgentiX](https://cortex-docs.paloaltonetworks.com/cortex-agentix/configure-cortex-agentix/cortex-agentix-configuration.md): Configure Cortex AgentiX to match your use case. - [Configure Cortex AgentiX](https://cortex-docs.paloaltonetworks.com/cortex-agentix/configure-cortex-agentix/configure-cortex-agentix.md): Configure Cortex AgentiX content, agents, users, integrations, automations, data, dashboards, and reporting. - [Cortex AgentiX Data Sources and Connectors](https://cortex-docs.paloaltonetworks.com/cortex-agentix/configure-cortex-agentix/cortex-agentix-data-sources-and-connectors.md): Connect Cortex AgentiX to supported data sources and third-party services. - [What are Cortex AgentiX data sources and connectors?](https://cortex-docs.paloaltonetworks.com/cortex-agentix/configure-cortex-agentix/cortex-agentix-data-sources-and-connectors/what-are-cortex-agentix-data-sources-and-connectors.md): Learn more about Cortex AgentiX Data Sources and connectors with a unified approach to integrations. - [What is the data source and connector catalog?](https://cortex-docs.paloaltonetworks.com/cortex-agentix/configure-cortex-agentix/cortex-agentix-data-sources-and-connectors/what-is-the-data-source-and-connector-catalog.md): Learn more about the complete data source and connector catalog available in Cortex AgentiX. - [Vendor-specific data sources and connectors](https://cortex-docs.paloaltonetworks.com/cortex-agentix/configure-cortex-agentix/cortex-agentix-data-sources-and-connectors/vendor-specific-data-sources-and-connectors.md): Choose and configure vendor connectors, data sources, and Marketplace integrations for Cortex AgentiX. - [Absolute](https://cortex-docs.paloaltonetworks.com/cortex-agentix/configure-cortex-agentix/cortex-agentix-data-sources-and-connectors/vendor-specific-data-sources-and-connectors/absolute.md): Configure the Absolute connector for Cortex AgentiX. - [Absolute](https://cortex-docs.paloaltonetworks.com/cortex-agentix/configure-cortex-agentix/cortex-agentix-data-sources-and-connectors/vendor-specific-data-sources-and-connectors/absolute/absolute.md): Use Absolute data for Cortex AgentiX. - [abuse.ch](https://cortex-docs.paloaltonetworks.com/cortex-agentix/configure-cortex-agentix/cortex-agentix-data-sources-and-connectors/vendor-specific-data-sources-and-connectors/abuse.ch.md): Configure the abuse.ch connector for Cortex AgentiX. - [abuse.ch](https://cortex-docs.paloaltonetworks.com/cortex-agentix/configure-cortex-agentix/cortex-agentix-data-sources-and-connectors/vendor-specific-data-sources-and-connectors/abuse.ch/abuse.ch.md): Use abuse.ch threat intelligence with Cortex AgentiX. - [AbuseIPDB](https://cortex-docs.paloaltonetworks.com/cortex-agentix/configure-cortex-agentix/cortex-agentix-data-sources-and-connectors/vendor-specific-data-sources-and-connectors/abuseipdb.md): Configure the AbuseIPDB connector for Cortex AgentiX. - [AbuseIPDB](https://cortex-docs.paloaltonetworks.com/cortex-agentix/configure-cortex-agentix/cortex-agentix-data-sources-and-connectors/vendor-specific-data-sources-and-connectors/abuseipdb/abuseipdb.md): Use AbuseIPDB data for Cortex AgentiX. - [Accenture](https://cortex-docs.paloaltonetworks.com/cortex-agentix/configure-cortex-agentix/cortex-agentix-data-sources-and-connectors/vendor-specific-data-sources-and-connectors/accenture.md): Configure the Accenture connector for Cortex AgentiX. - [Accenture](https://cortex-docs.paloaltonetworks.com/cortex-agentix/configure-cortex-agentix/cortex-agentix-data-sources-and-connectors/vendor-specific-data-sources-and-connectors/accenture/accenture.md): Use Accenture data for Cortex AgentiX. - [AdminByRequest](https://cortex-docs.paloaltonetworks.com/cortex-agentix/configure-cortex-agentix/cortex-agentix-data-sources-and-connectors/vendor-specific-data-sources-and-connectors/adminbyrequest.md): Configure the AdminByRequest connector for Cortex AgentiX. - [AdminByRequest](https://cortex-docs.paloaltonetworks.com/cortex-agentix/configure-cortex-agentix/cortex-agentix-data-sources-and-connectors/vendor-specific-data-sources-and-connectors/adminbyrequest/adminbyrequest.md): Use AdminByRequest data for Cortex AgentiX. - [Aha](https://cortex-docs.paloaltonetworks.com/cortex-agentix/configure-cortex-agentix/cortex-agentix-data-sources-and-connectors/vendor-specific-data-sources-and-connectors/aha.md): Configure the Aha connector for Cortex AgentiX. - [Aha](https://cortex-docs.paloaltonetworks.com/cortex-agentix/configure-cortex-agentix/cortex-agentix-data-sources-and-connectors/vendor-specific-data-sources-and-connectors/aha/aha.md): Use Aha data for Cortex AgentiX. - [AIOps](https://cortex-docs.paloaltonetworks.com/cortex-agentix/configure-cortex-agentix/cortex-agentix-data-sources-and-connectors/vendor-specific-data-sources-and-connectors/aiops.md): Configure the AIOps connector for Cortex AgentiX. - [AIOps](https://cortex-docs.paloaltonetworks.com/cortex-agentix/configure-cortex-agentix/cortex-agentix-data-sources-and-connectors/vendor-specific-data-sources-and-connectors/aiops/aiops.md): Use AIOps data for Cortex AgentiX. - [Akamai](https://cortex-docs.paloaltonetworks.com/cortex-agentix/configure-cortex-agentix/cortex-agentix-data-sources-and-connectors/vendor-specific-data-sources-and-connectors/akamai.md): Configure the Akamai connector for Cortex AgentiX. - [Akamai](https://cortex-docs.paloaltonetworks.com/cortex-agentix/configure-cortex-agentix/cortex-agentix-data-sources-and-connectors/vendor-specific-data-sources-and-connectors/akamai/akamai.md): Use Akamai data for Cortex AgentiX. - [AlgoSec](https://cortex-docs.paloaltonetworks.com/cortex-agentix/configure-cortex-agentix/cortex-agentix-data-sources-and-connectors/vendor-specific-data-sources-and-connectors/algosec.md): Configure the AlgoSec connector for Cortex AgentiX. - [AlgoSec](https://cortex-docs.paloaltonetworks.com/cortex-agentix/configure-cortex-agentix/cortex-agentix-data-sources-and-connectors/vendor-specific-data-sources-and-connectors/algosec/algosec.md): Use AlgoSec data for Cortex AgentiX. - [AlienVault](https://cortex-docs.paloaltonetworks.com/cortex-agentix/configure-cortex-agentix/cortex-agentix-data-sources-and-connectors/vendor-specific-data-sources-and-connectors/alienvault.md): Configure the AlienVault connector for Cortex AgentiX. - [AlienVault](https://cortex-docs.paloaltonetworks.com/cortex-agentix/configure-cortex-agentix/cortex-agentix-data-sources-and-connectors/vendor-specific-data-sources-and-connectors/alienvault/alienvault.md): Use AlienVault data for Cortex AgentiX. - [Amazon](https://cortex-docs.paloaltonetworks.com/cortex-agentix/configure-cortex-agentix/cortex-agentix-data-sources-and-connectors/vendor-specific-data-sources-and-connectors/amazon.md): Configure the Amazon connector for Cortex AgentiX. - [AWS Automation and Collection](https://cortex-docs.paloaltonetworks.com/cortex-agentix/configure-cortex-agentix/cortex-agentix-data-sources-and-connectors/vendor-specific-data-sources-and-connectors/amazon/aws-automation-and-collection.md): Use Amazon data for Cortex AgentiX. - [Anomali](https://cortex-docs.paloaltonetworks.com/cortex-agentix/configure-cortex-agentix/cortex-agentix-data-sources-and-connectors/vendor-specific-data-sources-and-connectors/anomali.md): Configure the Anomali connector for Cortex AgentiX. - [Anomali](https://cortex-docs.paloaltonetworks.com/cortex-agentix/configure-cortex-agentix/cortex-agentix-data-sources-and-connectors/vendor-specific-data-sources-and-connectors/anomali/anomali.md): Use Anomali data for Cortex AgentiX. - [Anthropic](https://cortex-docs.paloaltonetworks.com/cortex-agentix/configure-cortex-agentix/cortex-agentix-data-sources-and-connectors/vendor-specific-data-sources-and-connectors/anthropic.md): Configure the Anthropic connector for Cortex AgentiX. - [Claude Automation and Collection](https://cortex-docs.paloaltonetworks.com/cortex-agentix/configure-cortex-agentix/cortex-agentix-data-sources-and-connectors/vendor-specific-data-sources-and-connectors/anthropic/claude-automation-and-collection.md): Use Claude automation and collection with Cortex AgentiX. - [Apache](https://cortex-docs.paloaltonetworks.com/cortex-agentix/configure-cortex-agentix/cortex-agentix-data-sources-and-connectors/vendor-specific-data-sources-and-connectors/apache.md): Configure the Apache connector for Cortex AgentiX. - [Apache](https://cortex-docs.paloaltonetworks.com/cortex-agentix/configure-cortex-agentix/cortex-agentix-data-sources-and-connectors/vendor-specific-data-sources-and-connectors/apache/apache.md): Use Apache data for Cortex AgentiX. - [APIVoid](https://cortex-docs.paloaltonetworks.com/cortex-agentix/configure-cortex-agentix/cortex-agentix-data-sources-and-connectors/vendor-specific-data-sources-and-connectors/apivoid.md): Configure the APIVoid connector for Cortex AgentiX. - [APIVoid](https://cortex-docs.paloaltonetworks.com/cortex-agentix/configure-cortex-agentix/cortex-agentix-data-sources-and-connectors/vendor-specific-data-sources-and-connectors/apivoid/apivoid.md): Use APIVoid data for Cortex AgentiX. - [ArcSight](https://cortex-docs.paloaltonetworks.com/cortex-agentix/configure-cortex-agentix/cortex-agentix-data-sources-and-connectors/vendor-specific-data-sources-and-connectors/arcsight.md): Configure the ArcSight connector for Cortex AgentiX. - [ArcSight](https://cortex-docs.paloaltonetworks.com/cortex-agentix/configure-cortex-agentix/cortex-agentix-data-sources-and-connectors/vendor-specific-data-sources-and-connectors/arcsight/arcsight.md): Use ArcSight data for Cortex AgentiX. - [Arista Networks](https://cortex-docs.paloaltonetworks.com/cortex-agentix/configure-cortex-agentix/cortex-agentix-data-sources-and-connectors/vendor-specific-data-sources-and-connectors/arista-networks.md): Configure the Arista Networks connector for Cortex AgentiX. - [Arista Networks](https://cortex-docs.paloaltonetworks.com/cortex-agentix/configure-cortex-agentix/cortex-agentix-data-sources-and-connectors/vendor-specific-data-sources-and-connectors/arista-networks/arista-networks.md): Use Arista Networks data for Cortex AgentiX. - [Arkime](https://cortex-docs.paloaltonetworks.com/cortex-agentix/configure-cortex-agentix/cortex-agentix-data-sources-and-connectors/vendor-specific-data-sources-and-connectors/arkime.md): Configure the Arkime connector for Cortex AgentiX. - [Arkime](https://cortex-docs.paloaltonetworks.com/cortex-agentix/configure-cortex-agentix/cortex-agentix-data-sources-and-connectors/vendor-specific-data-sources-and-connectors/arkime/arkime.md): Use Arkime data for Cortex AgentiX. - [Atlassian](https://cortex-docs.paloaltonetworks.com/cortex-agentix/configure-cortex-agentix/cortex-agentix-data-sources-and-connectors/vendor-specific-data-sources-and-connectors/atlassian.md): Configure the Atlassian connector for Cortex AgentiX. - [Atlassian Automation and Collection](https://cortex-docs.paloaltonetworks.com/cortex-agentix/configure-cortex-agentix/cortex-agentix-data-sources-and-connectors/vendor-specific-data-sources-and-connectors/atlassian/atlassian-automation-and-collection.md): Use Atlassian data for Cortex AgentiX. - [AttackIQ](https://cortex-docs.paloaltonetworks.com/cortex-agentix/configure-cortex-agentix/cortex-agentix-data-sources-and-connectors/vendor-specific-data-sources-and-connectors/attackiq.md): Configure the AttackIQ connector for Cortex AgentiX. - [AttackIQ](https://cortex-docs.paloaltonetworks.com/cortex-agentix/configure-cortex-agentix/cortex-agentix-data-sources-and-connectors/vendor-specific-data-sources-and-connectors/attackiq/attackiq.md): Use AttackIQ data for Cortex AgentiX. - [Aurora Endpoint Security](https://cortex-docs.paloaltonetworks.com/cortex-agentix/configure-cortex-agentix/cortex-agentix-data-sources-and-connectors/vendor-specific-data-sources-and-connectors/aurora-endpoint-security.md): Configure the Aurora Endpoint Security connector for Cortex AgentiX. - [Aurora Endpoint Security](https://cortex-docs.paloaltonetworks.com/cortex-agentix/configure-cortex-agentix/cortex-agentix-data-sources-and-connectors/vendor-specific-data-sources-and-connectors/aurora-endpoint-security/aurora-endpoint-security.md): Use Aurora Endpoint Security data for Cortex AgentiX. - [BeyondTrust](https://cortex-docs.paloaltonetworks.com/cortex-agentix/configure-cortex-agentix/cortex-agentix-data-sources-and-connectors/vendor-specific-data-sources-and-connectors/beyondtrust.md): Configure the BeyondTrust connector for Cortex AgentiX. - [BeyondTrust](https://cortex-docs.paloaltonetworks.com/cortex-agentix/configure-cortex-agentix/cortex-agentix-data-sources-and-connectors/vendor-specific-data-sources-and-connectors/beyondtrust/beyondtrust.md): Use BeyondTrust data for Cortex AgentiX. - [Blocklist.de](https://cortex-docs.paloaltonetworks.com/cortex-agentix/configure-cortex-agentix/cortex-agentix-data-sources-and-connectors/vendor-specific-data-sources-and-connectors/blocklist.de.md): Configure the Blocklist.de connector for Cortex AgentiX. - [Blocklist.de](https://cortex-docs.paloaltonetworks.com/cortex-agentix/configure-cortex-agentix/cortex-agentix-data-sources-and-connectors/vendor-specific-data-sources-and-connectors/blocklist.de/blocklist.de.md): Use Blocklist.de data for Cortex AgentiX. - [BlueCat Address Manager](https://cortex-docs.paloaltonetworks.com/cortex-agentix/configure-cortex-agentix/cortex-agentix-data-sources-and-connectors/vendor-specific-data-sources-and-connectors/bluecat-address-manager.md): Configure the BlueCat Address Manager connector for Cortex AgentiX. - [BlueCat Address Manager](https://cortex-docs.paloaltonetworks.com/cortex-agentix/configure-cortex-agentix/cortex-agentix-data-sources-and-connectors/vendor-specific-data-sources-and-connectors/bluecat-address-manager/bluecat-address-manager.md): Use BlueCat Address Manager data for Cortex AgentiX. - [BMC](https://cortex-docs.paloaltonetworks.com/cortex-agentix/configure-cortex-agentix/cortex-agentix-data-sources-and-connectors/vendor-specific-data-sources-and-connectors/bmc.md): Configure the BMC connector for Cortex AgentiX. - [BMC](https://cortex-docs.paloaltonetworks.com/cortex-agentix/configure-cortex-agentix/cortex-agentix-data-sources-and-connectors/vendor-specific-data-sources-and-connectors/bmc/bmc.md): Use BMC data for Cortex AgentiX. - [Box](https://cortex-docs.paloaltonetworks.com/cortex-agentix/configure-cortex-agentix/cortex-agentix-data-sources-and-connectors/vendor-specific-data-sources-and-connectors/box.md): Configure the Box connector for Cortex AgentiX. - [Box Automation and Collection](https://cortex-docs.paloaltonetworks.com/cortex-agentix/configure-cortex-agentix/cortex-agentix-data-sources-and-connectors/vendor-specific-data-sources-and-connectors/box/box-automation-and-collection.md): Use Box data for Cortex AgentiX. - [Broadcom](https://cortex-docs.paloaltonetworks.com/cortex-agentix/configure-cortex-agentix/cortex-agentix-data-sources-and-connectors/vendor-specific-data-sources-and-connectors/broadcom.md): Configure the Broadcom connector for Cortex AgentiX. - [Broadcom](https://cortex-docs.paloaltonetworks.com/cortex-agentix/configure-cortex-agentix/cortex-agentix-data-sources-and-connectors/vendor-specific-data-sources-and-connectors/broadcom/broadcom.md): Use Broadcom data for Cortex AgentiX. - [BruteForceBlocker](https://cortex-docs.paloaltonetworks.com/cortex-agentix/configure-cortex-agentix/cortex-agentix-data-sources-and-connectors/vendor-specific-data-sources-and-connectors/bruteforceblocker.md): Configure the BruteForceBlocker connector for Cortex AgentiX. - [BruteForceBlocker](https://cortex-docs.paloaltonetworks.com/cortex-agentix/configure-cortex-agentix/cortex-agentix-data-sources-and-connectors/vendor-specific-data-sources-and-connectors/bruteforceblocker/bruteforceblocker.md): Use BruteForceBlocker data for Cortex AgentiX. - [C2SEC](https://cortex-docs.paloaltonetworks.com/cortex-agentix/configure-cortex-agentix/cortex-agentix-data-sources-and-connectors/vendor-specific-data-sources-and-connectors/c2sec.md): Configure the C2SEC connector for Cortex AgentiX. - [C2SEC](https://cortex-docs.paloaltonetworks.com/cortex-agentix/configure-cortex-agentix/cortex-agentix-data-sources-and-connectors/vendor-specific-data-sources-and-connectors/c2sec/c2sec.md): Use C2SEC data for Cortex AgentiX. - [CAPESandbox](https://cortex-docs.paloaltonetworks.com/cortex-agentix/configure-cortex-agentix/cortex-agentix-data-sources-and-connectors/vendor-specific-data-sources-and-connectors/capesandbox.md): Configure the CAPESandbox connector for Cortex AgentiX. - [CAPESandbox](https://cortex-docs.paloaltonetworks.com/cortex-agentix/configure-cortex-agentix/cortex-agentix-data-sources-and-connectors/vendor-specific-data-sources-and-connectors/capesandbox/capesandbox.md): Use CAPESandbox data for Cortex AgentiX. - [Carbon Black](https://cortex-docs.paloaltonetworks.com/cortex-agentix/configure-cortex-agentix/cortex-agentix-data-sources-and-connectors/vendor-specific-data-sources-and-connectors/carbon-black.md): Configure the Carbon Black connector for Cortex AgentiX. - [Carbon Black](https://cortex-docs.paloaltonetworks.com/cortex-agentix/configure-cortex-agentix/cortex-agentix-data-sources-and-connectors/vendor-specific-data-sources-and-connectors/carbon-black/carbon-black.md): Use Carbon Black data for Cortex AgentiX. - [Centreon](https://cortex-docs.paloaltonetworks.com/cortex-agentix/configure-cortex-agentix/cortex-agentix-data-sources-and-connectors/vendor-specific-data-sources-and-connectors/centreon.md): Configure the Centreon connector for Cortex AgentiX. - [Centreon](https://cortex-docs.paloaltonetworks.com/cortex-agentix/configure-cortex-agentix/cortex-agentix-data-sources-and-connectors/vendor-specific-data-sources-and-connectors/centreon/centreon.md): Use Centreon data for Cortex AgentiX. - [Check Point](https://cortex-docs.paloaltonetworks.com/cortex-agentix/configure-cortex-agentix/cortex-agentix-data-sources-and-connectors/vendor-specific-data-sources-and-connectors/check-point.md): Configure the Check Point data source and connector for Cortex AgentiX. - [Check Point FW1/VPN1](https://cortex-docs.paloaltonetworks.com/cortex-agentix/configure-cortex-agentix/cortex-agentix-data-sources-and-connectors/vendor-specific-data-sources-and-connectors/check-point/check-point-fw1-vpn1.md): Use Check Point FW1/VPN1 data for Cortex AgentiX. - [Checkpoint Firewall](https://cortex-docs.paloaltonetworks.com/cortex-agentix/configure-cortex-agentix/cortex-agentix-data-sources-and-connectors/vendor-specific-data-sources-and-connectors/check-point/checkpoint-firewall.md): Use Checkpoint Firewall data for Cortex AgentiX. - [CheckPhish](https://cortex-docs.paloaltonetworks.com/cortex-agentix/configure-cortex-agentix/cortex-agentix-data-sources-and-connectors/vendor-specific-data-sources-and-connectors/checkphish.md): Configure the CheckPhish connector for Cortex AgentiX. - [CheckPhish](https://cortex-docs.paloaltonetworks.com/cortex-agentix/configure-cortex-agentix/cortex-agentix-data-sources-and-connectors/vendor-specific-data-sources-and-connectors/checkphish/checkphish.md): Use CheckPhish data for Cortex AgentiX. - [CipherTrust](https://cortex-docs.paloaltonetworks.com/cortex-agentix/configure-cortex-agentix/cortex-agentix-data-sources-and-connectors/vendor-specific-data-sources-and-connectors/ciphertrust.md): Configure the CipherTrust connector for Cortex AgentiX. - [CipherTrust](https://cortex-docs.paloaltonetworks.com/cortex-agentix/configure-cortex-agentix/cortex-agentix-data-sources-and-connectors/vendor-specific-data-sources-and-connectors/ciphertrust/ciphertrust.md): Use CipherTrust data for Cortex AgentiX. - [CIRCL](https://cortex-docs.paloaltonetworks.com/cortex-agentix/configure-cortex-agentix/cortex-agentix-data-sources-and-connectors/vendor-specific-data-sources-and-connectors/circl.md): Configure the CIRCL connector for Cortex AgentiX. - [CIRCL](https://cortex-docs.paloaltonetworks.com/cortex-agentix/configure-cortex-agentix/cortex-agentix-data-sources-and-connectors/vendor-specific-data-sources-and-connectors/circl/circl.md): Use CIRCL data for Cortex AgentiX. - [CircleCI](https://cortex-docs.paloaltonetworks.com/cortex-agentix/configure-cortex-agentix/cortex-agentix-data-sources-and-connectors/vendor-specific-data-sources-and-connectors/circleci.md): Configure the CircleCI connector for Cortex AgentiX. - [CircleCI](https://cortex-docs.paloaltonetworks.com/cortex-agentix/configure-cortex-agentix/cortex-agentix-data-sources-and-connectors/vendor-specific-data-sources-and-connectors/circleci/circleci.md): Use CircleCI data with Cortex AgentiX. - [Cisco](https://cortex-docs.paloaltonetworks.com/cortex-agentix/configure-cortex-agentix/cortex-agentix-data-sources-and-connectors/vendor-specific-data-sources-and-connectors/cisco.md): Configure the Cisco data sources and connectors for Cortex AgentiX. - [Cisco ASA firewalls and AnyConnect\`](https://cortex-docs.paloaltonetworks.com/cortex-agentix/configure-cortex-agentix/cortex-agentix-data-sources-and-connectors/vendor-specific-data-sources-and-connectors/cisco/cisco-asa-firewalls-and-anyconnect.md): Use Cisco ASA firewalls and AnyConnect data for Cortex AgentiX. - [Cisco ASA](https://cortex-docs.paloaltonetworks.com/cortex-agentix/configure-cortex-agentix/cortex-agentix-data-sources-and-connectors/vendor-specific-data-sources-and-connectors/cisco/cisco-asa.md): Use Cisco ASA data for Cortex AgentiX. - [Cisco DUO Automation and Collection](https://cortex-docs.paloaltonetworks.com/cortex-agentix/configure-cortex-agentix/cortex-agentix-data-sources-and-connectors/vendor-specific-data-sources-and-connectors/cisco/cisco-duo-automation-and-collection.md): Use Cisco DUO Automation and Collection data for Cortex AgentiX. - [Cisco Firepower](https://cortex-docs.paloaltonetworks.com/cortex-agentix/configure-cortex-agentix/cortex-agentix-data-sources-and-connectors/vendor-specific-data-sources-and-connectors/cisco/cisco-firepower.md): Use Cisco Firepower data for Cortex AgentiX. - [Cisco ISE](https://cortex-docs.paloaltonetworks.com/cortex-agentix/configure-cortex-agentix/cortex-agentix-data-sources-and-connectors/vendor-specific-data-sources-and-connectors/cisco/cisco-ise.md): Use Cisco ISE data for Cortex AgentiX. - [Cisco Meraki Automation and Remediation](https://cortex-docs.paloaltonetworks.com/cortex-agentix/configure-cortex-agentix/cortex-agentix-data-sources-and-connectors/vendor-specific-data-sources-and-connectors/cisco/cisco-meraki-automation-and-remediation.md): Use Cisco Meraki Automation and Remediation data for Cortex AgentiX. - [Cisco Security](https://cortex-docs.paloaltonetworks.com/cortex-agentix/configure-cortex-agentix/cortex-agentix-data-sources-and-connectors/vendor-specific-data-sources-and-connectors/cisco/cisco-security.md): Use Cisco Security data for Cortex AgentiX. - [Cisco Umbrella](https://cortex-docs.paloaltonetworks.com/cortex-agentix/configure-cortex-agentix/cortex-agentix-data-sources-and-connectors/vendor-specific-data-sources-and-connectors/cisco/cisco-umbrella.md): Use Cisco Umbrella data for Cortex AgentiX. - [Cloaken](https://cortex-docs.paloaltonetworks.com/cortex-agentix/configure-cortex-agentix/cortex-agentix-data-sources-and-connectors/vendor-specific-data-sources-and-connectors/cloaken.md): Configure the Cloaken connector for Cortex AgentiX. - [Cloaken](https://cortex-docs.paloaltonetworks.com/cortex-agentix/configure-cortex-agentix/cortex-agentix-data-sources-and-connectors/vendor-specific-data-sources-and-connectors/cloaken/cloaken.md): Use Cloaken data for Cortex AgentiX. - [CloudConvert](https://cortex-docs.paloaltonetworks.com/cortex-agentix/configure-cortex-agentix/cortex-agentix-data-sources-and-connectors/vendor-specific-data-sources-and-connectors/cloudconvert.md): Configure the CloudConvert connector for Cortex AgentiX. - [CloudConvert](https://cortex-docs.paloaltonetworks.com/cortex-agentix/configure-cortex-agentix/cortex-agentix-data-sources-and-connectors/vendor-specific-data-sources-and-connectors/cloudconvert/cloudconvert.md): Use CloudConvert data for Cortex AgentiX. - [Cloudflare](https://cortex-docs.paloaltonetworks.com/cortex-agentix/configure-cortex-agentix/cortex-agentix-data-sources-and-connectors/vendor-specific-data-sources-and-connectors/cloudflare.md): Configure the Cloudflare connector for Cortex AgentiX. - [Cloudflare](https://cortex-docs.paloaltonetworks.com/cortex-agentix/configure-cortex-agentix/cortex-agentix-data-sources-and-connectors/vendor-specific-data-sources-and-connectors/cloudflare/cloudflare.md): Use Cloudflare data for Cortex AgentiX. - [CounterTack](https://cortex-docs.paloaltonetworks.com/cortex-agentix/configure-cortex-agentix/cortex-agentix-data-sources-and-connectors/vendor-specific-data-sources-and-connectors/countertack.md): Configure the CounterTack connector for Cortex AgentiX. - [CounterTack](https://cortex-docs.paloaltonetworks.com/cortex-agentix/configure-cortex-agentix/cortex-agentix-data-sources-and-connectors/vendor-specific-data-sources-and-connectors/countertack/countertack.md): Use CounterTack data for Cortex AgentiX. - [CrowdStrike](https://cortex-docs.paloaltonetworks.com/cortex-agentix/configure-cortex-agentix/cortex-agentix-data-sources-and-connectors/vendor-specific-data-sources-and-connectors/crowdstrike.md): Configure the CrowdStrike connector for Cortex AgentiX. - [CrowdStrike](https://cortex-docs.paloaltonetworks.com/cortex-agentix/configure-cortex-agentix/cortex-agentix-data-sources-and-connectors/vendor-specific-data-sources-and-connectors/crowdstrike/crowdstrike.md): Use CrowdStrike data for Cortex AgentiX. - [CryptoCurrency](https://cortex-docs.paloaltonetworks.com/cortex-agentix/configure-cortex-agentix/cortex-agentix-data-sources-and-connectors/vendor-specific-data-sources-and-connectors/cryptocurrency.md): Configure the CryptoCurrency connector for Cortex AgentiX. - [CryptoCurrency](https://cortex-docs.paloaltonetworks.com/cortex-agentix/configure-cortex-agentix/cortex-agentix-data-sources-and-connectors/vendor-specific-data-sources-and-connectors/cryptocurrency/cryptocurrency.md): Use CryptoCurrency data for Cortex AgentiX. - [Cuckoo Sandbox](https://cortex-docs.paloaltonetworks.com/cortex-agentix/configure-cortex-agentix/cortex-agentix-data-sources-and-connectors/vendor-specific-data-sources-and-connectors/cuckoo-sandbox.md): Configure the Cuckoo Sandbox connector for Cortex AgentiX. - [Cuckoo Sandbox](https://cortex-docs.paloaltonetworks.com/cortex-agentix/configure-cortex-agentix/cortex-agentix-data-sources-and-connectors/vendor-specific-data-sources-and-connectors/cuckoo-sandbox/cuckoo-sandbox.md): Use Cuckoo Sandbox data for Cortex AgentiX. - [CybelAngel](https://cortex-docs.paloaltonetworks.com/cortex-agentix/configure-cortex-agentix/cortex-agentix-data-sources-and-connectors/vendor-specific-data-sources-and-connectors/cybelangel.md): Configure the CybelAngel connector for Cortex AgentiX. - [CybelAngel](https://cortex-docs.paloaltonetworks.com/cortex-agentix/configure-cortex-agentix/cortex-agentix-data-sources-and-connectors/vendor-specific-data-sources-and-connectors/cybelangel/cybelangel.md): Use CybelAngel data for Cortex AgentiX. - [CyberArk](https://cortex-docs.paloaltonetworks.com/cortex-agentix/configure-cortex-agentix/cortex-agentix-data-sources-and-connectors/vendor-specific-data-sources-and-connectors/cyberark.md): Configure the CyberArk connector for Cortex AgentiX. - [CyberArk](https://cortex-docs.paloaltonetworks.com/cortex-agentix/configure-cortex-agentix/cortex-agentix-data-sources-and-connectors/vendor-specific-data-sources-and-connectors/cyberark/cyberark.md): Use CyberArk data for Cortex AgentiX. - [Cyber Triage](https://cortex-docs.paloaltonetworks.com/cortex-agentix/configure-cortex-agentix/cortex-agentix-data-sources-and-connectors/vendor-specific-data-sources-and-connectors/cyber-triage.md): Configure the Cyber Triage connector for Cortex AgentiX. - [Cyber Triage](https://cortex-docs.paloaltonetworks.com/cortex-agentix/configure-cortex-agentix/cortex-agentix-data-sources-and-connectors/vendor-specific-data-sources-and-connectors/cyber-triage/cyber-triage.md): Use Cyber Triage data for Cortex AgentiX. - [DeHashed](https://cortex-docs.paloaltonetworks.com/cortex-agentix/configure-cortex-agentix/cortex-agentix-data-sources-and-connectors/vendor-specific-data-sources-and-connectors/dehashed.md): Configure the DeHashed connector for Cortex AgentiX. - [DeHashed](https://cortex-docs.paloaltonetworks.com/cortex-agentix/configure-cortex-agentix/cortex-agentix-data-sources-and-connectors/vendor-specific-data-sources-and-connectors/dehashed/dehashed.md): Use DeHashed data for Cortex AgentiX. - [DHS](https://cortex-docs.paloaltonetworks.com/cortex-agentix/configure-cortex-agentix/cortex-agentix-data-sources-and-connectors/vendor-specific-data-sources-and-connectors/dhs.md): Configure the DHS connector for Cortex AgentiX. - [DHS](https://cortex-docs.paloaltonetworks.com/cortex-agentix/configure-cortex-agentix/cortex-agentix-data-sources-and-connectors/vendor-specific-data-sources-and-connectors/dhs/dhs.md): Use DHS data for Cortex AgentiX. - [dnstwist](https://cortex-docs.paloaltonetworks.com/cortex-agentix/configure-cortex-agentix/cortex-agentix-data-sources-and-connectors/vendor-specific-data-sources-and-connectors/dnstwist.md): Configure the dnstwist connector for Cortex AgentiX. - [dnstwist](https://cortex-docs.paloaltonetworks.com/cortex-agentix/configure-cortex-agentix/cortex-agentix-data-sources-and-connectors/vendor-specific-data-sources-and-connectors/dnstwist/dnstwist.md): Use dnstwist data for Cortex AgentiX. - [EasyVista](https://cortex-docs.paloaltonetworks.com/cortex-agentix/configure-cortex-agentix/cortex-agentix-data-sources-and-connectors/vendor-specific-data-sources-and-connectors/easyvista.md): Configure the EasyVista connector for Cortex AgentiX. - [EasyVista](https://cortex-docs.paloaltonetworks.com/cortex-agentix/configure-cortex-agentix/cortex-agentix-data-sources-and-connectors/vendor-specific-data-sources-and-connectors/easyvista/easyvista.md): Use EasyVista data for Cortex AgentiX. - [Email Hippo](https://cortex-docs.paloaltonetworks.com/cortex-agentix/configure-cortex-agentix/cortex-agentix-data-sources-and-connectors/vendor-specific-data-sources-and-connectors/email-hippo.md): Configure the Email Hippo connector for Cortex AgentiX. - [Email Hippo](https://cortex-docs.paloaltonetworks.com/cortex-agentix/configure-cortex-agentix/cortex-agentix-data-sources-and-connectors/vendor-specific-data-sources-and-connectors/email-hippo/email-hippo.md): Use Email Hippo data for Cortex AgentiX. - [Elastic](https://cortex-docs.paloaltonetworks.com/cortex-agentix/configure-cortex-agentix/cortex-agentix-data-sources-and-connectors/vendor-specific-data-sources-and-connectors/elastic.md): Configure the Elastic connector for Cortex AgentiX. - [ElasticSearch](https://cortex-docs.paloaltonetworks.com/cortex-agentix/configure-cortex-agentix/cortex-agentix-data-sources-and-connectors/vendor-specific-data-sources-and-connectors/elastic/elasticsearch.md): Use ElasticSearch data for Cortex AgentiX. - [Endgame](https://cortex-docs.paloaltonetworks.com/cortex-agentix/configure-cortex-agentix/cortex-agentix-data-sources-and-connectors/vendor-specific-data-sources-and-connectors/endgame.md): Configure the Endgame connector for Cortex AgentiX. - [Endgame](https://cortex-docs.paloaltonetworks.com/cortex-agentix/configure-cortex-agentix/cortex-agentix-data-sources-and-connectors/vendor-specific-data-sources-and-connectors/endgame/endgame.md): Use Endgame data for Cortex AgentiX. - [Envoy](https://cortex-docs.paloaltonetworks.com/cortex-agentix/configure-cortex-agentix/cortex-agentix-data-sources-and-connectors/vendor-specific-data-sources-and-connectors/envoy.md): Configure the Envoy connector for Cortex AgentiX. - [Envoy](https://cortex-docs.paloaltonetworks.com/cortex-agentix/configure-cortex-agentix/cortex-agentix-data-sources-and-connectors/vendor-specific-data-sources-and-connectors/envoy/envoy.md): Use Envoy data for Cortex AgentiX. - [Exabeam](https://cortex-docs.paloaltonetworks.com/cortex-agentix/configure-cortex-agentix/cortex-agentix-data-sources-and-connectors/vendor-specific-data-sources-and-connectors/exabeam.md): Configure the Exabeam connector for Cortex AgentiX. - [Exabeam](https://cortex-docs.paloaltonetworks.com/cortex-agentix/configure-cortex-agentix/cortex-agentix-data-sources-and-connectors/vendor-specific-data-sources-and-connectors/exabeam/exabeam.md): Use Exabeam data for Cortex AgentiX. - [F5](https://cortex-docs.paloaltonetworks.com/cortex-agentix/configure-cortex-agentix/cortex-agentix-data-sources-and-connectors/vendor-specific-data-sources-and-connectors/f5.md): Configure the F5 connector for Cortex AgentiX. - [F5 Automation and Remediation](https://cortex-docs.paloaltonetworks.com/cortex-agentix/configure-cortex-agentix/cortex-agentix-data-sources-and-connectors/vendor-specific-data-sources-and-connectors/f5/f5-automation-and-remediation.md): Use F5 Automation and Remediation data for Cortex AgentiX. - [Fastly](https://cortex-docs.paloaltonetworks.com/cortex-agentix/configure-cortex-agentix/cortex-agentix-data-sources-and-connectors/vendor-specific-data-sources-and-connectors/fastly.md): Configure the Fastly connector for Cortex AgentiX. - [Fastly](https://cortex-docs.paloaltonetworks.com/cortex-agentix/configure-cortex-agentix/cortex-agentix-data-sources-and-connectors/vendor-specific-data-sources-and-connectors/fastly/fastly.md): Use Fastly data for Cortex AgentiX. - [Fidelis](https://cortex-docs.paloaltonetworks.com/cortex-agentix/configure-cortex-agentix/cortex-agentix-data-sources-and-connectors/vendor-specific-data-sources-and-connectors/fidelis.md): Configure the Fidelis connector for Cortex AgentiX. - [Fidelis](https://cortex-docs.paloaltonetworks.com/cortex-agentix/configure-cortex-agentix/cortex-agentix-data-sources-and-connectors/vendor-specific-data-sources-and-connectors/fidelis/fidelis.md): Use Fidelis data for Cortex AgentiX. - [Filigran](https://cortex-docs.paloaltonetworks.com/cortex-agentix/configure-cortex-agentix/cortex-agentix-data-sources-and-connectors/vendor-specific-data-sources-and-connectors/filigran.md): Configure the Filigran connector for Cortex AgentiX. - [Filigran OpenCTI](https://cortex-docs.paloaltonetworks.com/cortex-agentix/configure-cortex-agentix/cortex-agentix-data-sources-and-connectors/vendor-specific-data-sources-and-connectors/filigran/filigran-opencti.md): Use Filigran OpenCTI data for Cortex AgentiX. - [Forcepoint](https://cortex-docs.paloaltonetworks.com/cortex-agentix/configure-cortex-agentix/cortex-agentix-data-sources-and-connectors/vendor-specific-data-sources-and-connectors/forcepoint.md): Configure the Forcepoint data source and connector for Cortex AgentiX. - [Forcepoint DLP](https://cortex-docs.paloaltonetworks.com/cortex-agentix/configure-cortex-agentix/cortex-agentix-data-sources-and-connectors/vendor-specific-data-sources-and-connectors/forcepoint/forcepoint-dlp.md): Use Forcepoint DLP data for Cortex AgentiX. - [Forcepoint](https://cortex-docs.paloaltonetworks.com/cortex-agentix/configure-cortex-agentix/cortex-agentix-data-sources-and-connectors/vendor-specific-data-sources-and-connectors/forcepoint/forcepoint.md): Use Forcepoint data for Cortex AgentiX. - [ForeScout](https://cortex-docs.paloaltonetworks.com/cortex-agentix/configure-cortex-agentix/cortex-agentix-data-sources-and-connectors/vendor-specific-data-sources-and-connectors/forescout.md): Configure the ForeScout connector for Cortex AgentiX. - [ForeScout](https://cortex-docs.paloaltonetworks.com/cortex-agentix/configure-cortex-agentix/cortex-agentix-data-sources-and-connectors/vendor-specific-data-sources-and-connectors/forescout/forescout.md): Use ForeScout data for Cortex AgentiX. - [Fortinet](https://cortex-docs.paloaltonetworks.com/cortex-agentix/configure-cortex-agentix/cortex-agentix-data-sources-and-connectors/vendor-specific-data-sources-and-connectors/fortinet.md): Configure the Fortinet data source and connectors for Cortex AgentiX. - [Fortinet Fortigate](https://cortex-docs.paloaltonetworks.com/cortex-agentix/configure-cortex-agentix/cortex-agentix-data-sources-and-connectors/vendor-specific-data-sources-and-connectors/fortinet/fortinet-fortigate.md): Collect Fortinet Fortigate data for Cortex AgentiX. - [Fortinet FortiGate connector](https://cortex-docs.paloaltonetworks.com/cortex-agentix/configure-cortex-agentix/cortex-agentix-data-sources-and-connectors/vendor-specific-data-sources-and-connectors/fortinet/fortinet-fortigate/fortinet-fortigate-connector.md): Use Fortinet FortiGate data for Cortex AgentiX. - [Fortinet](https://cortex-docs.paloaltonetworks.com/cortex-agentix/configure-cortex-agentix/cortex-agentix-data-sources-and-connectors/vendor-specific-data-sources-and-connectors/fortinet/fortinet.md): Use Fortinet data for Cortex AgentiX. - [Fortinet FortiWeb VM](https://cortex-docs.paloaltonetworks.com/cortex-agentix/configure-cortex-agentix/cortex-agentix-data-sources-and-connectors/vendor-specific-data-sources-and-connectors/fortinet/fortinet-fortiweb-vm.md): Use Fortinet FortiWeb VM data for Cortex AgentiX. - [Fortra](https://cortex-docs.paloaltonetworks.com/cortex-agentix/configure-cortex-agentix/cortex-agentix-data-sources-and-connectors/vendor-specific-data-sources-and-connectors/fortra.md): Configure the Fortra connector for Cortex AgentiX. - [Fortra](https://cortex-docs.paloaltonetworks.com/cortex-agentix/configure-cortex-agentix/cortex-agentix-data-sources-and-connectors/vendor-specific-data-sources-and-connectors/fortra/fortra.md): Use Fortra data for Cortex AgentiX. - [FraudWatch](https://cortex-docs.paloaltonetworks.com/cortex-agentix/configure-cortex-agentix/cortex-agentix-data-sources-and-connectors/vendor-specific-data-sources-and-connectors/fraudwatch.md): Configure the FraudWatch connector for Cortex AgentiX. - [FraudWatch](https://cortex-docs.paloaltonetworks.com/cortex-agentix/configure-cortex-agentix/cortex-agentix-data-sources-and-connectors/vendor-specific-data-sources-and-connectors/fraudwatch/fraudwatch.md): Use FraudWatch data for Cortex AgentiX. - [Freshworks](https://cortex-docs.paloaltonetworks.com/cortex-agentix/configure-cortex-agentix/cortex-agentix-data-sources-and-connectors/vendor-specific-data-sources-and-connectors/freshworks.md): Configure the Freshworks connector for Cortex AgentiX. - [Freshworks](https://cortex-docs.paloaltonetworks.com/cortex-agentix/configure-cortex-agentix/cortex-agentix-data-sources-and-connectors/vendor-specific-data-sources-and-connectors/freshworks/freshworks.md): Use Freshworks data for Cortex AgentiX. - [Gamma.AI](https://cortex-docs.paloaltonetworks.com/cortex-agentix/configure-cortex-agentix/cortex-agentix-data-sources-and-connectors/vendor-specific-data-sources-and-connectors/gamma.ai.md): Configure the Gamma.AI connector for Cortex AgentiX. - [Gamma.AI](https://cortex-docs.paloaltonetworks.com/cortex-agentix/configure-cortex-agentix/cortex-agentix-data-sources-and-connectors/vendor-specific-data-sources-and-connectors/gamma.ai/gamma.ai.md): Use Gamma.AI data for Cortex AgentiX. - [Generic](https://cortex-docs.paloaltonetworks.com/cortex-agentix/configure-cortex-agentix/cortex-agentix-data-sources-and-connectors/vendor-specific-data-sources-and-connectors/generic.md): Configure the Generic connectors for Cortex AgentiX. - [Generic Intel Feed](https://cortex-docs.paloaltonetworks.com/cortex-agentix/configure-cortex-agentix/cortex-agentix-data-sources-and-connectors/vendor-specific-data-sources-and-connectors/generic/generic-intel-feed.md): Use Generic Intel Feed data for Cortex AgentiX. - [Generic MCP](https://cortex-docs.paloaltonetworks.com/cortex-agentix/configure-cortex-agentix/cortex-agentix-data-sources-and-connectors/vendor-specific-data-sources-and-connectors/generic/generic-mcp.md): Use Generic MCP data for Cortex AgentiX. - [Generic SQL](https://cortex-docs.paloaltonetworks.com/cortex-agentix/configure-cortex-agentix/cortex-agentix-data-sources-and-connectors/vendor-specific-data-sources-and-connectors/generic/generic-sql.md): Use Generic SQL data for Cortex AgentiX. - [Gigamon](https://cortex-docs.paloaltonetworks.com/cortex-agentix/configure-cortex-agentix/cortex-agentix-data-sources-and-connectors/vendor-specific-data-sources-and-connectors/gigamon.md): Configure the Gigamon connector for Cortex AgentiX. - [Gigamon](https://cortex-docs.paloaltonetworks.com/cortex-agentix/configure-cortex-agentix/cortex-agentix-data-sources-and-connectors/vendor-specific-data-sources-and-connectors/gigamon/gigamon.md): Use Gigamon data for Cortex AgentiX. - [GitHub](https://cortex-docs.paloaltonetworks.com/cortex-agentix/configure-cortex-agentix/cortex-agentix-data-sources-and-connectors/vendor-specific-data-sources-and-connectors/github.md): Configure the GitHub connector for Cortex AgentiX. - [GitHub](https://cortex-docs.paloaltonetworks.com/cortex-agentix/configure-cortex-agentix/cortex-agentix-data-sources-and-connectors/vendor-specific-data-sources-and-connectors/github/github.md): Use GitHub data for Cortex AgentiX. - [GitLab](https://cortex-docs.paloaltonetworks.com/cortex-agentix/configure-cortex-agentix/cortex-agentix-data-sources-and-connectors/vendor-specific-data-sources-and-connectors/gitlab.md): Configure the GitLab connector for Cortex AgentiX. - [GitLab Automation and Collection](https://cortex-docs.paloaltonetworks.com/cortex-agentix/configure-cortex-agentix/cortex-agentix-data-sources-and-connectors/vendor-specific-data-sources-and-connectors/gitlab/gitlab-automation-and-collection.md): Use GitLab Automation and Collection data for Cortex AgentiX. - [Giphy](https://cortex-docs.paloaltonetworks.com/cortex-agentix/configure-cortex-agentix/cortex-agentix-data-sources-and-connectors/vendor-specific-data-sources-and-connectors/giphy.md): Configure the Giphy connector for Cortex AgentiX. - [Giphy](https://cortex-docs.paloaltonetworks.com/cortex-agentix/configure-cortex-agentix/cortex-agentix-data-sources-and-connectors/vendor-specific-data-sources-and-connectors/giphy/giphy.md): Use Giphy data for Cortex AgentiX. - [Google](https://cortex-docs.paloaltonetworks.com/cortex-agentix/configure-cortex-agentix/cortex-agentix-data-sources-and-connectors/vendor-specific-data-sources-and-connectors/google.md): Configure the Google connectors for Cortex AgentiX. - [Google AI](https://cortex-docs.paloaltonetworks.com/cortex-agentix/configure-cortex-agentix/cortex-agentix-data-sources-and-connectors/vendor-specific-data-sources-and-connectors/google/google-ai.md): Use Google AI data for Cortex AgentiX. - [Google Cloud](https://cortex-docs.paloaltonetworks.com/cortex-agentix/configure-cortex-agentix/cortex-agentix-data-sources-and-connectors/vendor-specific-data-sources-and-connectors/google/google-cloud.md): Use Google Cloud data for Cortex AgentiX. - [Google SecOps](https://cortex-docs.paloaltonetworks.com/cortex-agentix/configure-cortex-agentix/cortex-agentix-data-sources-and-connectors/vendor-specific-data-sources-and-connectors/google/google-secops.md): Use Google SecOps data for Cortex AgentiX. - [Google Services](https://cortex-docs.paloaltonetworks.com/cortex-agentix/configure-cortex-agentix/cortex-agentix-data-sources-and-connectors/vendor-specific-data-sources-and-connectors/google/google-services.md): Use Google Services data for Cortex AgentiX. - [Google Workspace](https://cortex-docs.paloaltonetworks.com/cortex-agentix/configure-cortex-agentix/cortex-agentix-data-sources-and-connectors/vendor-specific-data-sources-and-connectors/google/google-workspace.md): Use Google Workspace data for Cortex AgentiX. - [Google Workspace connector](https://cortex-docs.paloaltonetworks.com/cortex-agentix/configure-cortex-agentix/cortex-agentix-data-sources-and-connectors/vendor-specific-data-sources-and-connectors/google/google-workspace/google-workspace-connector.md): Use Google Workspace connector data for Cortex AgentiX. - [Google Workspace Automation and Collection](https://cortex-docs.paloaltonetworks.com/cortex-agentix/configure-cortex-agentix/cortex-agentix-data-sources-and-connectors/vendor-specific-data-sources-and-connectors/google/google-workspace/google-workspace-automation-and-collection.md): Use Google Workspace Automation and Collection data for Cortex AgentiX. - [GraphQL](https://cortex-docs.paloaltonetworks.com/cortex-agentix/configure-cortex-agentix/cortex-agentix-data-sources-and-connectors/vendor-specific-data-sources-and-connectors/graphql.md): Configure the GraphQL connector for Cortex AgentiX. - [GraphQL](https://cortex-docs.paloaltonetworks.com/cortex-agentix/configure-cortex-agentix/cortex-agentix-data-sources-and-connectors/vendor-specific-data-sources-and-connectors/graphql/graphql.md): Use GraphQL data for Cortex AgentiX. - [Grouped Example Connector](https://cortex-docs.paloaltonetworks.com/cortex-agentix/configure-cortex-agentix/cortex-agentix-data-sources-and-connectors/vendor-specific-data-sources-and-connectors/grouped-example-connector.md): Configure the Grouped Example Connector connector for Cortex AgentiX. - [Grouped Example Connector](https://cortex-docs.paloaltonetworks.com/cortex-agentix/configure-cortex-agentix/cortex-agentix-data-sources-and-connectors/vendor-specific-data-sources-and-connectors/grouped-example-connector/grouped-example-connector.md): Use Grouped Example Connector data for Cortex AgentiX. - [GRR](https://cortex-docs.paloaltonetworks.com/cortex-agentix/configure-cortex-agentix/cortex-agentix-data-sources-and-connectors/vendor-specific-data-sources-and-connectors/grr.md): Configure the GRR connector for Cortex AgentiX. - [GRR](https://cortex-docs.paloaltonetworks.com/cortex-agentix/configure-cortex-agentix/cortex-agentix-data-sources-and-connectors/vendor-specific-data-sources-and-connectors/grr/grr.md): Use GRR data for Cortex AgentiX. - [Grafana](https://cortex-docs.paloaltonetworks.com/cortex-agentix/configure-cortex-agentix/cortex-agentix-data-sources-and-connectors/vendor-specific-data-sources-and-connectors/grafana.md): Configure the Grafana connector for Cortex AgentiX. - [Grafana](https://cortex-docs.paloaltonetworks.com/cortex-agentix/configure-cortex-agentix/cortex-agentix-data-sources-and-connectors/vendor-specific-data-sources-and-connectors/grafana/grafana.md): Use Grafana data for Cortex AgentiX. - [HashiCorp](https://cortex-docs.paloaltonetworks.com/cortex-agentix/configure-cortex-agentix/cortex-agentix-data-sources-and-connectors/vendor-specific-data-sources-and-connectors/hashicorp.md): Configure the HashiCorp connector for Cortex AgentiX. - [HashiCorp](https://cortex-docs.paloaltonetworks.com/cortex-agentix/configure-cortex-agentix/cortex-agentix-data-sources-and-connectors/vendor-specific-data-sources-and-connectors/hashicorp/hashicorp.md): Use HashiCorp data for Cortex AgentiX. - [Have I Been Pwnd](https://cortex-docs.paloaltonetworks.com/cortex-agentix/configure-cortex-agentix/cortex-agentix-data-sources-and-connectors/vendor-specific-data-sources-and-connectors/have-i-been-pwnd.md): Configure the Have I Been Pwnd connector for Cortex AgentiX. - [Have I Been Pwnd](https://cortex-docs.paloaltonetworks.com/cortex-agentix/configure-cortex-agentix/cortex-agentix-data-sources-and-connectors/vendor-specific-data-sources-and-connectors/have-i-been-pwnd/have-i-been-pwnd.md): Use Have I Been Pwnd data for Cortex AgentiX. - [HCL BigFix](https://cortex-docs.paloaltonetworks.com/cortex-agentix/configure-cortex-agentix/cortex-agentix-data-sources-and-connectors/vendor-specific-data-sources-and-connectors/hcl-bigfix.md): Configure the HCL BigFix connector for Cortex AgentiX. - [HCL BigFix](https://cortex-docs.paloaltonetworks.com/cortex-agentix/configure-cortex-agentix/cortex-agentix-data-sources-and-connectors/vendor-specific-data-sources-and-connectors/hcl-bigfix/hcl-bigfix.md): Use HCL BigFix data for Cortex AgentiX. - [HPE Aruba](https://cortex-docs.paloaltonetworks.com/cortex-agentix/configure-cortex-agentix/cortex-agentix-data-sources-and-connectors/vendor-specific-data-sources-and-connectors/hpe-aruba.md): Configure the HPE Aruba connector for Cortex AgentiX. - [HPE Aruba](https://cortex-docs.paloaltonetworks.com/cortex-agentix/configure-cortex-agentix/cortex-agentix-data-sources-and-connectors/vendor-specific-data-sources-and-connectors/hpe-aruba/hpe-aruba.md): Use HPE Aruba data for Cortex AgentiX. - [Hostio Solutions](https://cortex-docs.paloaltonetworks.com/cortex-agentix/configure-cortex-agentix/cortex-agentix-data-sources-and-connectors/vendor-specific-data-sources-and-connectors/hostio-solutions.md): Configure the Hostio Solutions connector for Cortex AgentiX. - [Hostio Solutions](https://cortex-docs.paloaltonetworks.com/cortex-agentix/configure-cortex-agentix/cortex-agentix-data-sources-and-connectors/vendor-specific-data-sources-and-connectors/hostio-solutions/hostio-solutions.md): Use Hostio Solutions data for Cortex AgentiX. - [IBM](https://cortex-docs.paloaltonetworks.com/cortex-agentix/configure-cortex-agentix/cortex-agentix-data-sources-and-connectors/vendor-specific-data-sources-and-connectors/ibm.md): Configure the IBM connectors for Cortex AgentiX. - [IBM QRadar](https://cortex-docs.paloaltonetworks.com/cortex-agentix/configure-cortex-agentix/cortex-agentix-data-sources-and-connectors/vendor-specific-data-sources-and-connectors/ibm/ibm-qradar.md): Use IBM QRadar data for Cortex AgentiX. - [IBM Security](https://cortex-docs.paloaltonetworks.com/cortex-agentix/configure-cortex-agentix/cortex-agentix-data-sources-and-connectors/vendor-specific-data-sources-and-connectors/ibm/ibm-security.md): Use IBM Security data for Cortex AgentiX. - [Imperva](https://cortex-docs.paloaltonetworks.com/cortex-agentix/configure-cortex-agentix/cortex-agentix-data-sources-and-connectors/vendor-specific-data-sources-and-connectors/imperva.md): Configure the Imperva connector for Cortex AgentiX. - [Imperva](https://cortex-docs.paloaltonetworks.com/cortex-agentix/configure-cortex-agentix/cortex-agentix-data-sources-and-connectors/vendor-specific-data-sources-and-connectors/imperva/imperva.md): Use Imperva data for Cortex AgentiX. - [InfoArmor](https://cortex-docs.paloaltonetworks.com/cortex-agentix/configure-cortex-agentix/cortex-agentix-data-sources-and-connectors/vendor-specific-data-sources-and-connectors/infoarmor.md): Configure the InfoArmor connector for Cortex AgentiX. - [InfoArmor](https://cortex-docs.paloaltonetworks.com/cortex-agentix/configure-cortex-agentix/cortex-agentix-data-sources-and-connectors/vendor-specific-data-sources-and-connectors/infoarmor/infoarmor.md): Use InfoArmor data for Cortex AgentiX. - [Intellum](https://cortex-docs.paloaltonetworks.com/cortex-agentix/configure-cortex-agentix/cortex-agentix-data-sources-and-connectors/vendor-specific-data-sources-and-connectors/intellum.md): Configure the Intellum connector for Cortex AgentiX. - [Intellum](https://cortex-docs.paloaltonetworks.com/cortex-agentix/configure-cortex-agentix/cortex-agentix-data-sources-and-connectors/vendor-specific-data-sources-and-connectors/intellum/intellum.md): Use Intellum data for Cortex AgentiX. - [IPInfo.io](https://cortex-docs.paloaltonetworks.com/cortex-agentix/configure-cortex-agentix/cortex-agentix-data-sources-and-connectors/vendor-specific-data-sources-and-connectors/ipinfo.io.md): Configure the IPInfo.io connector for Cortex AgentiX. - [IPInfo.io](https://cortex-docs.paloaltonetworks.com/cortex-agentix/configure-cortex-agentix/cortex-agentix-data-sources-and-connectors/vendor-specific-data-sources-and-connectors/ipinfo.io/ipinfo.io.md): Use IPInfo.io data for Cortex AgentiX. - [IPstack](https://cortex-docs.paloaltonetworks.com/cortex-agentix/configure-cortex-agentix/cortex-agentix-data-sources-and-connectors/vendor-specific-data-sources-and-connectors/ipstack.md): Configure the IPstack connector for Cortex AgentiX. - [IPstack](https://cortex-docs.paloaltonetworks.com/cortex-agentix/configure-cortex-agentix/cortex-agentix-data-sources-and-connectors/vendor-specific-data-sources-and-connectors/ipstack/ipstack.md): Use IPstack data for Cortex AgentiX. - [Ivanti](https://cortex-docs.paloaltonetworks.com/cortex-agentix/configure-cortex-agentix/cortex-agentix-data-sources-and-connectors/vendor-specific-data-sources-and-connectors/ivanti.md): Configure the Ivanti connector for Cortex AgentiX. - [Ivanti](https://cortex-docs.paloaltonetworks.com/cortex-agentix/configure-cortex-agentix/cortex-agentix-data-sources-and-connectors/vendor-specific-data-sources-and-connectors/ivanti/ivanti.md): Use Ivanti data for Cortex AgentiX. - [iZOOlogic](https://cortex-docs.paloaltonetworks.com/cortex-agentix/configure-cortex-agentix/cortex-agentix-data-sources-and-connectors/vendor-specific-data-sources-and-connectors/izoologic.md): Configure the iZOOlogic connector for Cortex AgentiX. - [iZOOlogic](https://cortex-docs.paloaltonetworks.com/cortex-agentix/configure-cortex-agentix/cortex-agentix-data-sources-and-connectors/vendor-specific-data-sources-and-connectors/izoologic/izoologic.md): Use iZOOlogic data for Cortex AgentiX. - [Jamf](https://cortex-docs.paloaltonetworks.com/cortex-agentix/configure-cortex-agentix/cortex-agentix-data-sources-and-connectors/vendor-specific-data-sources-and-connectors/jamf.md): Configure the Jamf connector for Cortex AgentiX. - [Jamf](https://cortex-docs.paloaltonetworks.com/cortex-agentix/configure-cortex-agentix/cortex-agentix-data-sources-and-connectors/vendor-specific-data-sources-and-connectors/jamf/jamf.md): Use Jamf data for Cortex AgentiX. - [Joe Security](https://cortex-docs.paloaltonetworks.com/cortex-agentix/configure-cortex-agentix/cortex-agentix-data-sources-and-connectors/vendor-specific-data-sources-and-connectors/joe-security.md): Configure the Joe Security connector for Cortex AgentiX. - [Joe Security](https://cortex-docs.paloaltonetworks.com/cortex-agentix/configure-cortex-agentix/cortex-agentix-data-sources-and-connectors/vendor-specific-data-sources-and-connectors/joe-security/joe-security.md): Use Joe Security data for Cortex AgentiX. - [JSONWhoIs.com](https://cortex-docs.paloaltonetworks.com/cortex-agentix/configure-cortex-agentix/cortex-agentix-data-sources-and-connectors/vendor-specific-data-sources-and-connectors/jsonwhois.com.md): Configure the JSONWhoIs.com connector for Cortex AgentiX. - [JSONWhoIs.com](https://cortex-docs.paloaltonetworks.com/cortex-agentix/configure-cortex-agentix/cortex-agentix-data-sources-and-connectors/vendor-specific-data-sources-and-connectors/jsonwhois.com/jsonwhois.com.md): Use JSONWhoIs.com data for Cortex AgentiX. - [Kafka](https://cortex-docs.paloaltonetworks.com/cortex-agentix/configure-cortex-agentix/cortex-agentix-data-sources-and-connectors/vendor-specific-data-sources-and-connectors/kafka.md): Configure the Kafka connector for Cortex AgentiX. - [Kafka](https://cortex-docs.paloaltonetworks.com/cortex-agentix/configure-cortex-agentix/cortex-agentix-data-sources-and-connectors/vendor-specific-data-sources-and-connectors/kafka/kafka.md): Use Kafka data for Cortex AgentiX. - [Kaspersky](https://cortex-docs.paloaltonetworks.com/cortex-agentix/configure-cortex-agentix/cortex-agentix-data-sources-and-connectors/vendor-specific-data-sources-and-connectors/kaspersky.md): Configure the Kaspersky connector for Cortex AgentiX. - [Kaspersky](https://cortex-docs.paloaltonetworks.com/cortex-agentix/configure-cortex-agentix/cortex-agentix-data-sources-and-connectors/vendor-specific-data-sources-and-connectors/kaspersky/kaspersky.md): Use Kaspersky data for Cortex AgentiX. - [Koi](https://cortex-docs.paloaltonetworks.com/cortex-agentix/configure-cortex-agentix/cortex-agentix-data-sources-and-connectors/vendor-specific-data-sources-and-connectors/koi.md): Configure the Koi connector for Cortex AgentiX. - [Koi](https://cortex-docs.paloaltonetworks.com/cortex-agentix/configure-cortex-agentix/cortex-agentix-data-sources-and-connectors/vendor-specific-data-sources-and-connectors/koi/koi.md): Use Koi data for Cortex AgentiX. - [Koodous](https://cortex-docs.paloaltonetworks.com/cortex-agentix/configure-cortex-agentix/cortex-agentix-data-sources-and-connectors/vendor-specific-data-sources-and-connectors/koodous.md): Configure the Koodous connector for Cortex AgentiX. - [Koodous](https://cortex-docs.paloaltonetworks.com/cortex-agentix/configure-cortex-agentix/cortex-agentix-data-sources-and-connectors/vendor-specific-data-sources-and-connectors/koodous/koodous.md): Use Koodous data for Cortex AgentiX. - [Lastline](https://cortex-docs.paloaltonetworks.com/cortex-agentix/configure-cortex-agentix/cortex-agentix-data-sources-and-connectors/vendor-specific-data-sources-and-connectors/lastline.md): Configure the Lastline connector for Cortex AgentiX. - [Lastline](https://cortex-docs.paloaltonetworks.com/cortex-agentix/configure-cortex-agentix/cortex-agentix-data-sources-and-connectors/vendor-specific-data-sources-and-connectors/lastline/lastline.md): Use Lastline data for Cortex AgentiX. - [LevelBlue](https://cortex-docs.paloaltonetworks.com/cortex-agentix/configure-cortex-agentix/cortex-agentix-data-sources-and-connectors/vendor-specific-data-sources-and-connectors/levelblue.md): Configure the LevelBlue connector for Cortex AgentiX. - [LevelBlue](https://cortex-docs.paloaltonetworks.com/cortex-agentix/configure-cortex-agentix/cortex-agentix-data-sources-and-connectors/vendor-specific-data-sources-and-connectors/levelblue/levelblue.md): Use LevelBlue data for Cortex AgentiX. - [LogRhythm](https://cortex-docs.paloaltonetworks.com/cortex-agentix/configure-cortex-agentix/cortex-agentix-data-sources-and-connectors/vendor-specific-data-sources-and-connectors/logrhythm.md): Configure the LogRhythm connector for Cortex AgentiX. - [LogRhythm](https://cortex-docs.paloaltonetworks.com/cortex-agentix/configure-cortex-agentix/cortex-agentix-data-sources-and-connectors/vendor-specific-data-sources-and-connectors/logrhythm/logrhythm.md): Use LogRhythm data for Cortex AgentiX. - [LOLBAS](https://cortex-docs.paloaltonetworks.com/cortex-agentix/configure-cortex-agentix/cortex-agentix-data-sources-and-connectors/vendor-specific-data-sources-and-connectors/lolbas.md): Configure the LOLBAS connector for Cortex AgentiX. - [LOLBAS](https://cortex-docs.paloaltonetworks.com/cortex-agentix/configure-cortex-agentix/cortex-agentix-data-sources-and-connectors/vendor-specific-data-sources-and-connectors/lolbas/lolbas.md): Use LOLBAS data for Cortex AgentiX. - [Lookout](https://cortex-docs.paloaltonetworks.com/cortex-agentix/configure-cortex-agentix/cortex-agentix-data-sources-and-connectors/vendor-specific-data-sources-and-connectors/lookout.md): Configure the Lookout connector for Cortex AgentiX. - [Lookout](https://cortex-docs.paloaltonetworks.com/cortex-agentix/configure-cortex-agentix/cortex-agentix-data-sources-and-connectors/vendor-specific-data-sources-and-connectors/lookout/lookout.md): Use Lookout data for Cortex AgentiX. - [Lumu](https://cortex-docs.paloaltonetworks.com/cortex-agentix/configure-cortex-agentix/cortex-agentix-data-sources-and-connectors/vendor-specific-data-sources-and-connectors/lumu.md): Configure the Lumu connector for Cortex AgentiX. - [Lumu](https://cortex-docs.paloaltonetworks.com/cortex-agentix/configure-cortex-agentix/cortex-agentix-data-sources-and-connectors/vendor-specific-data-sources-and-connectors/lumu/lumu.md): Use Lumu data for Cortex AgentiX. - [Mail Utilities](https://cortex-docs.paloaltonetworks.com/cortex-agentix/configure-cortex-agentix/cortex-agentix-data-sources-and-connectors/vendor-specific-data-sources-and-connectors/mail-utilities.md): Configure the Mail Utilities connector for Cortex AgentiX. - [Mail Utilities](https://cortex-docs.paloaltonetworks.com/cortex-agentix/configure-cortex-agentix/cortex-agentix-data-sources-and-connectors/vendor-specific-data-sources-and-connectors/mail-utilities/mail-utilities.md): Use Mail Utilities data for Cortex AgentiX. - [Majestic](https://cortex-docs.paloaltonetworks.com/cortex-agentix/configure-cortex-agentix/cortex-agentix-data-sources-and-connectors/vendor-specific-data-sources-and-connectors/majestic.md): Configure the Majestic connector for Cortex AgentiX. - [Majestic](https://cortex-docs.paloaltonetworks.com/cortex-agentix/configure-cortex-agentix/cortex-agentix-data-sources-and-connectors/vendor-specific-data-sources-and-connectors/majestic/majestic.md): Use Majestic data for Cortex AgentiX. - [ManageEngine](https://cortex-docs.paloaltonetworks.com/cortex-agentix/configure-cortex-agentix/cortex-agentix-data-sources-and-connectors/vendor-specific-data-sources-and-connectors/manageengine.md): Configure the ManageEngine connector for Cortex AgentiX. - [ManageEngine](https://cortex-docs.paloaltonetworks.com/cortex-agentix/configure-cortex-agentix/cortex-agentix-data-sources-and-connectors/vendor-specific-data-sources-and-connectors/manageengine/manageengine.md): Use ManageEngine data for Cortex AgentiX. - [Mattermost](https://cortex-docs.paloaltonetworks.com/cortex-agentix/configure-cortex-agentix/cortex-agentix-data-sources-and-connectors/vendor-specific-data-sources-and-connectors/mattermost.md): Configure the Mattermost connector for Cortex AgentiX. - [Mattermost](https://cortex-docs.paloaltonetworks.com/cortex-agentix/configure-cortex-agentix/cortex-agentix-data-sources-and-connectors/vendor-specific-data-sources-and-connectors/mattermost/mattermost.md): Use Mattermost data for Cortex AgentiX. - [MaxMind](https://cortex-docs.paloaltonetworks.com/cortex-agentix/configure-cortex-agentix/cortex-agentix-data-sources-and-connectors/vendor-specific-data-sources-and-connectors/maxmind.md): Configure the MaxMind connector for Cortex AgentiX. - [MaxMind](https://cortex-docs.paloaltonetworks.com/cortex-agentix/configure-cortex-agentix/cortex-agentix-data-sources-and-connectors/vendor-specific-data-sources-and-connectors/maxmind/maxmind.md): Use MaxMind data for Cortex AgentiX. - [Meta](https://cortex-docs.paloaltonetworks.com/cortex-agentix/configure-cortex-agentix/cortex-agentix-data-sources-and-connectors/vendor-specific-data-sources-and-connectors/meta.md): Configure the Meta connector for Cortex AgentiX. - [Meta](https://cortex-docs.paloaltonetworks.com/cortex-agentix/configure-cortex-agentix/cortex-agentix-data-sources-and-connectors/vendor-specific-data-sources-and-connectors/meta/meta.md): Use Meta data for Cortex AgentiX. - [Mimecast](https://cortex-docs.paloaltonetworks.com/cortex-agentix/configure-cortex-agentix/cortex-agentix-data-sources-and-connectors/vendor-specific-data-sources-and-connectors/mimecast.md): Configure the Mimecast connector for Cortex AgentiX. - [Mimecast](https://cortex-docs.paloaltonetworks.com/cortex-agentix/configure-cortex-agentix/cortex-agentix-data-sources-and-connectors/vendor-specific-data-sources-and-connectors/mimecast/mimecast.md): Use Mimecast data for Cortex AgentiX. - [Microsoft](https://cortex-docs.paloaltonetworks.com/cortex-agentix/configure-cortex-agentix/cortex-agentix-data-sources-and-connectors/vendor-specific-data-sources-and-connectors/microsoft.md): Configure the Microsoft connectors for Cortex AgentiX. - [Azure DevOps](https://cortex-docs.paloaltonetworks.com/cortex-agentix/configure-cortex-agentix/cortex-agentix-data-sources-and-connectors/vendor-specific-data-sources-and-connectors/microsoft/azure-devops.md): Use Azure DevOps data for Cortex AgentiX. - [Azure Firewall](https://cortex-docs.paloaltonetworks.com/cortex-agentix/configure-cortex-agentix/cortex-agentix-data-sources-and-connectors/vendor-specific-data-sources-and-connectors/microsoft/azure-firewall.md): Use Azure Firewall data for Cortex AgentiX. - [Microsoft 365](https://cortex-docs.paloaltonetworks.com/cortex-agentix/configure-cortex-agentix/cortex-agentix-data-sources-and-connectors/vendor-specific-data-sources-and-connectors/microsoft/microsoft-365.md): Use Microsoft 365 data for Cortex AgentiX. - [Azure Log Analytics](https://cortex-docs.paloaltonetworks.com/cortex-agentix/configure-cortex-agentix/cortex-agentix-data-sources-and-connectors/vendor-specific-data-sources-and-connectors/microsoft/azure-log-analytics.md): Use Azure Log Analytics data for Cortex AgentiX. - [Azure Services](https://cortex-docs.paloaltonetworks.com/cortex-agentix/configure-cortex-agentix/cortex-agentix-data-sources-and-connectors/vendor-specific-data-sources-and-connectors/microsoft/azure-services.md): Use Azure Services data for Cortex AgentiX. - [Azure WAF](https://cortex-docs.paloaltonetworks.com/cortex-agentix/configure-cortex-agentix/cortex-agentix-data-sources-and-connectors/vendor-specific-data-sources-and-connectors/microsoft/azure-waf.md): Use Azure WAF data for Cortex AgentiX. - [Microsoft Active Directory](https://cortex-docs.paloaltonetworks.com/cortex-agentix/configure-cortex-agentix/cortex-agentix-data-sources-and-connectors/vendor-specific-data-sources-and-connectors/microsoft/microsoft-active-directory.md): Use Microsoft Active Directory data for Cortex AgentiX. - [Microsoft Graph](https://cortex-docs.paloaltonetworks.com/cortex-agentix/configure-cortex-agentix/cortex-agentix-data-sources-and-connectors/vendor-specific-data-sources-and-connectors/microsoft/microsoft-graph.md): Use Microsoft Graph data for Cortex AgentiX. - [Microsoft Identity](https://cortex-docs.paloaltonetworks.com/cortex-agentix/configure-cortex-agentix/cortex-agentix-data-sources-and-connectors/vendor-specific-data-sources-and-connectors/microsoft/microsoft-identity.md): Use Microsoft Identity data for Cortex AgentiX. - [Microsoft Intune](https://cortex-docs.paloaltonetworks.com/cortex-agentix/configure-cortex-agentix/cortex-agentix-data-sources-and-connectors/vendor-specific-data-sources-and-connectors/microsoft/microsoft-intune.md): Use Microsoft Intune data for Cortex AgentiX. - [Microsoft Security Automation and Collection](https://cortex-docs.paloaltonetworks.com/cortex-agentix/configure-cortex-agentix/cortex-agentix-data-sources-and-connectors/vendor-specific-data-sources-and-connectors/microsoft/microsoft-security-automation-and-collection.md): Use Microsoft Security Automation and Collection data for Cortex AgentiX. - [Microsoft Windows Tools](https://cortex-docs.paloaltonetworks.com/cortex-agentix/configure-cortex-agentix/cortex-agentix-data-sources-and-connectors/vendor-specific-data-sources-and-connectors/microsoft/microsoft-windows-tools.md): Use Microsoft Windows Tools data for Cortex AgentiX. - [M365 Automation and Collection](https://cortex-docs.paloaltonetworks.com/cortex-agentix/configure-cortex-agentix/cortex-agentix-data-sources-and-connectors/vendor-specific-data-sources-and-connectors/microsoft/m365-automation-and-collection.md): Use M365 Automation and Collection data for Cortex AgentiX. - [MISP](https://cortex-docs.paloaltonetworks.com/cortex-agentix/configure-cortex-agentix/cortex-agentix-data-sources-and-connectors/vendor-specific-data-sources-and-connectors/misp.md): Configure the MISP connector for Cortex AgentiX. - [MISP](https://cortex-docs.paloaltonetworks.com/cortex-agentix/configure-cortex-agentix/cortex-agentix-data-sources-and-connectors/vendor-specific-data-sources-and-connectors/misp/misp.md): Use MISP data for Cortex AgentiX. - [MITRE](https://cortex-docs.paloaltonetworks.com/cortex-agentix/configure-cortex-agentix/cortex-agentix-data-sources-and-connectors/vendor-specific-data-sources-and-connectors/mitre.md): Configure the MITRE connector for Cortex AgentiX. - [MITRE](https://cortex-docs.paloaltonetworks.com/cortex-agentix/configure-cortex-agentix/cortex-agentix-data-sources-and-connectors/vendor-specific-data-sources-and-connectors/mitre/mitre.md): Use MITRE data for Cortex AgentiX. - [MongoDB](https://cortex-docs.paloaltonetworks.com/cortex-agentix/configure-cortex-agentix/cortex-agentix-data-sources-and-connectors/vendor-specific-data-sources-and-connectors/mongodb.md): Configure the MongoDB connector for Cortex AgentiX. - [MongoDB](https://cortex-docs.paloaltonetworks.com/cortex-agentix/configure-cortex-agentix/cortex-agentix-data-sources-and-connectors/vendor-specific-data-sources-and-connectors/mongodb/mongodb.md): Use MongoDB data for Cortex AgentiX. - [MxToolBox](https://cortex-docs.paloaltonetworks.com/cortex-agentix/configure-cortex-agentix/cortex-agentix-data-sources-and-connectors/vendor-specific-data-sources-and-connectors/mxtoolbox.md): Configure the MxToolBox connector for Cortex AgentiX. - [MxToolBox](https://cortex-docs.paloaltonetworks.com/cortex-agentix/configure-cortex-agentix/cortex-agentix-data-sources-and-connectors/vendor-specific-data-sources-and-connectors/mxtoolbox/mxtoolbox.md): Use MxToolBox data for Cortex AgentiX. - [Netcraft](https://cortex-docs.paloaltonetworks.com/cortex-agentix/configure-cortex-agentix/cortex-agentix-data-sources-and-connectors/vendor-specific-data-sources-and-connectors/netcraft.md): Configure the Netcraft connector for Cortex AgentiX. - [Netcraft](https://cortex-docs.paloaltonetworks.com/cortex-agentix/configure-cortex-agentix/cortex-agentix-data-sources-and-connectors/vendor-specific-data-sources-and-connectors/netcraft/netcraft.md): Use Netcraft data for Cortex AgentiX. - [Netmiko](https://cortex-docs.paloaltonetworks.com/cortex-agentix/configure-cortex-agentix/cortex-agentix-data-sources-and-connectors/vendor-specific-data-sources-and-connectors/netmiko.md): Configure the Netmiko connector for Cortex AgentiX. - [Netmiko](https://cortex-docs.paloaltonetworks.com/cortex-agentix/configure-cortex-agentix/cortex-agentix-data-sources-and-connectors/vendor-specific-data-sources-and-connectors/netmiko/netmiko.md): Use Netmiko data for Cortex AgentiX. - [NetQuest](https://cortex-docs.paloaltonetworks.com/cortex-agentix/configure-cortex-agentix/cortex-agentix-data-sources-and-connectors/vendor-specific-data-sources-and-connectors/netquest.md): Configure the NetQuest connector for Cortex AgentiX. - [NetQuest](https://cortex-docs.paloaltonetworks.com/cortex-agentix/configure-cortex-agentix/cortex-agentix-data-sources-and-connectors/vendor-specific-data-sources-and-connectors/netquest/netquest.md): Use NetQuest data for Cortex AgentiX. - [Netskope](https://cortex-docs.paloaltonetworks.com/cortex-agentix/configure-cortex-agentix/cortex-agentix-data-sources-and-connectors/vendor-specific-data-sources-and-connectors/netskope.md): Configure the Netskope connector for Cortex AgentiX. - [Netskope](https://cortex-docs.paloaltonetworks.com/cortex-agentix/configure-cortex-agentix/cortex-agentix-data-sources-and-connectors/vendor-specific-data-sources-and-connectors/netskope/netskope.md): Use Netskope data for Cortex AgentiX. - [NIST](https://cortex-docs.paloaltonetworks.com/cortex-agentix/configure-cortex-agentix/cortex-agentix-data-sources-and-connectors/vendor-specific-data-sources-and-connectors/nist.md): Configure the NIST connector for Cortex AgentiX. - [NIST](https://cortex-docs.paloaltonetworks.com/cortex-agentix/configure-cortex-agentix/cortex-agentix-data-sources-and-connectors/vendor-specific-data-sources-and-connectors/nist/nist.md): Use NIST data for Cortex AgentiX. - [nmap](https://cortex-docs.paloaltonetworks.com/cortex-agentix/configure-cortex-agentix/cortex-agentix-data-sources-and-connectors/vendor-specific-data-sources-and-connectors/nmap.md): Configure the nmap connector for Cortex AgentiX. - [nmap](https://cortex-docs.paloaltonetworks.com/cortex-agentix/configure-cortex-agentix/cortex-agentix-data-sources-and-connectors/vendor-specific-data-sources-and-connectors/nmap/nmap.md): Use nmap data for Cortex AgentiX. - [NAVEX](https://cortex-docs.paloaltonetworks.com/cortex-agentix/configure-cortex-agentix/cortex-agentix-data-sources-and-connectors/vendor-specific-data-sources-and-connectors/navex.md): Configure the NAVEX connector for Cortex AgentiX. - [NAVEX](https://cortex-docs.paloaltonetworks.com/cortex-agentix/configure-cortex-agentix/cortex-agentix-data-sources-and-connectors/vendor-specific-data-sources-and-connectors/navex/navex.md): Use NAVEX data for Cortex AgentiX. - [Nutanix](https://cortex-docs.paloaltonetworks.com/cortex-agentix/configure-cortex-agentix/cortex-agentix-data-sources-and-connectors/vendor-specific-data-sources-and-connectors/nutanix.md): Configure the Nutanix connector for Cortex AgentiX. - [Nutanix](https://cortex-docs.paloaltonetworks.com/cortex-agentix/configure-cortex-agentix/cortex-agentix-data-sources-and-connectors/vendor-specific-data-sources-and-connectors/nutanix/nutanix.md): Use Nutanix data for Cortex AgentiX. - [Okta](https://cortex-docs.paloaltonetworks.com/cortex-agentix/configure-cortex-agentix/cortex-agentix-data-sources-and-connectors/vendor-specific-data-sources-and-connectors/okta.md): Configure the Okta connector for Cortex AgentiX. - [Okta Automation and Collection](https://cortex-docs.paloaltonetworks.com/cortex-agentix/configure-cortex-agentix/cortex-agentix-data-sources-and-connectors/vendor-specific-data-sources-and-connectors/okta/okta-automation-and-collection.md): Use Okta Automation and Collection data for Cortex AgentiX. - [OpenAI](https://cortex-docs.paloaltonetworks.com/cortex-agentix/configure-cortex-agentix/cortex-agentix-data-sources-and-connectors/vendor-specific-data-sources-and-connectors/openai.md): Configure the OpenAI connector for Cortex AgentiX. - [OpenAI](https://cortex-docs.paloaltonetworks.com/cortex-agentix/configure-cortex-agentix/cortex-agentix-data-sources-and-connectors/vendor-specific-data-sources-and-connectors/openai/openai.md): Use OpenAI data for Cortex AgentiX. - [OpenCVE](https://cortex-docs.paloaltonetworks.com/cortex-agentix/configure-cortex-agentix/cortex-agentix-data-sources-and-connectors/vendor-specific-data-sources-and-connectors/opencve.md): Configure the OpenCVE connector for Cortex AgentiX. - [OpenCVE](https://cortex-docs.paloaltonetworks.com/cortex-agentix/configure-cortex-agentix/cortex-agentix-data-sources-and-connectors/vendor-specific-data-sources-and-connectors/opencve/opencve.md): Use OpenCVE data for Cortex AgentiX. - [OpenLDAP](https://cortex-docs.paloaltonetworks.com/cortex-agentix/configure-cortex-agentix/cortex-agentix-data-sources-and-connectors/vendor-specific-data-sources-and-connectors/openldap.md): Configure the OpenLDAP connector for Cortex AgentiX. - [OpenLDAP](https://cortex-docs.paloaltonetworks.com/cortex-agentix/configure-cortex-agentix/cortex-agentix-data-sources-and-connectors/vendor-specific-data-sources-and-connectors/openldap/openldap.md): Use OpenLDAP data for Cortex AgentiX. - [OpenPhish](https://cortex-docs.paloaltonetworks.com/cortex-agentix/configure-cortex-agentix/cortex-agentix-data-sources-and-connectors/vendor-specific-data-sources-and-connectors/openphish.md): Configure the OpenPhish connector for Cortex AgentiX. - [OpenPhish](https://cortex-docs.paloaltonetworks.com/cortex-agentix/configure-cortex-agentix/cortex-agentix-data-sources-and-connectors/vendor-specific-data-sources-and-connectors/openphish/openphish.md): Use OpenPhish data for Cortex AgentiX. - [OpenText](https://cortex-docs.paloaltonetworks.com/cortex-agentix/configure-cortex-agentix/cortex-agentix-data-sources-and-connectors/vendor-specific-data-sources-and-connectors/opentext.md): Configure the OpenText connectors for Cortex AgentiX. - [OpenText EnCase Endpoint Security](https://cortex-docs.paloaltonetworks.com/cortex-agentix/configure-cortex-agentix/cortex-agentix-data-sources-and-connectors/vendor-specific-data-sources-and-connectors/opentext/opentext-encase-endpoint-security.md): Use OpenText EnCase Endpoint Security data for Cortex AgentiX. - [OpenText Service Manager](https://cortex-docs.paloaltonetworks.com/cortex-agentix/configure-cortex-agentix/cortex-agentix-data-sources-and-connectors/vendor-specific-data-sources-and-connectors/opentext/opentext-service-manager.md): Use OpenText Service Manager data for Cortex AgentiX. - [OpenText Vertica](https://cortex-docs.paloaltonetworks.com/cortex-agentix/configure-cortex-agentix/cortex-agentix-data-sources-and-connectors/vendor-specific-data-sources-and-connectors/opentext/opentext-vertica.md): Use OpenText Vertica data for Cortex AgentiX. - [OPSWAT](https://cortex-docs.paloaltonetworks.com/cortex-agentix/configure-cortex-agentix/cortex-agentix-data-sources-and-connectors/vendor-specific-data-sources-and-connectors/opswat.md): Configure the OPSWAT connector for Cortex AgentiX. - [OPSWAT MetaDefender](https://cortex-docs.paloaltonetworks.com/cortex-agentix/configure-cortex-agentix/cortex-agentix-data-sources-and-connectors/vendor-specific-data-sources-and-connectors/opswat/opswat-metadefender.md): Use OPSWAT MetaDefender data for Cortex AgentiX. - [Oracle](https://cortex-docs.paloaltonetworks.com/cortex-agentix/configure-cortex-agentix/cortex-agentix-data-sources-and-connectors/vendor-specific-data-sources-and-connectors/oracle.md): Configure the Oracle connector for Cortex AgentiX. - [Oracle](https://cortex-docs.paloaltonetworks.com/cortex-agentix/configure-cortex-agentix/cortex-agentix-data-sources-and-connectors/vendor-specific-data-sources-and-connectors/oracle/oracle.md): Use Oracle data for Cortex AgentiX. - [PacketMail.net](https://cortex-docs.paloaltonetworks.com/cortex-agentix/configure-cortex-agentix/cortex-agentix-data-sources-and-connectors/vendor-specific-data-sources-and-connectors/packetmail.net.md): Configure the PacketMail.net connector for Cortex AgentiX. - [PacketMail.net](https://cortex-docs.paloaltonetworks.com/cortex-agentix/configure-cortex-agentix/cortex-agentix-data-sources-and-connectors/vendor-specific-data-sources-and-connectors/packetmail.net/packetmail.net.md): Use PacketMail.net data for Cortex AgentiX. - [PacketSled](https://cortex-docs.paloaltonetworks.com/cortex-agentix/configure-cortex-agentix/cortex-agentix-data-sources-and-connectors/vendor-specific-data-sources-and-connectors/packetsled.md): Configure the PacketSled connector for Cortex AgentiX. - [PacketSled](https://cortex-docs.paloaltonetworks.com/cortex-agentix/configure-cortex-agentix/cortex-agentix-data-sources-and-connectors/vendor-specific-data-sources-and-connectors/packetsled/packetsled.md): Use PacketSled data for Cortex AgentiX. - [PagerDuty](https://cortex-docs.paloaltonetworks.com/cortex-agentix/configure-cortex-agentix/cortex-agentix-data-sources-and-connectors/vendor-specific-data-sources-and-connectors/pagerduty.md): Configure the PagerDuty connector for Cortex AgentiX. - [PagerDuty Automation and Collection](https://cortex-docs.paloaltonetworks.com/cortex-agentix/configure-cortex-agentix/cortex-agentix-data-sources-and-connectors/vendor-specific-data-sources-and-connectors/pagerduty/pagerduty-automation-and-collection.md): Use PagerDuty Automation and Collection data for Cortex AgentiX. - [PAT Helpdesk Advanced](https://cortex-docs.paloaltonetworks.com/cortex-agentix/configure-cortex-agentix/cortex-agentix-data-sources-and-connectors/vendor-specific-data-sources-and-connectors/pat-helpdesk-advanced.md): Configure the PAT Helpdesk Advanced connector for Cortex AgentiX. - [PAT Helpdesk Advanced](https://cortex-docs.paloaltonetworks.com/cortex-agentix/configure-cortex-agentix/cortex-agentix-data-sources-and-connectors/vendor-specific-data-sources-and-connectors/pat-helpdesk-advanced/pat-helpdesk-advanced.md): Use PAT Helpdesk Advanced data for Cortex AgentiX. - [PhishLabs](https://cortex-docs.paloaltonetworks.com/cortex-agentix/configure-cortex-agentix/cortex-agentix-data-sources-and-connectors/vendor-specific-data-sources-and-connectors/phishlabs.md): Configure the PhishLabs connector for Cortex AgentiX. - [PhishLabs](https://cortex-docs.paloaltonetworks.com/cortex-agentix/configure-cortex-agentix/cortex-agentix-data-sources-and-connectors/vendor-specific-data-sources-and-connectors/phishlabs/phishlabs.md): Use PhishLabs data for Cortex AgentiX. - [Pipl](https://cortex-docs.paloaltonetworks.com/cortex-agentix/configure-cortex-agentix/cortex-agentix-data-sources-and-connectors/vendor-specific-data-sources-and-connectors/pipl.md): Configure the Pipl connector for Cortex AgentiX. - [Pipl](https://cortex-docs.paloaltonetworks.com/cortex-agentix/configure-cortex-agentix/cortex-agentix-data-sources-and-connectors/vendor-specific-data-sources-and-connectors/pipl/pipl.md): Use Pipl data for Cortex AgentiX. - [Plainview](https://cortex-docs.paloaltonetworks.com/cortex-agentix/configure-cortex-agentix/cortex-agentix-data-sources-and-connectors/vendor-specific-data-sources-and-connectors/plainview.md): Configure the Plainview connector for Cortex AgentiX. - [Plainview](https://cortex-docs.paloaltonetworks.com/cortex-agentix/configure-cortex-agentix/cortex-agentix-data-sources-and-connectors/vendor-specific-data-sources-and-connectors/plainview/plainview.md): Use Plainview data for Cortex AgentiX. - [Proofpoint](https://cortex-docs.paloaltonetworks.com/cortex-agentix/configure-cortex-agentix/cortex-agentix-data-sources-and-connectors/vendor-specific-data-sources-and-connectors/proofpoint.md): Configure the Proofpoint connector for Cortex AgentiX. - [Proofpoint](https://cortex-docs.paloaltonetworks.com/cortex-agentix/configure-cortex-agentix/cortex-agentix-data-sources-and-connectors/vendor-specific-data-sources-and-connectors/proofpoint/proofpoint.md): Use Proofpoint data for Cortex AgentiX. - [ProtectWise](https://cortex-docs.paloaltonetworks.com/cortex-agentix/configure-cortex-agentix/cortex-agentix-data-sources-and-connectors/vendor-specific-data-sources-and-connectors/protectwise.md): Configure the ProtectWise connector for Cortex AgentiX. - [ProtectWise](https://cortex-docs.paloaltonetworks.com/cortex-agentix/configure-cortex-agentix/cortex-agentix-data-sources-and-connectors/vendor-specific-data-sources-and-connectors/protectwise/protectwise.md): Use ProtectWise data for Cortex AgentiX. - [Qualys](https://cortex-docs.paloaltonetworks.com/cortex-agentix/configure-cortex-agentix/cortex-agentix-data-sources-and-connectors/vendor-specific-data-sources-and-connectors/qualys.md): Configure the Qualys connector for Cortex AgentiX. - [Qualys](https://cortex-docs.paloaltonetworks.com/cortex-agentix/configure-cortex-agentix/cortex-agentix-data-sources-and-connectors/vendor-specific-data-sources-and-connectors/qualys/qualys.md): Use Qualys data for Cortex AgentiX. - [Quest KACE](https://cortex-docs.paloaltonetworks.com/cortex-agentix/configure-cortex-agentix/cortex-agentix-data-sources-and-connectors/vendor-specific-data-sources-and-connectors/quest-kace.md): Configure the Quest KACE connector for Cortex AgentiX. - [Quest KACE](https://cortex-docs.paloaltonetworks.com/cortex-agentix/configure-cortex-agentix/cortex-agentix-data-sources-and-connectors/vendor-specific-data-sources-and-connectors/quest-kace/quest-kace.md): Use Quest KACE data for Cortex AgentiX. - [Rapid7](https://cortex-docs.paloaltonetworks.com/cortex-agentix/configure-cortex-agentix/cortex-agentix-data-sources-and-connectors/vendor-specific-data-sources-and-connectors/rapid7.md): Configure the Rapid7 connector for Cortex AgentiX. - [Rapid7](https://cortex-docs.paloaltonetworks.com/cortex-agentix/configure-cortex-agentix/cortex-agentix-data-sources-and-connectors/vendor-specific-data-sources-and-connectors/rapid7/rapid7.md): Use Rapid7 data for Cortex AgentiX. - [Razor Group](https://cortex-docs.paloaltonetworks.com/cortex-agentix/configure-cortex-agentix/cortex-agentix-data-sources-and-connectors/vendor-specific-data-sources-and-connectors/razor-group.md): Configure the Razor Group connector for Cortex AgentiX. - [Razor Group](https://cortex-docs.paloaltonetworks.com/cortex-agentix/configure-cortex-agentix/cortex-agentix-data-sources-and-connectors/vendor-specific-data-sources-and-connectors/razor-group/razor-group.md): Use Razor Group data for Cortex AgentiX. - [Recorded Future](https://cortex-docs.paloaltonetworks.com/cortex-agentix/configure-cortex-agentix/cortex-agentix-data-sources-and-connectors/vendor-specific-data-sources-and-connectors/recorded-future.md): Configure the Recorded Future connector for Cortex AgentiX. - [Recorded Future](https://cortex-docs.paloaltonetworks.com/cortex-agentix/configure-cortex-agentix/cortex-agentix-data-sources-and-connectors/vendor-specific-data-sources-and-connectors/recorded-future/recorded-future.md): Use Recorded Future data for Cortex AgentiX. - [Red Hat](https://cortex-docs.paloaltonetworks.com/cortex-agentix/configure-cortex-agentix/cortex-agentix-data-sources-and-connectors/vendor-specific-data-sources-and-connectors/red-hat.md): Configure the Red Hat connector for Cortex AgentiX. - [Red Hat Ansible](https://cortex-docs.paloaltonetworks.com/cortex-agentix/configure-cortex-agentix/cortex-agentix-data-sources-and-connectors/vendor-specific-data-sources-and-connectors/red-hat/red-hat-ansible.md): Use Red Hat Ansible data for Cortex AgentiX. - [Redmine](https://cortex-docs.paloaltonetworks.com/cortex-agentix/configure-cortex-agentix/cortex-agentix-data-sources-and-connectors/vendor-specific-data-sources-and-connectors/redmine.md): Configure the Redmine connector for Cortex AgentiX. - [Redmine](https://cortex-docs.paloaltonetworks.com/cortex-agentix/configure-cortex-agentix/cortex-agentix-data-sources-and-connectors/vendor-specific-data-sources-and-connectors/redmine/redmine.md): Use Redmine data for Cortex AgentiX. - [ReliaQuest](https://cortex-docs.paloaltonetworks.com/cortex-agentix/configure-cortex-agentix/cortex-agentix-data-sources-and-connectors/vendor-specific-data-sources-and-connectors/reliaquest.md): Configure the ReliaQuest connector for Cortex AgentiX. - [ReliaQuest](https://cortex-docs.paloaltonetworks.com/cortex-agentix/configure-cortex-agentix/cortex-agentix-data-sources-and-connectors/vendor-specific-data-sources-and-connectors/reliaquest/reliaquest.md): Use ReliaQuest data for Cortex AgentiX. - [RemoteAccess](https://cortex-docs.paloaltonetworks.com/cortex-agentix/configure-cortex-agentix/cortex-agentix-data-sources-and-connectors/vendor-specific-data-sources-and-connectors/remoteaccess.md): Configure the RemoteAccess connector for Cortex AgentiX. - [RemoteAccess](https://cortex-docs.paloaltonetworks.com/cortex-agentix/configure-cortex-agentix/cortex-agentix-data-sources-and-connectors/vendor-specific-data-sources-and-connectors/remoteaccess/remoteaccess.md): Use RemoteAccess data for Cortex AgentiX. - [Retarus](https://cortex-docs.paloaltonetworks.com/cortex-agentix/configure-cortex-agentix/cortex-agentix-data-sources-and-connectors/vendor-specific-data-sources-and-connectors/retarus.md): Configure the Retarus connector for Cortex AgentiX. - [Retarus](https://cortex-docs.paloaltonetworks.com/cortex-agentix/configure-cortex-agentix/cortex-agentix-data-sources-and-connectors/vendor-specific-data-sources-and-connectors/retarus/retarus.md): Use Retarus data for Cortex AgentiX. - [RSA](https://cortex-docs.paloaltonetworks.com/cortex-agentix/configure-cortex-agentix/cortex-agentix-data-sources-and-connectors/vendor-specific-data-sources-and-connectors/rsa.md): Configure the RSA connector for Cortex AgentiX. - [RSA](https://cortex-docs.paloaltonetworks.com/cortex-agentix/configure-cortex-agentix/cortex-agentix-data-sources-and-connectors/vendor-specific-data-sources-and-connectors/rsa/rsa.md): Use RSA data for Cortex AgentiX. - [RTIR](https://cortex-docs.paloaltonetworks.com/cortex-agentix/configure-cortex-agentix/cortex-agentix-data-sources-and-connectors/vendor-specific-data-sources-and-connectors/rtir.md): Configure the RTIR connector for Cortex AgentiX. - [RTIR](https://cortex-docs.paloaltonetworks.com/cortex-agentix/configure-cortex-agentix/cortex-agentix-data-sources-and-connectors/vendor-specific-data-sources-and-connectors/rtir/rtir.md): Use RTIR data for Cortex AgentiX. - [Salesforce](https://cortex-docs.paloaltonetworks.com/cortex-agentix/configure-cortex-agentix/cortex-agentix-data-sources-and-connectors/vendor-specific-data-sources-and-connectors/salesforce.md): Configure the Salesforce connector for Cortex AgentiX. - [Salesforce connector](https://cortex-docs.paloaltonetworks.com/cortex-agentix/configure-cortex-agentix/cortex-agentix-data-sources-and-connectors/vendor-specific-data-sources-and-connectors/salesforce/ingest-and-run-salesforce-automation-and-remediation.md): Use Salesforce connector data for Cortex AgentiX. - [Automation and remediation commands](https://cortex-docs.paloaltonetworks.com/cortex-agentix/configure-cortex-agentix/cortex-agentix-data-sources-and-connectors/vendor-specific-data-sources-and-connectors/salesforce/ingest-and-run-salesforce-automation-and-remediation/automation-and-remediation-commands.md): Salesforce Automation and Remediation commands for playbooks and the War Room for Cortex AgentiX. - [Samhaus](https://cortex-docs.paloaltonetworks.com/cortex-agentix/configure-cortex-agentix/cortex-agentix-data-sources-and-connectors/vendor-specific-data-sources-and-connectors/samhaus.md): Configure the Samhaus connector for Cortex AgentiX. - [Samhaus](https://cortex-docs.paloaltonetworks.com/cortex-agentix/configure-cortex-agentix/cortex-agentix-data-sources-and-connectors/vendor-specific-data-sources-and-connectors/samhaus/samhaus.md): Use Samhaus data for Cortex AgentiX. - [SANS DShield](https://cortex-docs.paloaltonetworks.com/cortex-agentix/configure-cortex-agentix/cortex-agentix-data-sources-and-connectors/vendor-specific-data-sources-and-connectors/sans-dshield.md): Configure the SANS DShield connector for Cortex AgentiX. - [SANS DShield](https://cortex-docs.paloaltonetworks.com/cortex-agentix/configure-cortex-agentix/cortex-agentix-data-sources-and-connectors/vendor-specific-data-sources-and-connectors/sans-dshield/sans-dshield.md): Use SANS DShield data for Cortex AgentiX. - [SAP](https://cortex-docs.paloaltonetworks.com/cortex-agentix/configure-cortex-agentix/cortex-agentix-data-sources-and-connectors/vendor-specific-data-sources-and-connectors/sap.md): Configure the SAP connector for Cortex AgentiX. - [SAP](https://cortex-docs.paloaltonetworks.com/cortex-agentix/configure-cortex-agentix/cortex-agentix-data-sources-and-connectors/vendor-specific-data-sources-and-connectors/sap/sap.md): Use SAP data for Cortex AgentiX. - [Securonix](https://cortex-docs.paloaltonetworks.com/cortex-agentix/configure-cortex-agentix/cortex-agentix-data-sources-and-connectors/vendor-specific-data-sources-and-connectors/securonix.md): Configure the Securonix connector for Cortex AgentiX. - [Securonix](https://cortex-docs.paloaltonetworks.com/cortex-agentix/configure-cortex-agentix/cortex-agentix-data-sources-and-connectors/vendor-specific-data-sources-and-connectors/securonix/securonix.md): Use Securonix data for Cortex AgentiX. - [ServiceNow](https://cortex-docs.paloaltonetworks.com/cortex-agentix/configure-cortex-agentix/cortex-agentix-data-sources-and-connectors/vendor-specific-data-sources-and-connectors/servicenow.md): Configure the ServiceNow connector for Cortex AgentiX. - [ServiceNow Automation and Collection](https://cortex-docs.paloaltonetworks.com/cortex-agentix/configure-cortex-agentix/cortex-agentix-data-sources-and-connectors/vendor-specific-data-sources-and-connectors/servicenow/servicenow-automation-and-collection.md): Use ServiceNow Automation and Collection data for Cortex AgentiX. - [Shodan](https://cortex-docs.paloaltonetworks.com/cortex-agentix/configure-cortex-agentix/cortex-agentix-data-sources-and-connectors/vendor-specific-data-sources-and-connectors/shodan.md): Configure the Shodan connector for Cortex AgentiX. - [Shodan](https://cortex-docs.paloaltonetworks.com/cortex-agentix/configure-cortex-agentix/cortex-agentix-data-sources-and-connectors/vendor-specific-data-sources-and-connectors/shodan/shodan.md): Use Shodan data for Cortex AgentiX. - [Skyhigh Security](https://cortex-docs.paloaltonetworks.com/cortex-agentix/configure-cortex-agentix/cortex-agentix-data-sources-and-connectors/vendor-specific-data-sources-and-connectors/skyhigh-security.md): Configure the Skyhigh Security connector for Cortex AgentiX. - [Skyhigh Security](https://cortex-docs.paloaltonetworks.com/cortex-agentix/configure-cortex-agentix/cortex-agentix-data-sources-and-connectors/vendor-specific-data-sources-and-connectors/skyhigh-security/skyhigh-security.md): Use Skyhigh Security data for Cortex AgentiX. - [Slack](https://cortex-docs.paloaltonetworks.com/cortex-agentix/configure-cortex-agentix/cortex-agentix-data-sources-and-connectors/vendor-specific-data-sources-and-connectors/slack.md): Configure the Slack connector for Cortex AgentiX. - [Slack Automation and Collection](https://cortex-docs.paloaltonetworks.com/cortex-agentix/configure-cortex-agentix/cortex-agentix-data-sources-and-connectors/vendor-specific-data-sources-and-connectors/slack/slack-automation-and-collection.md): Use Slack Automation and Collection data for Cortex AgentiX. - [SMB](https://cortex-docs.paloaltonetworks.com/cortex-agentix/configure-cortex-agentix/cortex-agentix-data-sources-and-connectors/vendor-specific-data-sources-and-connectors/smb.md): Configure the SMB connector for Cortex AgentiX. - [SMB](https://cortex-docs.paloaltonetworks.com/cortex-agentix/configure-cortex-agentix/cortex-agentix-data-sources-and-connectors/vendor-specific-data-sources-and-connectors/smb/smb.md): Use SMB data for Cortex AgentiX. - [SMIME Messaging](https://cortex-docs.paloaltonetworks.com/cortex-agentix/configure-cortex-agentix/cortex-agentix-data-sources-and-connectors/vendor-specific-data-sources-and-connectors/smime-messaging.md): Configure the SMIME Messaging connector for Cortex AgentiX. - [SMIME Messaging](https://cortex-docs.paloaltonetworks.com/cortex-agentix/configure-cortex-agentix/cortex-agentix-data-sources-and-connectors/vendor-specific-data-sources-and-connectors/smime-messaging/smime-messaging.md): Use SMIME Messaging data for Cortex AgentiX. - [Snowflake](https://cortex-docs.paloaltonetworks.com/cortex-agentix/configure-cortex-agentix/cortex-agentix-data-sources-and-connectors/vendor-specific-data-sources-and-connectors/snowflake.md): Configure the Snowflake connector for Cortex AgentiX. - [Snowflake Automation and Collection](https://cortex-docs.paloaltonetworks.com/cortex-agentix/configure-cortex-agentix/cortex-agentix-data-sources-and-connectors/vendor-specific-data-sources-and-connectors/snowflake/snowflake-automation-and-collection.md): Use Snowflake Automation and Collection data for Cortex AgentiX. - [SolarWinds](https://cortex-docs.paloaltonetworks.com/cortex-agentix/configure-cortex-agentix/cortex-agentix-data-sources-and-connectors/vendor-specific-data-sources-and-connectors/solarwinds.md): Configure the SolarWinds connector for Cortex AgentiX. - [SolarWinds](https://cortex-docs.paloaltonetworks.com/cortex-agentix/configure-cortex-agentix/cortex-agentix-data-sources-and-connectors/vendor-specific-data-sources-and-connectors/solarwinds/solarwinds.md): Use SolarWinds data for Cortex AgentiX. - [Sophos](https://cortex-docs.paloaltonetworks.com/cortex-agentix/configure-cortex-agentix/cortex-agentix-data-sources-and-connectors/vendor-specific-data-sources-and-connectors/sophos.md): Configure the Sophos connector for Cortex AgentiX. - [Sophos](https://cortex-docs.paloaltonetworks.com/cortex-agentix/configure-cortex-agentix/cortex-agentix-data-sources-and-connectors/vendor-specific-data-sources-and-connectors/sophos/sophos.md): Use Sophos data for Cortex AgentiX. - [Splunk](https://cortex-docs.paloaltonetworks.com/cortex-agentix/configure-cortex-agentix/cortex-agentix-data-sources-and-connectors/vendor-specific-data-sources-and-connectors/splunk.md): Configure the Splunk connector for Cortex AgentiX. - [Splunk Automation and Collection](https://cortex-docs.paloaltonetworks.com/cortex-agentix/configure-cortex-agentix/cortex-agentix-data-sources-and-connectors/vendor-specific-data-sources-and-connectors/splunk/splunk-automation-and-collection.md): Use Splunk Automation and Collection data for Cortex AgentiX. - [Sublime Security](https://cortex-docs.paloaltonetworks.com/cortex-agentix/configure-cortex-agentix/cortex-agentix-data-sources-and-connectors/vendor-specific-data-sources-and-connectors/sublime-security.md): Configure the Sublime Security connector for Cortex AgentiX. - [Sublime Security](https://cortex-docs.paloaltonetworks.com/cortex-agentix/configure-cortex-agentix/cortex-agentix-data-sources-and-connectors/vendor-specific-data-sources-and-connectors/sublime-security/sublime-security.md): Use Sublime Security data for Cortex AgentiX. - [Sumo Logic](https://cortex-docs.paloaltonetworks.com/cortex-agentix/configure-cortex-agentix/cortex-agentix-data-sources-and-connectors/vendor-specific-data-sources-and-connectors/sumo-logic.md): Configure the Sumo Logic connector for Cortex AgentiX. - [Sumo Logic Automation and Collection](https://cortex-docs.paloaltonetworks.com/cortex-agentix/configure-cortex-agentix/cortex-agentix-data-sources-and-connectors/vendor-specific-data-sources-and-connectors/sumo-logic/sumo-logic-automation-and-collection.md): Use Sumo Logic Automation and Collection data for Cortex AgentiX. - [SysAid](https://cortex-docs.paloaltonetworks.com/cortex-agentix/configure-cortex-agentix/cortex-agentix-data-sources-and-connectors/vendor-specific-data-sources-and-connectors/sysaid.md): Configure the SysAid connector for Cortex AgentiX. - [SysAid](https://cortex-docs.paloaltonetworks.com/cortex-agentix/configure-cortex-agentix/cortex-agentix-data-sources-and-connectors/vendor-specific-data-sources-and-connectors/sysaid/sysaid.md): Use SysAid data for Cortex AgentiX. - [Syslog Sender](https://cortex-docs.paloaltonetworks.com/cortex-agentix/configure-cortex-agentix/cortex-agentix-data-sources-and-connectors/vendor-specific-data-sources-and-connectors/syslog-sender.md): Configure the Syslog Sender connector for Cortex AgentiX. - [Syslog Sender](https://cortex-docs.paloaltonetworks.com/cortex-agentix/configure-cortex-agentix/cortex-agentix-data-sources-and-connectors/vendor-specific-data-sources-and-connectors/syslog-sender/syslog-sender.md): Use Syslog Sender data for Cortex AgentiX. - [Tanium](https://cortex-docs.paloaltonetworks.com/cortex-agentix/configure-cortex-agentix/cortex-agentix-data-sources-and-connectors/vendor-specific-data-sources-and-connectors/tanium.md): Configure the Tanium connector for Cortex AgentiX. - [Tanium](https://cortex-docs.paloaltonetworks.com/cortex-agentix/configure-cortex-agentix/cortex-agentix-data-sources-and-connectors/vendor-specific-data-sources-and-connectors/tanium/tanium.md): Use Tanium data for Cortex AgentiX. - [TAXII](https://cortex-docs.paloaltonetworks.com/cortex-agentix/configure-cortex-agentix/cortex-agentix-data-sources-and-connectors/vendor-specific-data-sources-and-connectors/taxii.md): Configure the TAXII connector for Cortex AgentiX. - [TAXII](https://cortex-docs.paloaltonetworks.com/cortex-agentix/configure-cortex-agentix/cortex-agentix-data-sources-and-connectors/vendor-specific-data-sources-and-connectors/taxii/taxii.md): Use TAXII data for Cortex AgentiX. - [Telegram](https://cortex-docs.paloaltonetworks.com/cortex-agentix/configure-cortex-agentix/cortex-agentix-data-sources-and-connectors/vendor-specific-data-sources-and-connectors/telegram.md): Configure the Telegram connector for Cortex AgentiX. - [Telegram](https://cortex-docs.paloaltonetworks.com/cortex-agentix/configure-cortex-agentix/cortex-agentix-data-sources-and-connectors/vendor-specific-data-sources-and-connectors/telegram/telegram.md): Use Telegram data for Cortex AgentiX. - [Tenable](https://cortex-docs.paloaltonetworks.com/cortex-agentix/configure-cortex-agentix/cortex-agentix-data-sources-and-connectors/vendor-specific-data-sources-and-connectors/tenable.md): Configure the Tenable connector for Cortex AgentiX. - [Tenable](https://cortex-docs.paloaltonetworks.com/cortex-agentix/configure-cortex-agentix/cortex-agentix-data-sources-and-connectors/vendor-specific-data-sources-and-connectors/tenable/tenable.md): Use Tenable data for Cortex AgentiX. - [TheHive](https://cortex-docs.paloaltonetworks.com/cortex-agentix/configure-cortex-agentix/cortex-agentix-data-sources-and-connectors/vendor-specific-data-sources-and-connectors/thehive.md): Configure the TheHive connector for Cortex AgentiX. - [TheHive](https://cortex-docs.paloaltonetworks.com/cortex-agentix/configure-cortex-agentix/cortex-agentix-data-sources-and-connectors/vendor-specific-data-sources-and-connectors/thehive/thehive.md): Use TheHive data for Cortex AgentiX. - [Thinkst Canary](https://cortex-docs.paloaltonetworks.com/cortex-agentix/configure-cortex-agentix/cortex-agentix-data-sources-and-connectors/vendor-specific-data-sources-and-connectors/thinkst-canary.md): Configure the Thinkst Canary connector for Cortex AgentiX. - [Thinkst Canary](https://cortex-docs.paloaltonetworks.com/cortex-agentix/configure-cortex-agentix/cortex-agentix-data-sources-and-connectors/vendor-specific-data-sources-and-connectors/thinkst-canary/thinkst-canary.md): Use Thinkst Canary data for Cortex AgentiX. - [ThreatConnect](https://cortex-docs.paloaltonetworks.com/cortex-agentix/configure-cortex-agentix/cortex-agentix-data-sources-and-connectors/vendor-specific-data-sources-and-connectors/threatconnect.md): Configure the ThreatConnect connector for Cortex AgentiX. - [ThreatConnect](https://cortex-docs.paloaltonetworks.com/cortex-agentix/configure-cortex-agentix/cortex-agentix-data-sources-and-connectors/vendor-specific-data-sources-and-connectors/threatconnect/threatconnect.md): Use ThreatConnect data for Cortex AgentiX. - [ThreatMiner.org](https://cortex-docs.paloaltonetworks.com/cortex-agentix/configure-cortex-agentix/cortex-agentix-data-sources-and-connectors/vendor-specific-data-sources-and-connectors/threatminer.org.md): Configure the ThreatMiner.org connector for Cortex AgentiX. - [ThreatMiner.org](https://cortex-docs.paloaltonetworks.com/cortex-agentix/configure-cortex-agentix/cortex-agentix-data-sources-and-connectors/vendor-specific-data-sources-and-connectors/threatminer.org/threatminer.org.md): Use ThreatMiner.org data for Cortex AgentiX. - [ThreatX](https://cortex-docs.paloaltonetworks.com/cortex-agentix/configure-cortex-agentix/cortex-agentix-data-sources-and-connectors/vendor-specific-data-sources-and-connectors/threatx.md): Configure the ThreatX connector for Cortex AgentiX. - [ThreatX](https://cortex-docs.paloaltonetworks.com/cortex-agentix/configure-cortex-agentix/cortex-agentix-data-sources-and-connectors/vendor-specific-data-sources-and-connectors/threatx/threatx.md): Use ThreatX data for Cortex AgentiX. - [Tidy](https://cortex-docs.paloaltonetworks.com/cortex-agentix/configure-cortex-agentix/cortex-agentix-data-sources-and-connectors/vendor-specific-data-sources-and-connectors/tidy.md): Configure the Tidy connector for Cortex AgentiX. - [Tidy](https://cortex-docs.paloaltonetworks.com/cortex-agentix/configure-cortex-agentix/cortex-agentix-data-sources-and-connectors/vendor-specific-data-sources-and-connectors/tidy/tidy.md): Use Tidy data for Cortex AgentiX. - [TOPdesk](https://cortex-docs.paloaltonetworks.com/cortex-agentix/configure-cortex-agentix/cortex-agentix-data-sources-and-connectors/vendor-specific-data-sources-and-connectors/topdesk.md): Configure the TOPdesk connector for Cortex AgentiX. - [TOPdesk](https://cortex-docs.paloaltonetworks.com/cortex-agentix/configure-cortex-agentix/cortex-agentix-data-sources-and-connectors/vendor-specific-data-sources-and-connectors/topdesk/topdesk.md): Use TOPdesk data for Cortex AgentiX. - [Tor Exit Adress](https://cortex-docs.paloaltonetworks.com/cortex-agentix/configure-cortex-agentix/cortex-agentix-data-sources-and-connectors/vendor-specific-data-sources-and-connectors/tor-exit-adress.md): Configure the Tor Exit Adress connector for Cortex AgentiX. - [Tor Exit Adress](https://cortex-docs.paloaltonetworks.com/cortex-agentix/configure-cortex-agentix/cortex-agentix-data-sources-and-connectors/vendor-specific-data-sources-and-connectors/tor-exit-adress/tor-exit-adress.md): Use Tor Exit Adress data for Cortex AgentiX. - [Trellix](https://cortex-docs.paloaltonetworks.com/cortex-agentix/configure-cortex-agentix/cortex-agentix-data-sources-and-connectors/vendor-specific-data-sources-and-connectors/trellix.md): Configure the Trellix connectors for Cortex AgentiX. - [Trellix Database Security](https://cortex-docs.paloaltonetworks.com/cortex-agentix/configure-cortex-agentix/cortex-agentix-data-sources-and-connectors/vendor-specific-data-sources-and-connectors/trellix/trellix-database-security.md): Use Trellix Database Security data for Cortex AgentiX. - [Trellix Email Security (ETP)](https://cortex-docs.paloaltonetworks.com/cortex-agentix/configure-cortex-agentix/cortex-agentix-data-sources-and-connectors/vendor-specific-data-sources-and-connectors/trellix/trellix-email-security-etp.md): Use Trellix Email Security (ETP) data for Cortex AgentiX. - [Trellix Email Security](https://cortex-docs.paloaltonetworks.com/cortex-agentix/configure-cortex-agentix/cortex-agentix-data-sources-and-connectors/vendor-specific-data-sources-and-connectors/trellix/trellix-email-security.md): Use Trellix Email Security data for Cortex AgentiX. - [Trellix Endpoint (HX)](https://cortex-docs.paloaltonetworks.com/cortex-agentix/configure-cortex-agentix/cortex-agentix-data-sources-and-connectors/vendor-specific-data-sources-and-connectors/trellix/trellix-endpoint-hx.md): Use Trellix Endpoint (HX) data for Cortex AgentiX. - [Trellix ePO](https://cortex-docs.paloaltonetworks.com/cortex-agentix/configure-cortex-agentix/cortex-agentix-data-sources-and-connectors/vendor-specific-data-sources-and-connectors/trellix/trellix-epo.md): Use Trellix ePO data for Cortex AgentiX. - [Trellix Network](https://cortex-docs.paloaltonetworks.com/cortex-agentix/configure-cortex-agentix/cortex-agentix-data-sources-and-connectors/vendor-specific-data-sources-and-connectors/trellix/trellix-network.md): Use Trellix Network data for Cortex AgentiX. - [Trellix Sandbox](https://cortex-docs.paloaltonetworks.com/cortex-agentix/configure-cortex-agentix/cortex-agentix-data-sources-and-connectors/vendor-specific-data-sources-and-connectors/trellix/trellix-sandbox.md): Use Trellix Sandbox data for Cortex AgentiX. - [Trellix SIEM](https://cortex-docs.paloaltonetworks.com/cortex-agentix/configure-cortex-agentix/cortex-agentix-data-sources-and-connectors/vendor-specific-data-sources-and-connectors/trellix/trellix-siem.md): Use Trellix SIEM data for Cortex AgentiX. - [Trellix Threat Intel](https://cortex-docs.paloaltonetworks.com/cortex-agentix/configure-cortex-agentix/cortex-agentix-data-sources-and-connectors/vendor-specific-data-sources-and-connectors/trellix/trellix-threat-intel.md): Use Trellix Threat Intel data for Cortex AgentiX. - [TrendAI](https://cortex-docs.paloaltonetworks.com/cortex-agentix/configure-cortex-agentix/cortex-agentix-data-sources-and-connectors/vendor-specific-data-sources-and-connectors/trendai.md): Configure the TrendAI connector for Cortex AgentiX. - [TrendAI](https://cortex-docs.paloaltonetworks.com/cortex-agentix/configure-cortex-agentix/cortex-agentix-data-sources-and-connectors/vendor-specific-data-sources-and-connectors/trendai/trendai.md): Use TrendAI data for Cortex AgentiX. - [Twilio](https://cortex-docs.paloaltonetworks.com/cortex-agentix/configure-cortex-agentix/cortex-agentix-data-sources-and-connectors/vendor-specific-data-sources-and-connectors/twilio.md): Configure the Twilio connector for Cortex AgentiX. - [Twilio](https://cortex-docs.paloaltonetworks.com/cortex-agentix/configure-cortex-agentix/cortex-agentix-data-sources-and-connectors/vendor-specific-data-sources-and-connectors/twilio/twilio.md): Use Twilio data for Cortex AgentiX. - [Versa Networks](https://cortex-docs.paloaltonetworks.com/cortex-agentix/configure-cortex-agentix/cortex-agentix-data-sources-and-connectors/vendor-specific-data-sources-and-connectors/versa-networks.md): Configure the Versa Networks connector for Cortex AgentiX. - [Versa Networks](https://cortex-docs.paloaltonetworks.com/cortex-agentix/configure-cortex-agentix/cortex-agentix-data-sources-and-connectors/vendor-specific-data-sources-and-connectors/versa-networks/versa-networks.md): Use Versa Networks data for Cortex AgentiX. - [VMware](https://cortex-docs.paloaltonetworks.com/cortex-agentix/configure-cortex-agentix/cortex-agentix-data-sources-and-connectors/vendor-specific-data-sources-and-connectors/vmware.md): Configure the VMware connector for Cortex AgentiX. - [VMware Automation and Collection](https://cortex-docs.paloaltonetworks.com/cortex-agentix/configure-cortex-agentix/cortex-agentix-data-sources-and-connectors/vendor-specific-data-sources-and-connectors/vmware/vmware-automation-and-collection.md): Use VMware Automation and Collection data for Cortex AgentiX. - [VulnDB](https://cortex-docs.paloaltonetworks.com/cortex-agentix/configure-cortex-agentix/cortex-agentix-data-sources-and-connectors/vendor-specific-data-sources-and-connectors/vulndb.md): Configure the VulnDB connector for Cortex AgentiX. - [VulnDB](https://cortex-docs.paloaltonetworks.com/cortex-agentix/configure-cortex-agentix/cortex-agentix-data-sources-and-connectors/vendor-specific-data-sources-and-connectors/vulndb/vulndb.md): Use VulnDB data for Cortex AgentiX. - [WhatsMyBrowser.org](https://cortex-docs.paloaltonetworks.com/cortex-agentix/configure-cortex-agentix/cortex-agentix-data-sources-and-connectors/vendor-specific-data-sources-and-connectors/whatsmybrowser.org.md): Configure the WhatsMyBrowser.org connector for Cortex AgentiX. - [WhatsMyBrowser.org](https://cortex-docs.paloaltonetworks.com/cortex-agentix/configure-cortex-agentix/cortex-agentix-data-sources-and-connectors/vendor-specific-data-sources-and-connectors/whatsmybrowser.org/whatsmybrowser.org.md): Use WhatsMyBrowser.org data for Cortex AgentiX. - [Whois](https://cortex-docs.paloaltonetworks.com/cortex-agentix/configure-cortex-agentix/cortex-agentix-data-sources-and-connectors/vendor-specific-data-sources-and-connectors/whois.md): Configure the Whois connector for Cortex AgentiX. - [Whois](https://cortex-docs.paloaltonetworks.com/cortex-agentix/configure-cortex-agentix/cortex-agentix-data-sources-and-connectors/vendor-specific-data-sources-and-connectors/whois/whois.md): Use Whois data for Cortex AgentiX. - [Workday](https://cortex-docs.paloaltonetworks.com/cortex-agentix/configure-cortex-agentix/cortex-agentix-data-sources-and-connectors/vendor-specific-data-sources-and-connectors/workday.md): Configure the Workday connector for Cortex AgentiX. - [Workday Automation and Collection](https://cortex-docs.paloaltonetworks.com/cortex-agentix/configure-cortex-agentix/cortex-agentix-data-sources-and-connectors/vendor-specific-data-sources-and-connectors/workday/workday-automation-and-collection.md): Use Workday Automation and Collection data for Cortex AgentiX. - [X](https://cortex-docs.paloaltonetworks.com/cortex-agentix/configure-cortex-agentix/cortex-agentix-data-sources-and-connectors/vendor-specific-data-sources-and-connectors/x.md): Configure the X connector for Cortex AgentiX. - [X Automation and Remediation](https://cortex-docs.paloaltonetworks.com/cortex-agentix/configure-cortex-agentix/cortex-agentix-data-sources-and-connectors/vendor-specific-data-sources-and-connectors/x/x-automation-and-remediation.md): Use X Automation and Remediation data for Cortex AgentiX. - [Zendesk](https://cortex-docs.paloaltonetworks.com/cortex-agentix/configure-cortex-agentix/cortex-agentix-data-sources-and-connectors/vendor-specific-data-sources-and-connectors/zendesk.md): Configure the Zendesk connector for Cortex AgentiX. - [Zendesk](https://cortex-docs.paloaltonetworks.com/cortex-agentix/configure-cortex-agentix/cortex-agentix-data-sources-and-connectors/vendor-specific-data-sources-and-connectors/zendesk/zendesk.md): Use Zendesk data for Cortex AgentiX. - [Zimperium](https://cortex-docs.paloaltonetworks.com/cortex-agentix/configure-cortex-agentix/cortex-agentix-data-sources-and-connectors/vendor-specific-data-sources-and-connectors/zimperium.md): Configure the Zimperium connector for Cortex AgentiX. - [Zimperium](https://cortex-docs.paloaltonetworks.com/cortex-agentix/configure-cortex-agentix/cortex-agentix-data-sources-and-connectors/vendor-specific-data-sources-and-connectors/zimperium/zimperium.md): Use Zimperium data for Cortex AgentiX. - [Zoom](https://cortex-docs.paloaltonetworks.com/cortex-agentix/configure-cortex-agentix/cortex-agentix-data-sources-and-connectors/vendor-specific-data-sources-and-connectors/zoom.md): Configure the Zoom connector for Cortex AgentiX. - [Zoom](https://cortex-docs.paloaltonetworks.com/cortex-agentix/configure-cortex-agentix/cortex-agentix-data-sources-and-connectors/vendor-specific-data-sources-and-connectors/zoom/zoom.md): Use Zoom data for Cortex AgentiX. - [Zscaler](https://cortex-docs.paloaltonetworks.com/cortex-agentix/configure-cortex-agentix/cortex-agentix-data-sources-and-connectors/vendor-specific-data-sources-and-connectors/zscaler.md): Configure the Zscaler connector for Cortex AgentiX. - [Zscaler](https://cortex-docs.paloaltonetworks.com/cortex-agentix/configure-cortex-agentix/cortex-agentix-data-sources-and-connectors/vendor-specific-data-sources-and-connectors/zscaler/zscaler.md): Use Zscaler data for Cortex AgentiX. - [Connectors](https://cortex-docs.paloaltonetworks.com/cortex-agentix/configure-cortex-agentix/cortex-agentix-data-sources-and-connectors/connectors.md): Use unified connectors to configure third-party services and security capabilities in Cortex AgentiX. - [Standard data sources](https://cortex-docs.paloaltonetworks.com/cortex-agentix/configure-cortex-agentix/cortex-agentix-data-sources-and-connectors/standard-data-sources.md): Configure standard Cortex AgentiX data sources to ingest, parse, and normalize third-party security logs. - [Palo Alto Networks integrations](https://cortex-docs.paloaltonetworks.com/cortex-agentix/configure-cortex-agentix/cortex-agentix-data-sources-and-connectors/palo-alto-networks-integrations.md) - [Next-Generation Firewall](https://cortex-docs.paloaltonetworks.com/cortex-agentix/configure-cortex-agentix/cortex-agentix-data-sources-and-connectors/palo-alto-networks-integrations/next-generation-firewall.md) - [Panorama](https://cortex-docs.paloaltonetworks.com/cortex-agentix/configure-cortex-agentix/cortex-agentix-data-sources-and-connectors/palo-alto-networks-integrations/next-generation-firewall/panorama.md) - [Prisma Access](https://cortex-docs.paloaltonetworks.com/cortex-agentix/configure-cortex-agentix/cortex-agentix-data-sources-and-connectors/palo-alto-networks-integrations/prisma-access.md) - [Palo Alto Networks Prisma](https://cortex-docs.paloaltonetworks.com/cortex-agentix/configure-cortex-agentix/cortex-agentix-data-sources-and-connectors/palo-alto-networks-integrations/prisma-access/palo-alto-networks-prisma.md) - [IoT Security](https://cortex-docs.paloaltonetworks.com/cortex-agentix/configure-cortex-agentix/cortex-agentix-data-sources-and-connectors/palo-alto-networks-integrations/iot-security.md) - [IoT Security](https://cortex-docs.paloaltonetworks.com/cortex-agentix/configure-cortex-agentix/cortex-agentix-data-sources-and-connectors/palo-alto-networks-integrations/iot-security/iot-security.md) - [Cortex Automation Developer Tools](https://cortex-docs.paloaltonetworks.com/cortex-agentix/configure-cortex-agentix/cortex-agentix-data-sources-and-connectors/palo-alto-networks-integrations/cortex-automation-developer-tools.md) - [Cortex Data Lake](https://cortex-docs.paloaltonetworks.com/cortex-agentix/configure-cortex-agentix/cortex-agentix-data-sources-and-connectors/palo-alto-networks-integrations/cortex-data-lake.md) - [Cortex Internals](https://cortex-docs.paloaltonetworks.com/cortex-agentix/configure-cortex-agentix/cortex-agentix-data-sources-and-connectors/palo-alto-networks-integrations/cortex-internals.md) - [Cortex XDR](https://cortex-docs.paloaltonetworks.com/cortex-agentix/configure-cortex-agentix/cortex-agentix-data-sources-and-connectors/palo-alto-networks-integrations/cortex-xdr.md) - [Enterprise DLP](https://cortex-docs.paloaltonetworks.com/cortex-agentix/configure-cortex-agentix/cortex-agentix-data-sources-and-connectors/palo-alto-networks-integrations/enterprise-dlp.md) - [Palo Alto Networks Cortex](https://cortex-docs.paloaltonetworks.com/cortex-agentix/configure-cortex-agentix/cortex-agentix-data-sources-and-connectors/palo-alto-networks-integrations/palo-alto-networks-cortex.md) - [PAN PSIRT Advisories](https://cortex-docs.paloaltonetworks.com/cortex-agentix/configure-cortex-agentix/cortex-agentix-data-sources-and-connectors/palo-alto-networks-integrations/pan-psirt-advisories.md) - [Prisma Cloud Compute](https://cortex-docs.paloaltonetworks.com/cortex-agentix/configure-cortex-agentix/cortex-agentix-data-sources-and-connectors/palo-alto-networks-integrations/prisma-cloud-compute.md) - [Prisma Cloud CSPM](https://cortex-docs.paloaltonetworks.com/cortex-agentix/configure-cortex-agentix/cortex-agentix-data-sources-and-connectors/palo-alto-networks-integrations/prisma-cloud-cspm.md) - [SaaS Security (Aperture)](https://cortex-docs.paloaltonetworks.com/cortex-agentix/configure-cortex-agentix/cortex-agentix-data-sources-and-connectors/palo-alto-networks-integrations/saas-security-aperture.md) - [Threat Vault](https://cortex-docs.paloaltonetworks.com/cortex-agentix/configure-cortex-agentix/cortex-agentix-data-sources-and-connectors/palo-alto-networks-integrations/threat-vault.md) - [WildFire Cloud](https://cortex-docs.paloaltonetworks.com/cortex-agentix/configure-cortex-agentix/cortex-agentix-data-sources-and-connectors/palo-alto-networks-integrations/wildfire-cloud.md) - [Administration and troubleshooting](https://cortex-docs.paloaltonetworks.com/cortex-agentix/configure-cortex-agentix/cortex-agentix-data-sources-and-connectors/administration-and-troubleshooting.md): Learn more about the administration and troubleshooting of the different data collector and connector integrations in Cortex AgentiX. - [Manage instances](https://cortex-docs.paloaltonetworks.com/cortex-agentix/configure-cortex-agentix/cortex-agentix-data-sources-and-connectors/administration-and-troubleshooting/manage-instances.md): Manage data source and integration instances in Cortex AgentiX. - [Add a new data source or instance](https://cortex-docs.paloaltonetworks.com/cortex-agentix/configure-cortex-agentix/cortex-agentix-data-sources-and-connectors/administration-and-troubleshooting/manage-instances/add-a-new-data-source-or-instance.md): Add a data source or integration instance in Cortex AgentiX. - [Integrations](https://cortex-docs.paloaltonetworks.com/cortex-agentix/configure-cortex-agentix/cortex-agentix-data-sources-and-connectors/administration-and-troubleshooting/integrations.md): Configure Cortex AgentiX integrations and instances to connect third-party tools and automate SOC operations. - [Manage API keys](https://cortex-docs.paloaltonetworks.com/cortex-agentix/configure-cortex-agentix/cortex-agentix-data-sources-and-connectors/administration-and-troubleshooting/integrations/manage-api-keys.md): Create and manage API keys for Cortex AgentiX integrations. - [Integration use cases](https://cortex-docs.paloaltonetworks.com/cortex-agentix/configure-cortex-agentix/cortex-agentix-data-sources-and-connectors/administration-and-troubleshooting/integrations/integration-use-cases.md): Explore integration use cases for Cortex AgentiX security workflows. - [Add an integration instance](https://cortex-docs.paloaltonetworks.com/cortex-agentix/configure-cortex-agentix/cortex-agentix-data-sources-and-connectors/administration-and-troubleshooting/integrations/add-an-integration-instance.md): Add and configure Cortex AgentiX integration instances for third-party security tools, issue ingestion, and automation. - [Configure integration permissions](https://cortex-docs.paloaltonetworks.com/cortex-agentix/configure-cortex-agentix/cortex-agentix-data-sources-and-connectors/administration-and-troubleshooting/integrations/configure-integration-permissions.md): Configure permissions for Cortex AgentiX integration instances and commands. - [Fetch issues from an integration instance](https://cortex-docs.paloaltonetworks.com/cortex-agentix/configure-cortex-agentix/cortex-agentix-data-sources-and-connectors/administration-and-troubleshooting/integrations/fetch-issues-from-an-integration-instance.md): Fetch issues from an integration instance in Cortex AgentiX. - [Map fields to issue types](https://cortex-docs.paloaltonetworks.com/cortex-agentix/configure-cortex-agentix/cortex-agentix-data-sources-and-connectors/administration-and-troubleshooting/integrations/fetch-issues-from-an-integration-instance/map-fields-to-issue-types.md): Map integration fields to issue types in Cortex AgentiX. - [Classify events using a classifier for issue types](https://cortex-docs.paloaltonetworks.com/cortex-agentix/configure-cortex-agentix/cortex-agentix-data-sources-and-connectors/administration-and-troubleshooting/integrations/fetch-issues-from-an-integration-instance/classify-events-using-a-classifier-for-issue-types.md): Classify integration events for Cortex AgentiX issue types. - [Forward requests to long-running integrations](https://cortex-docs.paloaltonetworks.com/cortex-agentix/configure-cortex-agentix/cortex-agentix-data-sources-and-connectors/administration-and-troubleshooting/integrations/forward-requests-to-long-running-integrations.md): Forward requests to long-running integrations in Cortex AgentiX. - [Manage credentials](https://cortex-docs.paloaltonetworks.com/cortex-agentix/configure-cortex-agentix/cortex-agentix-data-sources-and-connectors/administration-and-troubleshooting/integrations/manage-credentials.md): Manage credentials used by Cortex AgentiX integrations and automations. - [Troubleshoot Integrations](https://cortex-docs.paloaltonetworks.com/cortex-agentix/configure-cortex-agentix/cortex-agentix-data-sources-and-connectors/administration-and-troubleshooting/integrations/troubleshoot-integrations.md): Troubleshoot integration configuration and connectivity in Cortex AgentiX. - [Verify collector connectivity](https://cortex-docs.paloaltonetworks.com/cortex-agentix/configure-cortex-agentix/cortex-agentix-data-sources-and-connectors/administration-and-troubleshooting/verify-collector-connectivity.md): Verify data collector connectivity and troubleshoot errors in Cortex AgentiX. - [Marketplace](https://cortex-docs.paloaltonetworks.com/cortex-agentix/configure-cortex-agentix/marketplace.md): Use the Marketplace, a centralized content portal, to download and manage content packs in Cortex AgentiX. - [Cortex Marketplace](https://cortex-docs.paloaltonetworks.com/cortex-agentix/configure-cortex-agentix/marketplace/cortex-marketplace.md): Browse, search, and manage content packs for security orchestration in Cortex AgentiX. - [Content packs](https://cortex-docs.paloaltonetworks.com/cortex-agentix/configure-cortex-agentix/marketplace/content-packs.md): Explore pre-installed and recommended Cortex AgentiX content packs for security workflows and integrations. - [Content pack support types](https://cortex-docs.paloaltonetworks.com/cortex-agentix/configure-cortex-agentix/marketplace/content-pack-support-types.md): Understand content pack support types, maintenance responsibilities, and support channels in Cortex AgentiX. - [Manage content packs](https://cortex-docs.paloaltonetworks.com/cortex-agentix/configure-cortex-agentix/marketplace/manage-content-packs.md): Install, update, revert, and delete Cortex Marketplace content packs and manage required and optional dependencies in Cortex AgentiX. - [Marketplace FAQs](https://cortex-docs.paloaltonetworks.com/cortex-agentix/configure-cortex-agentix/marketplace/marketplace-faqs.md): Find answers about updating, customizing, detaching, and reverting Cortex AgentiX Marketplace content packs. - [Content changes when upgrading Cortex AgentiX versions](https://cortex-docs.paloaltonetworks.com/cortex-agentix/configure-cortex-agentix/marketplace/content-changes-when-upgrading-cortex-agentix-versions.md): Review content packs that automatically update during version upgrades in Cortex AgentiX. - [Content pack contributions](https://cortex-docs.paloaltonetworks.com/cortex-agentix/configure-cortex-agentix/marketplace/content-pack-contributions.md): Submit content pack contributions for review, approval, and publication in Cortex AgentiX. - [Configure the Cortex Agentic Assistant](https://cortex-docs.paloaltonetworks.com/cortex-agentix/configure-cortex-agentix/configure-the-cortex-agentic-assistant.md): Configure AI agents, actions, knowledge, and access controls in Cortex AgentiX. - [Agentic Assistant components and concepts](https://cortex-docs.paloaltonetworks.com/cortex-agentix/configure-cortex-agentix/configure-the-cortex-agentic-assistant/agentic-assistant-components-and-concepts.md): Understand Cortex Agentic Assistant agents, actions, plans, conversations, and knowledge in Cortex AgentiX. - [Agentic Assistant Hub](https://cortex-docs.paloaltonetworks.com/cortex-agentix/configure-cortex-agentix/configure-the-cortex-agentic-assistant/agents-hub.md): Manage Cortex Agentic Assistant agents and actions in Cortex AgentiX using the Agentic Assistant Hub. - [Manage actions](https://cortex-docs.paloaltonetworks.com/cortex-agentix/configure-cortex-agentix/configure-the-cortex-agentic-assistant/agents-hub/manage-actions.md): Manage system and custom Agentic Assistant actions in Cortex AgentiX, including sensitive action approvals. - [Register actions](https://cortex-docs.paloaltonetworks.com/cortex-agentix/configure-cortex-agentix/configure-the-cortex-agentic-assistant/agents-hub/register-actions.md): Register scripts, commands, and AI prompts as Agentic Assistant actions in Cortex AgentiX. - [Manage agents](https://cortex-docs.paloaltonetworks.com/cortex-agentix/configure-cortex-agentix/configure-the-cortex-agentic-assistant/agents-hub/manage-agents.md): Manage system and custom Agentic Assistant agents in Cortex AgentiX, including actions and permissions. - [Build agents](https://cortex-docs.paloaltonetworks.com/cortex-agentix/configure-cortex-agentix/configure-the-cortex-agentic-assistant/agents-hub/build-agents.md): Build custom Agentic Assistant agents in Cortex AgentiX with instructions, knowledge, roles, and actions. - [Manage knowledge sources (preview)](https://cortex-docs.paloaltonetworks.com/cortex-agentix/configure-cortex-agentix/configure-the-cortex-agentic-assistant/agents-hub/manage-knowledge-sources-preview.md): Add, manage, and sync Knowledge Center knowledge sources to ground Cortex AgentiX Agentic Assistant agents with trusted organizational and system knowledge. - [Expand agent capabilities with MCP integrations](https://cortex-docs.paloaltonetworks.com/cortex-agentix/configure-cortex-agentix/configure-the-cortex-agentic-assistant/agents-hub/expand-agent-capabilities-with-mcp-integrations.md): Connect Model Context Protocol (MCP) integrations in Cortex AgentiX to extend Agentic Assistant agents with third-party tools and external system access. - [Agentic Assistant role-based access control](https://cortex-docs.paloaltonetworks.com/cortex-agentix/configure-cortex-agentix/configure-the-cortex-agentic-assistant/agentic-assistant-role-based-access-control.md): Configure role-based access for Cortex Agentic Assistant agents, actions, and chat in Cortex AgentiX. - [Cortex MCP server](https://cortex-docs.paloaltonetworks.com/cortex-agentix/configure-cortex-agentix/cortex-mcp-server.md): Connect LLM applications to Cortex AgentiX using the Cortex MCP server for natural-language security workflows. - [Install the Cortex MCP server](https://cortex-docs.paloaltonetworks.com/cortex-agentix/configure-cortex-agentix/cortex-mcp-server/install-the-cortex-mcp-server.md): Install the Cortex MCP server for natural-language case and issue management in Cortex AgentiX. - [Configure the MCP client](https://cortex-docs.paloaltonetworks.com/cortex-agentix/configure-cortex-agentix/cortex-mcp-server/configure-the-mcp-client.md): Configure an MCP client to connect securely to the Cortex MCP server in Cortex AgentiX. - [Use the Cortex MCP server](https://cortex-docs.paloaltonetworks.com/cortex-agentix/configure-cortex-agentix/cortex-mcp-server/use-the-cortex-mcp-server.md): Use Cortex MCP server tools to investigate and manage cases, issues, and assets in Cortex AgentiX. - [Create custom Cortex MCP server tools](https://cortex-docs.paloaltonetworks.com/cortex-agentix/configure-cortex-agentix/cortex-mcp-server/create-custom-cortex-mcp-server-tools.md): Create custom OpenAPI and Python tools for Cortex MCP server workflows in Cortex AgentiX. - [Remote repository management](https://cortex-docs.paloaltonetworks.com/cortex-agentix/configure-cortex-agentix/remote-repository-management.md): Manage Cortex AgentiX content across development and production tenants with remote repositories. - [Cortex AgentiX development tenant](https://cortex-docs.paloaltonetworks.com/cortex-agentix/configure-cortex-agentix/remote-repository-management/cortex-agentix-development-tenant.md): Develop, test, and synchronize Cortex AgentiX content safely before deploying it to production. - [Set up a remote repository](https://cortex-docs.paloaltonetworks.com/cortex-agentix/configure-cortex-agentix/remote-repository-management/set-up-a-remote-repository.md): Configure a built-in or private remote repository for Cortex AgentiX content version control. - [Set up a built-in remote repository](https://cortex-docs.paloaltonetworks.com/cortex-agentix/configure-cortex-agentix/remote-repository-management/set-up-a-remote-repository/set-up-a-built-in-remote-repository.md): Set up the built-in remote repository to synchronize Cortex AgentiX content between tenants. - [Set up a Private Remote Repository](https://cortex-docs.paloaltonetworks.com/cortex-agentix/configure-cortex-agentix/remote-repository-management/set-up-a-remote-repository/set-up-a-private-remote-repository.md): Configure a private Git remote repository for Cortex AgentiX content synchronization and collaboration. - [Push and pull content](https://cortex-docs.paloaltonetworks.com/cortex-agentix/configure-cortex-agentix/remote-repository-management/push-and-pull-content.md): Push and pull Cortex AgentiX content between development and production tenants using remote repositories. - [Remote repository troubleshooting](https://cortex-docs.paloaltonetworks.com/cortex-agentix/configure-cortex-agentix/remote-repository-management/remote-repository-troubleshooting.md): Troubleshoot Cortex AgentiX remote repository setup, branch conflicts, and repository type changes. - [Users and roles management](https://cortex-docs.paloaltonetworks.com/cortex-agentix/configure-cortex-agentix/users-and-roles-management.md): Manage Cortex AgentiX users, roles, user groups, authentication, and access permissions. - [Users, groups, and roles in Cortex AgentiX](https://cortex-docs.paloaltonetworks.com/cortex-agentix/configure-cortex-agentix/users-and-roles-management/users-and-roles-in-cortex-agentix.md): Set up and configure roles and user groups for the Cortex AgentiX tenant and Cortex Gateway. Configure authentication and manage users. - [Roles management](https://cortex-docs.paloaltonetworks.com/cortex-agentix/configure-cortex-agentix/users-and-roles-management/roles-management.md): Manage Cortex AgentiX roles, permissions, and role assignments in Cortex Gateway and tenant environments. - [Manage roles in the Cortex AgentiX tenant](https://cortex-docs.paloaltonetworks.com/cortex-agentix/configure-cortex-agentix/users-and-roles-management/roles-management/manage-roles-in-the-cortex-agentix-tenant.md): Create, edit, and manage roles in your Cortex AgentiX tenant. - [Role permissions by component](https://cortex-docs.paloaltonetworks.com/cortex-agentix/configure-cortex-agentix/users-and-roles-management/roles-management/role-permissions-by-component.md): Review the permissions available for each Cortex AgentiX component. - [Dashboards and Reports permissions](https://cortex-docs.paloaltonetworks.com/cortex-agentix/configure-cortex-agentix/users-and-roles-management/roles-management/role-permissions-by-component/dashboards-and-reports-permissions.md): Configure Cortex AgentiX permissions for dashboards, reports, widgets, and security posture visibility. - [Dashboards permissions](https://cortex-docs.paloaltonetworks.com/cortex-agentix/configure-cortex-agentix/users-and-roles-management/roles-management/role-permissions-by-component/dashboards-and-reports-permissions/dashboards-permissions.md): Configure Cortex AgentiX dashboard permissions for viewing, creating, sharing, and accessing widget data. - [Reports permissions](https://cortex-docs.paloaltonetworks.com/cortex-agentix/configure-cortex-agentix/users-and-roles-management/roles-management/role-permissions-by-component/dashboards-and-reports-permissions/reports-permissions.md): Configure Cortex AgentiX permissions for reports, report templates, object access, and security data visibility. - [Command Center Dashboard permissions](https://cortex-docs.paloaltonetworks.com/cortex-agentix/configure-cortex-agentix/users-and-roles-management/roles-management/role-permissions-by-component/dashboards-and-reports-permissions/command-center-dashboard-permissions.md): Configure Cortex Command Center Dashboard access and required permissions for dashboards, cases, and playbooks in Cortex AgentiX. - [Cases and Issues permissions](https://cortex-docs.paloaltonetworks.com/cortex-agentix/configure-cortex-agentix/users-and-roles-management/roles-management/role-permissions-by-component/cases-and-issues-permissions.md): Configure Cortex AgentiX permissions for case and issue triage, investigation, playbook response, and security operations. - [Investigation and Response permissions](https://cortex-docs.paloaltonetworks.com/cortex-agentix/configure-cortex-agentix/users-and-roles-management/roles-management/role-permissions-by-component/investigation-and-response-permissions.md): Explore Cortex AgentiX permissions for investigation, response, automation, threat intelligence, and related workflows. - [Query Library permissions](https://cortex-docs.paloaltonetworks.com/cortex-agentix/configure-cortex-agentix/users-and-roles-management/roles-management/role-permissions-by-component/investigation-and-response-permissions/query-library-permissions.md): Configure Query Library permissions for saving, sharing, reusing, running, and scheduling XQL queries in Cortex AgentiX. - [Query Center permissions](https://cortex-docs.paloaltonetworks.com/cortex-agentix/configure-cortex-agentix/users-and-roles-management/roles-management/role-permissions-by-component/investigation-and-response-permissions/query-center-permissions.md): Configure Query Center permissions for writing, running, scheduling, and exporting XQL queries with scoped data access. - [Playbook permissions](https://cortex-docs.paloaltonetworks.com/cortex-agentix/configure-cortex-agentix/users-and-roles-management/roles-management/role-permissions-by-component/investigation-and-response-permissions/playbook-permissions.md): Configure Cortex AgentiX permissions for accessing, building, sharing, and running automated response playbooks. - [Script permissions](https://cortex-docs.paloaltonetworks.com/cortex-agentix/configure-cortex-agentix/users-and-roles-management/roles-management/role-permissions-by-component/investigation-and-response-permissions/script-permissions.md): Configure Cortex AgentiX permissions for accessing, creating, sharing, and running automation scripts, including elevated scripts. - [Jobs permissions](https://cortex-docs.paloaltonetworks.com/cortex-agentix/configure-cortex-agentix/users-and-roles-management/roles-management/role-permissions-by-component/investigation-and-response-permissions/jobs-permissions.md): Configure Cortex AgentiX permissions for viewing, managing, and running scheduled automation jobs and playbooks. - [Playground permissions](https://cortex-docs.paloaltonetworks.com/cortex-agentix/configure-cortex-agentix/users-and-roles-management/roles-management/role-permissions-by-component/investigation-and-response-permissions/playground-permissions.md): Configure Cortex AgentiX Playground permissions for testing automation commands, scripts, playbooks, and integrations. - [Automation Exclusion Center permissions](https://cortex-docs.paloaltonetworks.com/cortex-agentix/configure-cortex-agentix/users-and-roles-management/roles-management/role-permissions-by-component/investigation-and-response-permissions/automation-exclusion-center-permissions.md): Configure Automation Exclusion Center permissions for managing remediation exclusions, assets, policies, and automation controls. - [Threat Management permissions](https://cortex-docs.paloaltonetworks.com/cortex-agentix/configure-cortex-agentix/users-and-roles-management/roles-management/role-permissions-by-component/threat-management-permissions.md): Configure Cortex AgentiX permissions for detection rules, threat intelligence, Marketplace content, and exception workflows. - [Detection Rules permissions](https://cortex-docs.paloaltonetworks.com/cortex-agentix/configure-cortex-agentix/users-and-roles-management/roles-management/role-permissions-by-component/threat-management-permissions/detection-rules-permissions.md): Configure Cortex AgentiX permissions for viewing and managing correlation and indicator detection rules. - [Threat Intelligence permissions](https://cortex-docs.paloaltonetworks.com/cortex-agentix/configure-cortex-agentix/users-and-roles-management/roles-management/role-permissions-by-component/threat-management-permissions/threat-intelligence-permissions.md): Configure Cortex AgentiX permissions for indicators, threat intelligence feeds, TIM, and Extended Threat Intelligence. - [Marketplace permissions](https://cortex-docs.paloaltonetworks.com/cortex-agentix/configure-cortex-agentix/users-and-roles-management/roles-management/role-permissions-by-component/marketplace-permissions.md): Configure Cortex AgentiX Marketplace permissions for browsing, installing, updating, and managing automation content packs. - [Exceptions Configuration permissions](https://cortex-docs.paloaltonetworks.com/cortex-agentix/configure-cortex-agentix/users-and-roles-management/roles-management/role-permissions-by-component/exceptions-configuration-permissions.md): Configure Cortex AgentiX permissions for issue suppression, exception rules, and exception approval workflows. - [Exception Management Admin permissions](https://cortex-docs.paloaltonetworks.com/cortex-agentix/configure-cortex-agentix/users-and-roles-management/roles-management/role-permissions-by-component/exceptions-configuration-permissions/exception-management-admin-permissions.md): Configure Exception Management Admin permissions in Cortex AgentiX. - [Exception Approver Admin permissions](https://cortex-docs.paloaltonetworks.com/cortex-agentix/configure-cortex-agentix/users-and-roles-management/roles-management/role-permissions-by-component/exceptions-configuration-permissions/exception-approver-admin-permissions.md): Configure Exception Approver Admin permissions in Cortex AgentiX. - [Configuration permissions](https://cortex-docs.paloaltonetworks.com/cortex-agentix/configure-cortex-agentix/users-and-roles-management/roles-management/role-permissions-by-component/configuration-permissions.md): Explore Cortex AgentiX role permissions for configuration, administration, data, integrations, and platform settings. - [Auditing permissions](https://cortex-docs.paloaltonetworks.com/cortex-agentix/configure-cortex-agentix/users-and-roles-management/roles-management/role-permissions-by-component/configuration-permissions/auditing-permissions.md): Control access to Cortex AgentiX management audit logs. - [Alert Notifications permissions](https://cortex-docs.paloaltonetworks.com/cortex-agentix/configure-cortex-agentix/users-and-roles-management/roles-management/role-permissions-by-component/configuration-permissions/alert-notifications-permissions.md): Control access to Cortex AgentiX alert notification settings and forwarding. - [General Configuration permissions](https://cortex-docs.paloaltonetworks.com/cortex-agentix/configure-cortex-agentix/users-and-roles-management/roles-management/role-permissions-by-component/configuration-permissions/general-configuration-permissions.md): Control access to Cortex AgentiX tenant-wide server and configuration settings. - [Access management permissions](https://cortex-docs.paloaltonetworks.com/cortex-agentix/configure-cortex-agentix/users-and-roles-management/roles-management/role-permissions-by-component/configuration-permissions/access-management-permissions.md): Control access to Cortex AgentiX users, roles, groups, and authentication settings. - [Data Sources permissions](https://cortex-docs.paloaltonetworks.com/cortex-agentix/configure-cortex-agentix/users-and-roles-management/roles-management/role-permissions-by-component/configuration-permissions/data-sources-permissions.md): Control access to Cortex AgentiX cloud and third-party data source integrations. - [Integrations - instance permissions](https://cortex-docs.paloaltonetworks.com/cortex-agentix/configure-cortex-agentix/users-and-roles-management/roles-management/role-permissions-by-component/configuration-permissions/integrations-instance-permissions.md): Control access to Cortex AgentiX data collection integration instances. - [Data Management permissions](https://cortex-docs.paloaltonetworks.com/cortex-agentix/configure-cortex-agentix/users-and-roles-management/roles-management/role-permissions-by-component/configuration-permissions/data-management-permissions.md): Control access to Cortex AgentiX dataset configuration and data lifecycle management. - [Public API](https://cortex-docs.paloaltonetworks.com/cortex-agentix/configure-cortex-agentix/users-and-roles-management/roles-management/role-permissions-by-component/configuration-permissions/public-api.md): Control access to Cortex AgentiX API keys and compute unit usage. - [Threat Intelligence permission - API configuration](https://cortex-docs.paloaltonetworks.com/cortex-agentix/configure-cortex-agentix/users-and-roles-management/roles-management/role-permissions-by-component/configuration-permissions/threat-intelligence-permission-api-configuration.md): Control access to Cortex AgentiX external threat intelligence API configuration. - [Integrations Permissions](https://cortex-docs.paloaltonetworks.com/cortex-agentix/configure-cortex-agentix/users-and-roles-management/roles-management/role-permissions-by-component/configuration-permissions/integrations-permissions.md): Control Cortex AgentiX role-based access to integration commands. - [Credentials permissions](https://cortex-docs.paloaltonetworks.com/cortex-agentix/configure-cortex-agentix/users-and-roles-management/roles-management/role-permissions-by-component/configuration-permissions/credentials-permissions.md): Control access to Cortex AgentiX credentials for integrations and automation. - [Case Properties permissions](https://cortex-docs.paloaltonetworks.com/cortex-agentix/configure-cortex-agentix/users-and-roles-management/roles-management/role-permissions-by-component/configuration-permissions/case-properties-permissions.md): Control access to Cortex AgentiX case domains, statuses, and properties. - [Exclusion list permissions](https://cortex-docs.paloaltonetworks.com/cortex-agentix/configure-cortex-agentix/users-and-roles-management/roles-management/role-permissions-by-component/configuration-permissions/exclusion-list-permissions.md): Control access to Cortex AgentiX indicator exclusion list configuration. - [Fields and Types permissions](https://cortex-docs.paloaltonetworks.com/cortex-agentix/configure-cortex-agentix/users-and-roles-management/roles-management/role-permissions-by-component/configuration-permissions/fields-and-types-permissions.md): Control access to Cortex AgentiX custom fields and indicator types. - [Layout permissions](https://cortex-docs.paloaltonetworks.com/cortex-agentix/configure-cortex-agentix/users-and-roles-management/roles-management/role-permissions-by-component/configuration-permissions/layout-permissions.md): Control access to Cortex AgentiX case and issue layout configuration. - [Sync Profile permissions](https://cortex-docs.paloaltonetworks.com/cortex-agentix/configure-cortex-agentix/users-and-roles-management/roles-management/role-permissions-by-component/configuration-permissions/sync-profile-permissions.md): Control access to Cortex AgentiX case mirroring sync profile configuration. - [Help permissions](https://cortex-docs.paloaltonetworks.com/cortex-agentix/configure-cortex-agentix/users-and-roles-management/roles-management/role-permissions-by-component/help-permissions.md): Configure Cortex AgentiX permissions for creating support cases, attaching troubleshooting artifacts, and contacting support. - [Cortex Agentic Assistant permissions](https://cortex-docs.paloaltonetworks.com/cortex-agentix/configure-cortex-agentix/users-and-roles-management/roles-management/role-permissions-by-component/cortex-agentic-assistant-permissions.md): Configure Agentic Assistant permissions for AI prompts, agents, natural-language investigations, and automated actions in Cortex AgentiX. - [AI Prompts](https://cortex-docs.paloaltonetworks.com/cortex-agentix/configure-cortex-agentix/users-and-roles-management/roles-management/role-permissions-by-component/cortex-agentic-assistant-permissions/ai-prompts.md): Configure AI Prompt Library permissions for creating reusable prompts and managing AI tasks in Cortex AgentiX playbooks. - [Cortex Agentic Assistant Agents](https://cortex-docs.paloaltonetworks.com/cortex-agentix/configure-cortex-agentix/users-and-roles-management/roles-management/role-permissions-by-component/cortex-agentic-assistant-permissions/cortex-agentic-assistant-agents.md): Configure Cortex AgentiX Agentic Assistant permissions for agent interactions, actions, custom agents, and administrator controls. - [User group management](https://cortex-docs.paloaltonetworks.com/cortex-agentix/configure-cortex-agentix/users-and-roles-management/user-group-management.md): Manage Cortex AgentiX user groups, role assignments, nested groups, SAML mapping, and scoped access. - [User management](https://cortex-docs.paloaltonetworks.com/cortex-agentix/configure-cortex-agentix/users-and-roles-management/user-management.md): Manage Cortex AgentiX user accounts, roles, groups, SSO access, scopes, and user status in Gateway or tenants. - [Manage users in the Cortex AgentiX tenant](https://cortex-docs.paloaltonetworks.com/cortex-agentix/configure-cortex-agentix/users-and-roles-management/user-management/manage-users-in-the-cortex-agentix-tenant.md): Manage Cortex AgentiX tenant users, roles, groups, scoped access, deactivation, and bulk role assignments. - [Manage user scope](https://cortex-docs.paloaltonetworks.com/cortex-agentix/configure-cortex-agentix/users-and-roles-management/user-management/manage-user-scope.md): Configure Scope-Based Access Control in Cortex AgentiX to apply granular case and issue access alongside RBAC. - [Manage access to objects](https://cortex-docs.paloaltonetworks.com/cortex-agentix/configure-cortex-agentix/users-and-roles-management/manage-access-to-objects.md): Learn more about managing access to objects in Cortex AgentiX. - [Manage access to custom dashboards](https://cortex-docs.paloaltonetworks.com/cortex-agentix/configure-cortex-agentix/users-and-roles-management/manage-access-to-objects/manage-access-to-custom-dashboards.md): Manage custom dashboard sharing, role permissions, ownership, widget visibility, and data access in Cortex AgentiX. - [Manage access to report templates](https://cortex-docs.paloaltonetworks.com/cortex-agentix/configure-cortex-agentix/users-and-roles-management/manage-access-to-objects/manage-access-to-report-templates.md): Manage report template sharing, role permissions, ownership, generated report access, and scoped data in Cortex AgentiX. - [Manage access to playbooks and scripts](https://cortex-docs.paloaltonetworks.com/cortex-agentix/configure-cortex-agentix/users-and-roles-management/manage-access-to-objects/manage-access-to-playbooks-and-scripts.md): Manage playbook and script sharing, role permissions, ownership, imports, and automation execution access in Cortex AgentiX. - [Manage access to saved queries](https://cortex-docs.paloaltonetworks.com/cortex-agentix/configure-cortex-agentix/users-and-roles-management/manage-access-to-objects/manage-access-to-saved-queries.md): Manage saved XQL query sharing, role permissions, ownership, and public or restricted visibility in Cortex AgentiX. - [Set up authentication](https://cortex-docs.paloaltonetworks.com/cortex-agentix/configure-cortex-agentix/users-and-roles-management/set-up-authentication.md): Authenticate Cortex AgentiX users using SAML 2.0 or Customer Support Portal (CSP). - [Authenticate users through the Customer Support Portal](https://cortex-docs.paloaltonetworks.com/cortex-agentix/configure-cortex-agentix/users-and-roles-management/set-up-authentication/authenticate-users-through-the-customer-support-portal.md): Authenticate Cortex AgentiX users through the Customer Support Portal and assign roles for Gateway and tenant access. - [Authenticate users using SSO](https://cortex-docs.paloaltonetworks.com/cortex-agentix/configure-cortex-agentix/users-and-roles-management/set-up-authentication/authenticate-users-using-sso.md): Configure SAML 2.0 SSO for Cortex AgentiX with identity provider mapping, user groups, roles, and tenant access. - [Set up Okta as the Identity Provider Using SAML 2.0](https://cortex-docs.paloaltonetworks.com/cortex-agentix/configure-cortex-agentix/users-and-roles-management/set-up-authentication/set-up-okta-as-the-identity-provider-using-saml-2.0.md): Configure Okta SAML 2.0 SSO for Cortex AgentiX with user attributes, group mapping, and authentication testing. - [Set up Microsoft Entra ID as the Identity Provider Using SAML 2.0](https://cortex-docs.paloaltonetworks.com/cortex-agentix/configure-cortex-agentix/users-and-roles-management/set-up-authentication/set-up-microsoft-entra-id-as-the-identity-provider-using-saml-2.0.md): Configure Microsoft Entra ID SAML 2.0 SSO for Cortex AgentiX with group claims, mappings, and authentication testing. - [Engines](https://cortex-docs.paloaltonetworks.com/cortex-agentix/configure-cortex-agentix/engines.md): Install, configure, manage, and troubleshoot Cortex AgentiX engines for remote network connectivity. - [What is an engine?](https://cortex-docs.paloaltonetworks.com/cortex-agentix/configure-cortex-agentix/engines/what-is-an-engine.md): Understand Cortex AgentiX engines and how they securely connect remote networks to integrations. - [Engine requirements](https://cortex-docs.paloaltonetworks.com/cortex-agentix/configure-cortex-agentix/engines/engine-requirements.md): Review hardware, operating system, and network requirements for Cortex AgentiX engines. - [Install an engine](https://cortex-docs.paloaltonetworks.com/cortex-agentix/configure-cortex-agentix/engines/install-an-engine.md): Install and configure a Cortex AgentiX engine for secure remote network connectivity. - [Docker](https://cortex-docs.paloaltonetworks.com/cortex-agentix/configure-cortex-agentix/engines/docker.md): Install, configure, secure, and troubleshoot Docker for Cortex AgentiX engines. - [Install Docker](https://cortex-docs.paloaltonetworks.com/cortex-agentix/configure-cortex-agentix/engines/docker/install-docker.md): Install Docker and verify required user permissions for Cortex AgentiX engines. - [Install Docker distribution for Red Hat on an engine server](https://cortex-docs.paloaltonetworks.com/cortex-agentix/configure-cortex-agentix/engines/docker/install-docker-distribution-for-red-hat.md): Install Docker and configure SELinux on Red Hat servers for Cortex AgentiX engines. - [Docker image security](https://cortex-docs.paloaltonetworks.com/cortex-agentix/configure-cortex-agentix/engines/docker/docker-image-security.md): Secure and harden Docker images and containers used by Cortex AgentiX engines. - [Docker FAQs](https://cortex-docs.paloaltonetworks.com/cortex-agentix/configure-cortex-agentix/engines/docker/docker-faqs.md): Find answers to common Docker setup and operation questions for Cortex AgentiX engines. - [Troubleshoot Docker Issues](https://cortex-docs.paloaltonetworks.com/cortex-agentix/configure-cortex-agentix/engines/docker/troubleshoot-docker-issues.md): Troubleshoot Docker installation, configuration, and runtime issues for Cortex AgentiX engines. - [Configure Docker pull rate limit](https://cortex-docs.paloaltonetworks.com/cortex-agentix/configure-cortex-agentix/engines/docker/configure-docker-pull-rate-limit.md): Configure Docker pull rate limits for reliable Cortex AgentiX engine image downloads. - [Change the Docker Installation folder](https://cortex-docs.paloaltonetworks.com/cortex-agentix/configure-cortex-agentix/engines/docker/change-the-docker-installation-folder.md): Change the Docker installation folder on servers that host Cortex AgentiX engines. - [Docker hardening guide](https://cortex-docs.paloaltonetworks.com/cortex-agentix/configure-cortex-agentix/engines/docker/docker-hardening-guide.md): Harden Docker deployments that support Cortex AgentiX engines with security configuration guidance. - [Docker network hardening](https://cortex-docs.paloaltonetworks.com/cortex-agentix/configure-cortex-agentix/engines/docker/docker-hardening-guide/docker-network-hardening.md): Harden Docker network settings for secure Cortex AgentiX engine deployments. - [Configure Docker images](https://cortex-docs.paloaltonetworks.com/cortex-agentix/configure-cortex-agentix/engines/docker/docker-hardening-guide/configure-docker-images.md): Configure secure Docker images for Cortex AgentiX engine deployments. - [Run Docker with non-root internal users](https://cortex-docs.paloaltonetworks.com/cortex-agentix/configure-cortex-agentix/engines/docker/docker-hardening-guide/run-docker-with-non-root-internal-users.md): Run Docker with non-root internal users for secure Cortex AgentiX engine operations. - [Configure the memory limit support without swap capabilities](https://cortex-docs.paloaltonetworks.com/cortex-agentix/configure-cortex-agentix/engines/docker/docker-hardening-guide/configure-the-memory-limit-support-without-swap-capabilities.md): Configure Docker memory limits without swap support for Cortex AgentiX engines. - [Configure the memory limitation](https://cortex-docs.paloaltonetworks.com/cortex-agentix/configure-cortex-agentix/engines/docker/docker-hardening-guide/configure-the-memory-limitation.md): Configure Docker memory limits for reliable Cortex AgentiX engine performance. - [Configure the CPU, PIDs, and open the file descriptors limit](https://cortex-docs.paloaltonetworks.com/cortex-agentix/configure-cortex-agentix/engines/docker/docker-hardening-guide/configure-the-cpu-pids-and-open-the-file-descriptors-limit.md): Configure CPU, PID, and file descriptor limits for Cortex AgentiX engine Docker containers. - [Check Docker hardening configurations](https://cortex-docs.paloaltonetworks.com/cortex-agentix/configure-cortex-agentix/engines/docker/docker-hardening-guide/check-docker-hardening-configurations.md): Verify Docker hardening settings for secure Cortex AgentiX engine deployments. - [Podman](https://cortex-docs.paloaltonetworks.com/cortex-agentix/configure-cortex-agentix/engines/podman.md): Install, configure, and troubleshoot Podman for Cortex AgentiX engines. - [Change the Container storage](https://cortex-docs.paloaltonetworks.com/cortex-agentix/configure-cortex-agentix/engines/podman/change-the-container-storage.md): Configure Podman container storage for Cortex AgentiX engines. - [Install Podman](https://cortex-docs.paloaltonetworks.com/cortex-agentix/configure-cortex-agentix/engines/podman/install-podman.md): Install and configure Podman to run Cortex AgentiX engines. - [Migrate from Docker to Podman](https://cortex-docs.paloaltonetworks.com/cortex-agentix/configure-cortex-agentix/engines/podman/migrate-from-docker-to-podman.md): Migrate a Cortex AgentiX engine from Docker to Podman. - [Troubleshoot Podman](https://cortex-docs.paloaltonetworks.com/cortex-agentix/configure-cortex-agentix/engines/podman/troubleshoot-podman.md): Resolve common Podman issues that affect Cortex AgentiX engines. - [Manage engines](https://cortex-docs.paloaltonetworks.com/cortex-agentix/configure-cortex-agentix/engines/manage-engines.md): Manage Cortex AgentiX engines and load-balancing groups for remote integrations. - [Upgrade an engine](https://cortex-docs.paloaltonetworks.com/cortex-agentix/configure-cortex-agentix/engines/upgrade-an-engine.md): Upgrade Cortex AgentiX engines from the tenant or a remote machine. - [Remove an engine](https://cortex-docs.paloaltonetworks.com/cortex-agentix/configure-cortex-agentix/engines/remove-an-engine.md): Remove a Cortex AgentiX engine from a remote machine. - [Configure engines](https://cortex-docs.paloaltonetworks.com/cortex-agentix/configure-cortex-agentix/engines/configure-engines.md): Configure Cortex AgentiX engines using d1.conf or tenant settings. - [Configure the engine to use a web proxy](https://cortex-docs.paloaltonetworks.com/cortex-agentix/configure-cortex-agentix/engines/configure-engines/configure-the-engine-to-use-a-web-proxy.md): Configure a web proxy for Cortex AgentiX engine connectivity. - [Configure the engine to call the server without using a proxy](https://cortex-docs.paloaltonetworks.com/cortex-agentix/configure-cortex-agentix/engines/configure-engines/configure-the-engine-to-call-the-server-without-using-a-proxy.md): Configure a Cortex AgentiX engine to connect to the server without a proxy. - [Use NGINX as a reverse proxy](https://cortex-docs.paloaltonetworks.com/cortex-agentix/configure-cortex-agentix/engines/configure-engines/configure-the-engine-to-call-the-server-without-using-a-proxy/use-nginx-as-a-reverse-proxy.md): Use NGINX as a reverse proxy for Cortex AgentiX engine server connectivity. - [Configure an engine to use custom certificates](https://cortex-docs.paloaltonetworks.com/cortex-agentix/configure-cortex-agentix/engines/configure-engines/configure-an-engine-to-use-custom-certificates.md): Configure custom certificates for secure Cortex AgentiX engine communication. - [Use an engine in an integration](https://cortex-docs.paloaltonetworks.com/cortex-agentix/configure-cortex-agentix/engines/use-an-engine-in-an-integration.md): Use Cortex AgentiX engines and load-balancing groups with integration instances. - [Run a script using an engine](https://cortex-docs.paloaltonetworks.com/cortex-agentix/configure-cortex-agentix/engines/run-a-script-using-an-engine.md): Run Cortex AgentiX automation scripts on engines and load-balancing groups. - [Troubleshoot engines](https://cortex-docs.paloaltonetworks.com/cortex-agentix/configure-cortex-agentix/engines/troubleshoot-engines.md): Troubleshoot Cortex AgentiX engines using logs, errors, and diagnostics. - [Troubleshoot integrations running on engines](https://cortex-docs.paloaltonetworks.com/cortex-agentix/configure-cortex-agentix/engines/troubleshoot-integrations-running-on-engines.md): Troubleshoot Cortex AgentiX integrations that run on engines. - [Cases and issues configuration](https://cortex-docs.paloaltonetworks.com/cortex-agentix/configure-cortex-agentix/cases-and-issues-configuration.md): Configure cases and issues in Cortex AgentiX including domains, fields, and layouts. Set up correlation rules and configure an external dynamic list. - [Case and issue lifecycle](https://cortex-docs.paloaltonetworks.com/cortex-agentix/configure-cortex-agentix/cases-and-issues-configuration/case-and-issue-lifecycle.md): Cases and issues go through various processes in Cortex AgentiX including ingestion, case/issue creation, planning, investigation, and response. - [Customize your cases](https://cortex-docs.paloaltonetworks.com/cortex-agentix/configure-cortex-agentix/cases-and-issues-configuration/customize-your-cases.md): Customize Cortex AgentiX cases with external threat intelligence integrations and verification sources. - [Create a case domain](https://cortex-docs.paloaltonetworks.com/cortex-agentix/configure-cortex-agentix/cases-and-issues-configuration/customize-your-cases/create-a-case-domain.md): Create custom case domains in Cortex AgentiX to organize workflows and control access. - [Create a starring configuration](https://cortex-docs.paloaltonetworks.com/cortex-agentix/configure-cortex-agentix/cases-and-issues-configuration/customize-your-cases/create-a-starring-configuration.md): Create Cortex AgentiX case starring configurations that identify and prioritize matching issues. - [Set up case scoring](https://cortex-docs.paloaltonetworks.com/cortex-agentix/configure-cortex-agentix/cases-and-issues-configuration/customize-your-cases/set-up-case-scoring.md): Set up Cortex AgentiX case scoring rules to prioritize issues based on defined criteria. - [Create custom case statuses and resolution reasons](https://cortex-docs.paloaltonetworks.com/cortex-agentix/configure-cortex-agentix/cases-and-issues-configuration/customize-your-cases/create-custom-case-statuses-and-resolution-reasons.md): Create custom Cortex AgentiX case statuses and resolution reasons for your workflows. - [Customize issue fields and layouts](https://cortex-docs.paloaltonetworks.com/cortex-agentix/configure-cortex-agentix/cases-and-issues-configuration/customize-issue-fields-and-layouts.md): Customize Cortex AgentiX issue fields and layouts for system and custom issue data. - [Issue fields](https://cortex-docs.paloaltonetworks.com/cortex-agentix/configure-cortex-agentix/cases-and-issues-configuration/customize-issue-fields-and-layouts/issue-fields.md): Manage Cortex AgentiX issue fields, including system, content-pack, and custom fields for detection workflows and issue layouts. - [Issue field types](https://cortex-docs.paloaltonetworks.com/cortex-agentix/configure-cortex-agentix/cases-and-issues-configuration/customize-issue-fields-and-layouts/issue-fields/issue-field-types.md): Learn about available Cortex AgentiX issue field types and their behaviors. - [Create custom issue fields](https://cortex-docs.paloaltonetworks.com/cortex-agentix/configure-cortex-agentix/cases-and-issues-configuration/customize-issue-fields-and-layouts/issue-fields/create-custom-issue-fields.md): Create custom Cortex AgentiX issue fields for mappings, correlations, and issue layouts. - [Create a grid field for an issue](https://cortex-docs.paloaltonetworks.com/cortex-agentix/configure-cortex-agentix/cases-and-issues-configuration/customize-issue-fields-and-layouts/issue-fields/create-custom-issue-fields/create-a-grid-field-for-an-issue.md): Create a Cortex AgentiX grid field to capture and edit tabular issue data. - [Issue field triggered scripts](https://cortex-docs.paloaltonetworks.com/cortex-agentix/configure-cortex-agentix/cases-and-issues-configuration/customize-issue-fields-and-layouts/issue-fields/create-custom-issue-fields/issue-field-triggered-scripts.md): Automate Cortex AgentiX issue workflows with scripts triggered by issue field changes. - [Issue timer fields](https://cortex-docs.paloaltonetworks.com/cortex-agentix/configure-cortex-agentix/cases-and-issues-configuration/customize-issue-fields-and-layouts/issue-fields/create-custom-issue-fields/issue-timer-fields.md): Use Cortex AgentiX issue timer fields to track response times and issue metrics. - [Configure issue timer fields](https://cortex-docs.paloaltonetworks.com/cortex-agentix/configure-cortex-agentix/cases-and-issues-configuration/customize-issue-fields-and-layouts/issue-fields/create-custom-issue-fields/issue-timer-fields/configure-issue-timer-fields.md): Configure Cortex AgentiX issue timer fields with targets, risk thresholds, and timeout scripts. - [Configure a playbook to run timers](https://cortex-docs.paloaltonetworks.com/cortex-agentix/configure-cortex-agentix/cases-and-issues-configuration/customize-issue-fields-and-layouts/issue-fields/create-custom-issue-fields/issue-timer-fields/configure-a-playbook-to-run-timers.md): Configure Cortex AgentiX playbooks to start, pause, and stop issue timers. - [Automate changes to issue fields using timer scripts](https://cortex-docs.paloaltonetworks.com/cortex-agentix/configure-cortex-agentix/cases-and-issues-configuration/customize-issue-fields-and-layouts/issue-fields/create-custom-issue-fields/issue-timer-fields/automate-changes-to-issue-fields-using-timer-scripts.md): Automate Cortex AgentiX issue field updates with scripts triggered by timer timeouts. - [Use issue timer field commands manually in the CLI](https://cortex-docs.paloaltonetworks.com/cortex-agentix/configure-cortex-agentix/cases-and-issues-configuration/customize-issue-fields-and-layouts/issue-fields/create-custom-issue-fields/issue-timer-fields/use-issue-timer-field-commands-manually-in-the-cli.md): Manage Cortex AgentiX issue timer fields manually with CLI commands. - [Issue layouts](https://cortex-docs.paloaltonetworks.com/cortex-agentix/configure-cortex-agentix/cases-and-issues-configuration/customize-issue-fields-and-layouts/issue-layouts.md): Configure Cortex AgentiX issue layouts to control data displayed during issue investigations. - [Create custom issue layouts](https://cortex-docs.paloaltonetworks.com/cortex-agentix/configure-cortex-agentix/cases-and-issues-configuration/customize-issue-fields-and-layouts/issue-layouts/create-custom-issue-layouts.md): Create custom Cortex AgentiX issue layouts with tailored fields, sections, and action buttons. - [Add a custom widget to an issue layout](https://cortex-docs.paloaltonetworks.com/cortex-agentix/configure-cortex-agentix/cases-and-issues-configuration/customize-issue-fields-and-layouts/issue-layouts/add-a-custom-widget-to-an-issue-layout.md): Add custom widgets to Cortex AgentiX issue layouts with dynamic sections and automation scripts. - [Create rules for issue layouts](https://cortex-docs.paloaltonetworks.com/cortex-agentix/configure-cortex-agentix/cases-and-issues-configuration/customize-issue-fields-and-layouts/issue-layouts/create-rules-for-issue-layouts.md): Create Cortex AgentiX issue layout rules to assign layouts by issue criteria. - [Customize case fields and layouts](https://cortex-docs.paloaltonetworks.com/cortex-agentix/configure-cortex-agentix/cases-and-issues-configuration/customize-case-fields-and-layouts.md): Customize Cortex AgentiX case fields and layouts for system and custom case data. - [Case fields](https://cortex-docs.paloaltonetworks.com/cortex-agentix/configure-cortex-agentix/cases-and-issues-configuration/customize-case-fields-and-layouts/case-fields.md): Manage Cortex AgentiX system, content-pack, and custom case fields for case layouts. - [Case field types](https://cortex-docs.paloaltonetworks.com/cortex-agentix/configure-cortex-agentix/cases-and-issues-configuration/customize-case-fields-and-layouts/case-fields/case-field-types.md): Learn about Cortex AgentiX case field types, including timer and SLA fields. - [Create custom case fields](https://cortex-docs.paloaltonetworks.com/cortex-agentix/configure-cortex-agentix/cases-and-issues-configuration/customize-case-fields-and-layouts/case-fields/create-custom-case-fields.md): Create custom Cortex AgentiX case fields for mappings, correlations, and case layouts. - [Create a grid field for a case](https://cortex-docs.paloaltonetworks.com/cortex-agentix/configure-cortex-agentix/cases-and-issues-configuration/customize-case-fields-and-layouts/case-fields/create-custom-case-fields/create-a-grid-field-for-a-case.md): Create a Cortex AgentiX grid field to capture and edit tabular case data. - [Update case fields](https://cortex-docs.paloaltonetworks.com/cortex-agentix/configure-cortex-agentix/cases-and-issues-configuration/customize-case-fields-and-layouts/case-fields/create-custom-case-fields/update-case-fields.md): Update Cortex AgentiX case fields with CLI commands, scripts, and playbooks. - [Create case timers and SLAs](https://cortex-docs.paloaltonetworks.com/cortex-agentix/configure-cortex-agentix/cases-and-issues-configuration/customize-case-fields-and-layouts/case-fields/create-case-timers-and-slas.md): Create Cortex AgentiX case timers and SLAs to track performance and response goals. - [Case layouts](https://cortex-docs.paloaltonetworks.com/cortex-agentix/configure-cortex-agentix/cases-and-issues-configuration/customize-case-fields-and-layouts/case-layouts.md): Manage Cortex AgentiX default and custom case layouts for case investigation data. - [Create custom case layouts](https://cortex-docs.paloaltonetworks.com/cortex-agentix/configure-cortex-agentix/cases-and-issues-configuration/customize-case-fields-and-layouts/case-layouts/create-custom-case-layouts.md): Create custom Cortex AgentiX case layouts with tailored fields, sections, and action buttons. - [Create rules for case layouts](https://cortex-docs.paloaltonetworks.com/cortex-agentix/configure-cortex-agentix/cases-and-issues-configuration/customize-case-fields-and-layouts/case-layouts/create-rules-for-case-layouts.md): Create Cortex AgentiX case layout rules to assign layouts by case criteria. - [Issue syncing](https://cortex-docs.paloaltonetworks.com/cortex-agentix/configure-cortex-agentix/cases-and-issues-configuration/issue-syncing.md): Sync Cortex AgentiX issues with external applications using inbound, outbound, or bi-directional synchronization. - [Create a sync profile](https://cortex-docs.paloaltonetworks.com/cortex-agentix/configure-cortex-agentix/cases-and-issues-configuration/issue-syncing/create-a-sync-profile.md): Create inbound and outbound sync profiles to map fields between Cortex AgentiX issues and external applications. - [Create issue exceptions](https://cortex-docs.paloaltonetworks.com/cortex-agentix/configure-cortex-agentix/cases-and-issues-configuration/create-issue-exceptions.md): Manage Cortex AgentiX issue exceptions to defer remediation and pause issue SLA timers. - [Configure the issue exception approval workflow](https://cortex-docs.paloaltonetworks.com/cortex-agentix/configure-cortex-agentix/cases-and-issues-configuration/create-issue-exceptions/configure-the-issue-exception-approval-workflow.md): Configure Cortex AgentiX issue exception approval workflows and approvers. - [Create an issue exception rule](https://cortex-docs.paloaltonetworks.com/cortex-agentix/configure-cortex-agentix/cases-and-issues-configuration/create-issue-exceptions/create-an-issue-exception-rule.md): Create Cortex AgentiX issue exception rules to defer remediation for matching issues. - [Create an exception rule from an issue](https://cortex-docs.paloaltonetworks.com/cortex-agentix/configure-cortex-agentix/cases-and-issues-configuration/create-issue-exceptions/create-an-exception-rule-from-an-issue.md): Create a Cortex AgentiX issue exception rule directly from an issue. - [View issue Exception Rules](https://cortex-docs.paloaltonetworks.com/cortex-agentix/configure-cortex-agentix/cases-and-issues-configuration/create-issue-exceptions/view-issue-exception-rules.md): View Cortex AgentiX issue exception rules, statuses, and impacted issues. - [Disable issue exception rules](https://cortex-docs.paloaltonetworks.com/cortex-agentix/configure-cortex-agentix/cases-and-issues-configuration/create-issue-exceptions/disable-issue-exception-rules.md): Disable Cortex AgentiX issue exception rules to stop creating issue exceptions. - [View excepted issues](https://cortex-docs.paloaltonetworks.com/cortex-agentix/configure-cortex-agentix/cases-and-issues-configuration/create-issue-exceptions/view-excepted-issues.md): View Cortex AgentiX excepted issues and track remaining exception periods. - [What's a correlation rule?](https://cortex-docs.paloaltonetworks.com/cortex-agentix/configure-cortex-agentix/cases-and-issues-configuration/whats-a-correlation-rule.md): Use correlation rules and XQL to detect event patterns and generate issues in Cortex AgentiX. - [Correlation rule details](https://cortex-docs.paloaltonetworks.com/cortex-agentix/configure-cortex-agentix/cases-and-issues-configuration/whats-a-correlation-rule/correlation-rule-details.md): Review correlation rule fields, execution status, and error details in Cortex AgentiX. - [Create a correlation rule](https://cortex-docs.paloaltonetworks.com/cortex-agentix/configure-cortex-agentix/cases-and-issues-configuration/whats-a-correlation-rule/create-a-correlation-rule.md): Create correlation rules with XQL queries, schedules, suppression, and actions in Cortex AgentiX. - [Manage correlation rules](https://cortex-docs.paloaltonetworks.com/cortex-agentix/configure-cortex-agentix/cases-and-issues-configuration/whats-a-correlation-rule/manage-correlation-rules.md): Manage correlation rules, including execution, editing, and import or export in Cortex AgentiX. - [Optimize case grouping in correlations](https://cortex-docs.paloaltonetworks.com/cortex-agentix/configure-cortex-agentix/cases-and-issues-configuration/optimize-case-grouping-in-correlations.md): Map correlation rule fields in Cortex AgentiX to improve case grouping, reduce issue fragmentation, and support ML-based prioritization. - [Automations](https://cortex-docs.paloaltonetworks.com/cortex-agentix/configure-cortex-agentix/automations.md): Build and manage automated security workflows with playbooks, scripts, context data, and jobs in Cortex AgentiX. - [Automation in Cortex AgentiX](https://cortex-docs.paloaltonetworks.com/cortex-agentix/configure-cortex-agentix/automations/automation-in-cortex-agentix.md): Automate issue response with playbooks, Quick Actions, and automation rules in Cortex AgentiX. - [Quick Actions](https://cortex-docs.paloaltonetworks.com/cortex-agentix/configure-cortex-agentix/automations/quick-actions.md): Use Quick Actions in Cortex AgentiX to run manual security investigation and response workflows. - [Automation Exclusion Center](https://cortex-docs.paloaltonetworks.com/cortex-agentix/configure-cortex-agentix/automations/automation-exclusion-center.md): Manage automation exclusion policies in Cortex AgentiX to protect critical assets from remediation. - [Manage automation exclusion policies](https://cortex-docs.paloaltonetworks.com/cortex-agentix/configure-cortex-agentix/automations/automation-exclusion-center/manage-automation-exclusion-policies.md): Create and manage automation exclusion policies in Cortex AgentiX to control remediation actions. - [Playbooks](https://cortex-docs.paloaltonetworks.com/cortex-agentix/configure-cortex-agentix/automations/playbooks.md): Build and manage playbooks in Cortex AgentiX to automate security response workflows. - [Playbooks overview](https://cortex-docs.paloaltonetworks.com/cortex-agentix/configure-cortex-agentix/automations/playbooks/playbooks-overview.md): Learn how playbooks automate investigation and response workflows in Cortex AgentiX. - [Access to playbooks](https://cortex-docs.paloaltonetworks.com/cortex-agentix/configure-cortex-agentix/automations/playbooks/access-to-playbooks.md): Manage access to playbooks with object-level roles in Cortex AgentiX. - [Playbook development checklist](https://cortex-docs.paloaltonetworks.com/cortex-agentix/configure-cortex-agentix/automations/playbooks/playbook-development-checklist.md): Plan, build, customize, and test playbooks in Cortex AgentiX with this development checklist. - [Plan your playbook](https://cortex-docs.paloaltonetworks.com/cortex-agentix/configure-cortex-agentix/automations/playbooks/plan-your-playbook.md): Plan automated security workflows before building a playbook in Cortex AgentiX. - [Manage playbooks](https://cortex-docs.paloaltonetworks.com/cortex-agentix/configure-cortex-agentix/automations/playbooks/manage-playbooks.md): View, manage, and adopt organization and Marketplace playbooks in Cortex AgentiX. - [Build your playbook](https://cortex-docs.paloaltonetworks.com/cortex-agentix/configure-cortex-agentix/automations/playbooks/build-your-playbook.md): Build automated security response playbooks in Cortex AgentiX with tasks, logic, and integrations. - [Choose from existing playbooks or create your own](https://cortex-docs.paloaltonetworks.com/cortex-agentix/configure-cortex-agentix/automations/playbooks/build-your-playbook/choose-from-existing-playbooks-or-create-your-own.md): Choose an existing playbook or create a custom playbook in Cortex AgentiX. - [Configure playbook settings](https://cortex-docs.paloaltonetworks.com/cortex-agentix/configure-cortex-agentix/automations/playbooks/build-your-playbook/configure-playbook-settings.md): Configure playbook settings, inputs, and properties in Cortex AgentiX. - [Add objects from the Task Library](https://cortex-docs.paloaltonetworks.com/cortex-agentix/configure-cortex-agentix/automations/playbooks/build-your-playbook/add-objects-from-the-task-library.md): Add tasks and automation objects from the Task Library in Cortex AgentiX playbooks. - [Add commands and scripts](https://cortex-docs.paloaltonetworks.com/cortex-agentix/configure-cortex-agentix/automations/playbooks/build-your-playbook/add-objects-from-the-task-library/add-commands-and-scripts.md): Add commands and scripts to automate tasks in Cortex AgentiX playbooks. - [Add sub-playbooks](https://cortex-docs.paloaltonetworks.com/cortex-agentix/configure-cortex-agentix/automations/playbooks/build-your-playbook/add-objects-from-the-task-library/add-sub-playbooks.md): Add sub-playbooks to reuse automated workflows in Cortex AgentiX. - [Add AI Prompt tasks](https://cortex-docs.paloaltonetworks.com/cortex-agentix/configure-cortex-agentix/automations/playbooks/build-your-playbook/add-objects-from-the-task-library/add-ai-prompt-tasks.md): Add AI Prompt tasks to automate AI-assisted workflows in Cortex AgentiX playbooks. - [Add manual tasks and blank tasks](https://cortex-docs.paloaltonetworks.com/cortex-agentix/configure-cortex-agentix/automations/playbooks/build-your-playbook/add-objects-from-the-task-library/add-manual-tasks-and-blank-tasks.md): Add manual and blank tasks to guide playbook workflows in Cortex AgentiX. - [Create a standard task](https://cortex-docs.paloaltonetworks.com/cortex-agentix/configure-cortex-agentix/automations/playbooks/build-your-playbook/add-objects-from-the-task-library/add-manual-tasks-and-blank-tasks/create-a-standard-task.md): Create standard tasks to run automated actions in Cortex AgentiX playbooks. - [Create a conditional task](https://cortex-docs.paloaltonetworks.com/cortex-agentix/configure-cortex-agentix/automations/playbooks/build-your-playbook/add-objects-from-the-task-library/add-manual-tasks-and-blank-tasks/create-a-conditional-task.md): Create conditional tasks to control playbook logic in Cortex AgentiX. - [Create a communication task](https://cortex-docs.paloaltonetworks.com/cortex-agentix/configure-cortex-agentix/automations/playbooks/build-your-playbook/add-objects-from-the-task-library/add-manual-tasks-and-blank-tasks/create-a-communication-task.md): Create communication tasks in Cortex AgentiX playbooks to gather data and send surveys. - [Create a section header](https://cortex-docs.paloaltonetworks.com/cortex-agentix/configure-cortex-agentix/automations/playbooks/build-your-playbook/create-a-section-header.md): Create section headers to organize tasks and workflows in Cortex AgentiX playbooks. - [Configure script error handling in a playbook](https://cortex-docs.paloaltonetworks.com/cortex-agentix/configure-cortex-agentix/automations/playbooks/build-your-playbook/configure-script-error-handling-in-a-playbook.md): Configure script error handling to manage failures in Cortex AgentiX playbooks. - [Customize your playbook](https://cortex-docs.paloaltonetworks.com/cortex-agentix/configure-cortex-agentix/automations/playbooks/build-your-playbook/customize-your-playbook.md): Customize Cortex AgentiX playbooks with loops, filters, transformers, and context updates. - [Configure a sub-playbook loop](https://cortex-docs.paloaltonetworks.com/cortex-agentix/configure-cortex-agentix/automations/playbooks/build-your-playbook/customize-your-playbook/configure-a-sub-playbook-loop.md): Configure sub-playbook loops to repeat automated workflows in Cortex AgentiX. - [Filter and Transform data](https://cortex-docs.paloaltonetworks.com/cortex-agentix/configure-cortex-agentix/automations/playbooks/build-your-playbook/customize-your-playbook/filter-and-transform-data.md): Filter and transform data for playbook workflows in Cortex AgentiX. - [Create custom filter and transformers](https://cortex-docs.paloaltonetworks.com/cortex-agentix/configure-cortex-agentix/automations/playbooks/build-your-playbook/customize-your-playbook/create-custom-filter-and-transformers.md): Create custom filters and transformers for playbook data in Cortex AgentiX. - [Filter considerations, categories, and built-in filters](https://cortex-docs.paloaltonetworks.com/cortex-agentix/configure-cortex-agentix/automations/playbooks/build-your-playbook/customize-your-playbook/filter-considerations-categories-and-built-in-filters.md): Understand filter categories, considerations, and built-in filters in Cortex AgentiX. - [Transformer considerations, categories, and built-in transformers](https://cortex-docs.paloaltonetworks.com/cortex-agentix/configure-cortex-agentix/automations/playbooks/build-your-playbook/customize-your-playbook/transformer-considerations-categories-and-built-in-transformers.md): Understand transformer categories, considerations, and built-in transformers in Cortex AgentiX. - [Extend context](https://cortex-docs.paloaltonetworks.com/cortex-agentix/configure-cortex-agentix/automations/playbooks/build-your-playbook/customize-your-playbook/extend-context.md): Extend context data for automated playbook workflows in Cortex AgentiX. - [Extract Indicators](https://cortex-docs.paloaltonetworks.com/cortex-agentix/configure-cortex-agentix/automations/playbooks/build-your-playbook/customize-your-playbook/extract-indicators.md): Extract indicators from playbook data to enrich investigations in Cortex AgentiX. - [Update issue fields with playbook tasks](https://cortex-docs.paloaltonetworks.com/cortex-agentix/configure-cortex-agentix/automations/playbooks/build-your-playbook/customize-your-playbook/update-issue-fields-with-playbook-tasks.md): Update issue fields with automated playbook tasks in Cortex AgentiX. - [Test your playbook](https://cortex-docs.paloaltonetworks.com/cortex-agentix/configure-cortex-agentix/automations/playbooks/build-your-playbook/test-your-playbook.md): Test and debug Cortex AgentiX playbooks with breakpoints, skips, and overrides. - [Troubleshoot playbook performance](https://cortex-docs.paloaltonetworks.com/cortex-agentix/configure-cortex-agentix/automations/playbooks/build-your-playbook/test-your-playbook/troubleshoot-playbook-performance.md): Troubleshoot playbook performance and execution delays in Cortex AgentiX. - [Manage playbook content](https://cortex-docs.paloaltonetworks.com/cortex-agentix/configure-cortex-agentix/automations/playbooks/build-your-playbook/manage-playbook-content.md): Manage playbook content, versions, and dependencies in Cortex AgentiX. - [Accelerate playbook development using the Agentic Playbook Builder (preview)](https://cortex-docs.paloaltonetworks.com/cortex-agentix/configure-cortex-agentix/automations/playbooks/accelerate-playbook-development-using-the-agentic-playbook-builder-preview.md): Use the Agentic Playbook Builder (preview) in Cortex AgentiX to create, optimize, and troubleshoot playbooks using natural language and security best practices. - [Agentic Playbook Builder prompt examples](https://cortex-docs.paloaltonetworks.com/cortex-agentix/configure-cortex-agentix/automations/playbooks/accelerate-playbook-development-using-the-agentic-playbook-builder-preview/agentic-playbook-builder-prompt-examples.md): Use Agentic Playbook Builder prompt examples to generate Cortex AgentiX security response playbooks for triage, enrichment, and remediation. - [Best practices for playbooks](https://cortex-docs.paloaltonetworks.com/cortex-agentix/configure-cortex-agentix/automations/playbooks/best-practices-for-playbooks.md): Apply playbook design and maintenance best practices in Cortex AgentiX. - [AI Prompts](https://cortex-docs.paloaltonetworks.com/cortex-agentix/configure-cortex-agentix/automations/ai-prompts.md): Create, manage, and use AI prompts in Cortex AgentiX automation and playbooks. - [AI prompts role-based access control](https://cortex-docs.paloaltonetworks.com/cortex-agentix/configure-cortex-agentix/automations/ai-prompts/ai-prompts-role-based-access-control.md): Manage AI prompt permissions with role-based access control in Cortex AgentiX. - [Use existing prompts](https://cortex-docs.paloaltonetworks.com/cortex-agentix/configure-cortex-agentix/automations/ai-prompts/use-existing-prompts.md): Find, duplicate, and edit reusable AI prompts in Cortex AgentiX. - [Create a prompt](https://cortex-docs.paloaltonetworks.com/cortex-agentix/configure-cortex-agentix/automations/ai-prompts/create-a-prompt.md): Create and configure AI prompts for agents and playbooks in Cortex AgentiX. - [Write effective prompts](https://cortex-docs.paloaltonetworks.com/cortex-agentix/configure-cortex-agentix/automations/ai-prompts/write-effective-prompts.md): Write effective AI prompts for reliable automation results in Cortex AgentiX. - [Agentic Response (Preview)](https://cortex-docs.paloaltonetworks.com/cortex-agentix/configure-cortex-agentix/automations/agentic-response-preview.md): Use Agentic Response in Cortex AgentiX to trigger AI agents from automation rules. - [Create an automation rule](https://cortex-docs.paloaltonetworks.com/cortex-agentix/configure-cortex-agentix/automations/create-an-automation-rule.md): Create automation rules in Cortex AgentiX to trigger actions for matching issues. - [Scripts](https://cortex-docs.paloaltonetworks.com/cortex-agentix/configure-cortex-agentix/automations/scripts.md): Create, manage, and run automation scripts in Cortex AgentiX. - [Access to scripts](https://cortex-docs.paloaltonetworks.com/cortex-agentix/configure-cortex-agentix/automations/scripts/access-to-scripts.md): Manage access to automation scripts with object-level roles in Cortex AgentiX. - [Use existing scripts](https://cortex-docs.paloaltonetworks.com/cortex-agentix/configure-cortex-agentix/automations/scripts/use-exisiting-scripts.md): Find, review, and reuse automation scripts in Cortex AgentiX. - [Create a Script](https://cortex-docs.paloaltonetworks.com/cortex-agentix/configure-cortex-agentix/automations/scripts/create-a-script.md): Create automation scripts in Cortex AgentiX to run custom security workflows. - [Accelerate script development using the Automation Engineer agent](https://cortex-docs.paloaltonetworks.com/cortex-agentix/configure-cortex-agentix/automations/scripts/accelerate-script-development-using-the-automation-engineer-agent.md): Use the Automation Engineer agent to accelerate script development in Cortex AgentiX. - [Change the Docker image](https://cortex-docs.paloaltonetworks.com/cortex-agentix/configure-cortex-agentix/automations/scripts/change-the-docker-image.md): Select Docker images for automation scripts and integrations in Cortex AgentiX. - [Context data](https://cortex-docs.paloaltonetworks.com/cortex-agentix/configure-cortex-agentix/automations/context-data.md): Use context data in Cortex AgentiX to support investigation, remediation, and automation workflows. - [Issue context data](https://cortex-docs.paloaltonetworks.com/cortex-agentix/configure-cortex-agentix/automations/context-data/issue-context-data.md): View and manage issue context data in Cortex AgentiX. - [Case context data](https://cortex-docs.paloaltonetworks.com/cortex-agentix/configure-cortex-agentix/automations/context-data/case-context-data.md): View and manage case context data in Cortex AgentiX. - [Search context data](https://cortex-docs.paloaltonetworks.com/cortex-agentix/configure-cortex-agentix/automations/context-data/search-context-data.md): Search context data to investigate automation results in Cortex AgentiX. - [Add context data to an issue](https://cortex-docs.paloaltonetworks.com/cortex-agentix/configure-cortex-agentix/automations/context-data/add-context-data-to-an-issue.md): Add context data to issues for automation workflows in Cortex AgentiX. - [Add context data to a case](https://cortex-docs.paloaltonetworks.com/cortex-agentix/configure-cortex-agentix/automations/context-data/add-context-data-to-a-case.md): Add context data to cases for automation workflows in Cortex AgentiX. - [Delete context data from a case](https://cortex-docs.paloaltonetworks.com/cortex-agentix/configure-cortex-agentix/automations/context-data/delete-context-data-from-a-case.md): Delete case context data in Cortex AgentiX. - [Use context data in a playbook](https://cortex-docs.paloaltonetworks.com/cortex-agentix/configure-cortex-agentix/automations/context-data/use-context-data-in-a-playbook.md): Use context data to pass information between playbook tasks in Cortex AgentiX. - [Lists](https://cortex-docs.paloaltonetworks.com/cortex-agentix/configure-cortex-agentix/automations/lists.md): Create and manage lists in Cortex AgentiX for playbooks, scripts, and automation workflows. - [Create a list](https://cortex-docs.paloaltonetworks.com/cortex-agentix/configure-cortex-agentix/automations/lists/create-a-list.md): Create lists to store reusable automation data in Cortex AgentiX. - [List commands](https://cortex-docs.paloaltonetworks.com/cortex-agentix/configure-cortex-agentix/automations/lists/list-commands.md): Use list commands to manage automation data in Cortex AgentiX. - [Use cases: JSON lists](https://cortex-docs.paloaltonetworks.com/cortex-agentix/configure-cortex-agentix/automations/lists/use-cases-json-lists.md): Use JSON lists to store and process structured automation data in Cortex AgentiX. - [Extract data from a JSON object](https://cortex-docs.paloaltonetworks.com/cortex-agentix/configure-cortex-agentix/automations/lists/use-cases-json-lists/extract-data-from-a-json-object.md): Extract data from JSON objects stored in Cortex AgentiX lists. - [Extract a subset of the data](https://cortex-docs.paloaltonetworks.com/cortex-agentix/configure-cortex-agentix/automations/lists/use-cases-json-lists/extract-a-subset-of-the-data.md): Extract selected data from JSON lists in Cortex AgentiX. - [Filter extracted data](https://cortex-docs.paloaltonetworks.com/cortex-agentix/configure-cortex-agentix/automations/lists/use-cases-json-lists/filter-extracted-data.md): Filter extracted JSON list data in Cortex AgentiX. - [Transform a list into an array](https://cortex-docs.paloaltonetworks.com/cortex-agentix/configure-cortex-agentix/automations/lists/transform-a-list-into-an-array-1.md): Transform a Cortex AgentiX list into an array for automation workflows. - [Jobs](https://cortex-docs.paloaltonetworks.com/cortex-agentix/configure-cortex-agentix/automations/jobs.md): Create and manage scheduled and event-triggered automation jobs in Cortex AgentiX. - [Access to Jobs](https://cortex-docs.paloaltonetworks.com/cortex-agentix/configure-cortex-agentix/automations/jobs/access-to-jobs.md): Manage access to automation jobs with object-level roles in Cortex AgentiX. - [Manage jobs](https://cortex-docs.paloaltonetworks.com/cortex-agentix/configure-cortex-agentix/automations/jobs/manage-jobs.md): Create, manage, and schedule playbook jobs in Cortex AgentiX. - [Create a time-triggered job](https://cortex-docs.paloaltonetworks.com/cortex-agentix/configure-cortex-agentix/automations/jobs/create-a-time-triggered-job.md): Create time-triggered jobs to run playbooks on a schedule in Cortex AgentiX. - [Create a job triggered by a delta in a feed](https://cortex-docs.paloaltonetworks.com/cortex-agentix/configure-cortex-agentix/automations/jobs/create-a-job-triggered-by-a-delta-in-a-feed.md): Create jobs that trigger playbooks when feed data changes in Cortex AgentiX. - [Data management](https://cortex-docs.paloaltonetworks.com/cortex-agentix/configure-cortex-agentix/data-management.md): Manage datasets, data models, parsing rules, and data workflows in Cortex AgentiX. - [Dataset management](https://cortex-docs.paloaltonetworks.com/cortex-agentix/configure-cortex-agentix/data-management/dataset-management.md): Manage datasets, data storage, and retention settings in Cortex AgentiX. - [What are datasets?](https://cortex-docs.paloaltonetworks.com/cortex-agentix/configure-cortex-agentix/data-management/dataset-management/what-are-datasets.md): Learn how datasets store, organize, and retain security data in Cortex AgentiX. - [Lookup datasets](https://cortex-docs.paloaltonetworks.com/cortex-agentix/configure-cortex-agentix/data-management/dataset-management/lookup-datasets.md): Create and manage lookup datasets for reference data in Cortex AgentiX. - [Import a lookup dataset](https://cortex-docs.paloaltonetworks.com/cortex-agentix/configure-cortex-agentix/data-management/dataset-management/lookup-datasets/import-a-lookup-dataset.md): Import a lookup dataset to use reference data in Cortex AgentiX. - [Download JSON file of lookup dataset](https://cortex-docs.paloaltonetworks.com/cortex-agentix/configure-cortex-agentix/data-management/dataset-management/lookup-datasets/download-json-file-of-lookup-dataset.md): Download lookup dataset data as a JSON file in Cortex AgentiX. - [Set time to live for lookup datasets](https://cortex-docs.paloaltonetworks.com/cortex-agentix/configure-cortex-agentix/data-management/dataset-management/lookup-datasets/set-time-to-live-for-lookup-datasets.md): Set a time to live for lookup datasets in Cortex AgentiX. - [Monitor datasets and dataset views activity](https://cortex-docs.paloaltonetworks.com/cortex-agentix/configure-cortex-agentix/data-management/dataset-management/monitor-datasets-and-dataset-views-activity.md): Monitor dataset and dataset view activity in Cortex AgentiX. - [Manage compute units](https://cortex-docs.paloaltonetworks.com/cortex-agentix/configure-cortex-agentix/data-management/manage-compute-units.md): Manage and monitor compute unit usage in Cortex AgentiX. - [Manage Event Forwarding](https://cortex-docs.paloaltonetworks.com/cortex-agentix/configure-cortex-agentix/data-management/manage-event-forwarding.md): Forward ingested event data from Cortex AgentiX to external storage. - [Monitor dashboards and reports](https://cortex-docs.paloaltonetworks.com/cortex-agentix/detect-investigate-and-respond-to-threats/monitor-dashboards-and-reports.md): Monitor security dashboards and reports in Cortex AgentiX. - [Overview of dashboards and reports](https://cortex-docs.paloaltonetworks.com/cortex-agentix/detect-investigate-and-respond-to-threats/monitor-dashboards-and-reports/overview-of-dashboards-and-reports.md): Learn how dashboards, reports, and widgets visualize security data in Cortex AgentiX. - [Dashboard interface basics](https://cortex-docs.paloaltonetworks.com/cortex-agentix/detect-investigate-and-respond-to-threats/monitor-dashboards-and-reports/overview-of-dashboards-and-reports/dashboard-interface-basics.md): Learn the dashboard interface and navigation controls in Cortex AgentiX. - [Dashboard types](https://cortex-docs.paloaltonetworks.com/cortex-agentix/detect-investigate-and-respond-to-threats/monitor-dashboards-and-reports/overview-of-dashboards-and-reports/dashboard-types.md): Understand dashboard types and their uses in Cortex AgentiX. - [Report basics](https://cortex-docs.paloaltonetworks.com/cortex-agentix/detect-investigate-and-respond-to-threats/monitor-dashboards-and-reports/overview-of-dashboards-and-reports/report-basics.md): Learn how reports summarize and deliver security data in Cortex AgentiX. - [Widget Library](https://cortex-docs.paloaltonetworks.com/cortex-agentix/detect-investigate-and-respond-to-threats/monitor-dashboards-and-reports/overview-of-dashboards-and-reports/widget-library.md): Explore the Widget Library for dashboards and reports in Cortex AgentiX. - [Access and visibility for dashboards and reports](https://cortex-docs.paloaltonetworks.com/cortex-agentix/detect-investigate-and-respond-to-threats/monitor-dashboards-and-reports/access-and-visibility-for-dashboards-and-reports.md): Manage dashboard and report access, visibility, and sharing in Cortex AgentiX. - [Visibility settings](https://cortex-docs.paloaltonetworks.com/cortex-agentix/detect-investigate-and-respond-to-threats/monitor-dashboards-and-reports/access-and-visibility-for-dashboards-and-reports/visibility-settings.md): Configure visibility settings for dashboards and reports in Cortex AgentiX. - [Access to widgets](https://cortex-docs.paloaltonetworks.com/cortex-agentix/detect-investigate-and-respond-to-threats/monitor-dashboards-and-reports/access-and-visibility-for-dashboards-and-reports/access-to-widgets.md): Control user access to dashboard widgets in Cortex AgentiX. - [Sharing icons](https://cortex-docs.paloaltonetworks.com/cortex-agentix/detect-investigate-and-respond-to-threats/monitor-dashboards-and-reports/access-and-visibility-for-dashboards-and-reports/sharing-icons.md): Understand dashboard and report sharing icons in Cortex AgentiX. - [Access and sharing cheat sheet](https://cortex-docs.paloaltonetworks.com/cortex-agentix/detect-investigate-and-respond-to-threats/monitor-dashboards-and-reports/access-and-visibility-for-dashboards-and-reports/access-and-sharing-cheat-sheet.md): Use this cheat sheet to manage dashboard and report access in Cortex AgentiX. - [Manage dashboards and reports](https://cortex-docs.paloaltonetworks.com/cortex-agentix/detect-investigate-and-respond-to-threats/monitor-dashboards-and-reports/manage-dashboards-and-reports.md): Manage dashboards, reports, templates, ownership, and content in Cortex AgentiX. - [Dashboard Manager](https://cortex-docs.paloaltonetworks.com/cortex-agentix/detect-investigate-and-respond-to-threats/monitor-dashboards-and-reports/manage-dashboards-and-reports/dashboard-manager.md): Use Dashboard Manager to organize and manage dashboards in Cortex AgentiX. - [Reports](https://cortex-docs.paloaltonetworks.com/cortex-agentix/detect-investigate-and-respond-to-threats/monitor-dashboards-and-reports/manage-dashboards-and-reports/reports.md): Manage reports and report templates in Cortex AgentiX. - [Duplicate dashboards and reports](https://cortex-docs.paloaltonetworks.com/cortex-agentix/detect-investigate-and-respond-to-threats/monitor-dashboards-and-reports/manage-dashboards-and-reports/duplicate-dashboards-and-reports.md): Duplicate dashboards and reports to reuse security visualizations in Cortex AgentiX. - [Share custom dashboards and report templates](https://cortex-docs.paloaltonetworks.com/cortex-agentix/detect-investigate-and-respond-to-threats/monitor-dashboards-and-reports/manage-dashboards-and-reports/share-custom-dashboards-and-report-templates.md): Share custom dashboards and report templates in Cortex AgentiX. - [Change ownership to dashboards and report templates](https://cortex-docs.paloaltonetworks.com/cortex-agentix/detect-investigate-and-respond-to-threats/monitor-dashboards-and-reports/manage-dashboards-and-reports/change-ownership-to-dashboards-and-report-templates.md): Change dashboard and report template ownership in Cortex AgentiX. - [Import and export dashboards and report templates](https://cortex-docs.paloaltonetworks.com/cortex-agentix/detect-investigate-and-respond-to-threats/monitor-dashboards-and-reports/manage-dashboards-and-reports/import-and-export-dashboards-and-report-templates.md): Import and export dashboards and report templates in Cortex AgentiX. - [Configure the notification rule for a failed report](https://cortex-docs.paloaltonetworks.com/cortex-agentix/detect-investigate-and-respond-to-threats/monitor-dashboards-and-reports/manage-dashboards-and-reports/configure-the-notification-rule-for-a-failed-report.md): Configure notifications for failed reports in Cortex AgentiX. - [Deleted content](https://cortex-docs.paloaltonetworks.com/cortex-agentix/detect-investigate-and-respond-to-threats/monitor-dashboards-and-reports/manage-dashboards-and-reports/deleted-content.md): Restore or permanently remove deleted dashboard and report content in Cortex AgentiX. - [Create dashboards](https://cortex-docs.paloaltonetworks.com/cortex-agentix/detect-investigate-and-respond-to-threats/monitor-dashboards-and-reports/create-dashboards.md): Create dashboards to visualize security data in Cortex AgentiX. - [Create a dashboard](https://cortex-docs.paloaltonetworks.com/cortex-agentix/detect-investigate-and-respond-to-threats/monitor-dashboards-and-reports/create-dashboards/create-a-dashboard.md): Create a custom dashboard to monitor security data in Cortex AgentiX. - [Create reports](https://cortex-docs.paloaltonetworks.com/cortex-agentix/detect-investigate-and-respond-to-threats/monitor-dashboards-and-reports/create-reports.md): Create reports to share security insights in Cortex AgentiX. - [Create a report template from scratch](https://cortex-docs.paloaltonetworks.com/cortex-agentix/detect-investigate-and-respond-to-threats/monitor-dashboards-and-reports/create-reports/create-a-report-template-from-scratch.md): Create a custom report template from scratch in Cortex AgentiX. - [Advanced configuration](https://cortex-docs.paloaltonetworks.com/cortex-agentix/detect-investigate-and-respond-to-threats/monitor-dashboards-and-reports/advanced-configuration.md): Configure advanced dashboard and report features in Cortex AgentiX. - [Create custom widgets](https://cortex-docs.paloaltonetworks.com/cortex-agentix/detect-investigate-and-respond-to-threats/monitor-dashboards-and-reports/advanced-configuration/create-custom-widgets.md): Create custom widgets for dashboards and reports in Cortex AgentiX. - [Create widgets using AI](https://cortex-docs.paloaltonetworks.com/cortex-agentix/detect-investigate-and-respond-to-threats/monitor-dashboards-and-reports/advanced-configuration/create-custom-widgets/create-widgets-using-ai.md): Create dashboard widgets using AI in Cortex AgentiX. - [Create XQL widgets](https://cortex-docs.paloaltonetworks.com/cortex-agentix/detect-investigate-and-respond-to-threats/monitor-dashboards-and-reports/advanced-configuration/create-custom-widgets/create-xql-widgets.md): Create XQL widgets to visualize query data in Cortex AgentiX. - [Add parameters to a custom XQL widget](https://cortex-docs.paloaltonetworks.com/cortex-agentix/detect-investigate-and-respond-to-threats/monitor-dashboards-and-reports/advanced-configuration/create-custom-widgets/add-parameters-to-a-custom-xql-widget.md): Add parameters to custom XQL widgets in Cortex AgentiX. - [Create script-based widgets](https://cortex-docs.paloaltonetworks.com/cortex-agentix/detect-investigate-and-respond-to-threats/monitor-dashboards-and-reports/advanced-configuration/create-custom-widgets/create-script-based-widgets.md): Create script-based widgets for dashboards in Cortex AgentiX. - [Configure global filters](https://cortex-docs.paloaltonetworks.com/cortex-agentix/detect-investigate-and-respond-to-threats/monitor-dashboards-and-reports/advanced-configuration/configure-global-filters.md): Configure global filters for dashboards in Cortex AgentiX. - [Configure drilldowns](https://cortex-docs.paloaltonetworks.com/cortex-agentix/detect-investigate-and-respond-to-threats/monitor-dashboards-and-reports/advanced-configuration/configure-drilldowns.md): Configure dashboard drilldowns for deeper investigation in Cortex AgentiX. - [Dashboard reference](https://cortex-docs.paloaltonetworks.com/cortex-agentix/detect-investigate-and-respond-to-threats/monitor-dashboards-and-reports/dashboard-reference.md): Reference system dashboards and Command Center dashboards in Cortex AgentiX. - [Command Center reference](https://cortex-docs.paloaltonetworks.com/cortex-agentix/detect-investigate-and-respond-to-threats/monitor-dashboards-and-reports/dashboard-reference/command-center-reference.md): Reference Command Center dashboards for security operations in Cortex AgentiX. - [Cortex Agentic Assistant dashboard](https://cortex-docs.paloaltonetworks.com/cortex-agentix/detect-investigate-and-respond-to-threats/monitor-dashboards-and-reports/dashboard-reference/command-center-reference/cortex-agentic-assistant-dashboard.md): Monitor Agentic Assistant activity with its dashboard in Cortex AgentiX. - [Cortex Cloud Command Center](https://cortex-docs.paloaltonetworks.com/cortex-agentix/detect-investigate-and-respond-to-threats/monitor-dashboards-and-reports/dashboard-reference/command-center-reference/cortex-cloud-command-center.md): Use Cortex Cloud Command Center dashboards in Cortex AgentiX. - [System dashboards](https://cortex-docs.paloaltonetworks.com/cortex-agentix/detect-investigate-and-respond-to-threats/monitor-dashboards-and-reports/dashboard-reference/system-dashboards.md): Reference system dashboards available in Cortex AgentiX. - [Cortex Cloud Consumption](https://cortex-docs.paloaltonetworks.com/cortex-agentix/detect-investigate-and-respond-to-threats/monitor-dashboards-and-reports/dashboard-reference/system-dashboards/cortex-cloud-consumption.md): Monitor Cortex Cloud consumption with this system dashboard in Cortex AgentiX. - [Cloud Security Operations](https://cortex-docs.paloaltonetworks.com/cortex-agentix/detect-investigate-and-respond-to-threats/monitor-dashboards-and-reports/dashboard-reference/system-dashboards/cloud-security-operations.md): Monitor cloud security operations with this system dashboard in Cortex AgentiX. - [Investigation and Response](https://cortex-docs.paloaltonetworks.com/cortex-agentix/detect-investigate-and-respond-to-threats/investigation-and-response.md): Investigate cases and issues, run XQL queries, and respond to threats in Cortex AgentiX. - [Overview of cases](https://cortex-docs.paloaltonetworks.com/cortex-agentix/detect-investigate-and-respond-to-threats/investigation-and-response/overview-of-cases.md): Understand case investigation, triage, and response workflows in Cortex AgentiX. - [What are cases?](https://cortex-docs.paloaltonetworks.com/cortex-agentix/detect-investigate-and-respond-to-threats/investigation-and-response/overview-of-cases/what-are-cases.md): A case provides the full contextual story of a problem that impacts your organization's security, giving you an end-to-end view of the problem and streamlining your understanding of what needs to be s - [Resolving cases with AI](https://cortex-docs.paloaltonetworks.com/cortex-agentix/detect-investigate-and-respond-to-threats/investigation-and-response/overview-of-cases/resolving-cases-with-ai.md): Use AI to analyze, investigate, and resolve security cases in Cortex AgentiX. - [Case lifecycle](https://cortex-docs.paloaltonetworks.com/cortex-agentix/detect-investigate-and-respond-to-threats/investigation-and-response/overview-of-cases/case-lifecycle.md): Understand case lifecycle stages from creation through resolution in Cortex AgentiX. - [Case thresholds](https://cortex-docs.paloaltonetworks.com/cortex-agentix/detect-investigate-and-respond-to-threats/investigation-and-response/overview-of-cases/case-thresholds.md): Configure case grouping thresholds to keep investigations manageable in Cortex AgentiX. - [Case scope and impact](https://cortex-docs.paloaltonetworks.com/cortex-agentix/detect-investigate-and-respond-to-threats/investigation-and-response/overview-of-cases/case-scope-and-impact.md): Assess case scope, impact, severity, score, and domain in Cortex AgentiX. - [Case and issue domains](https://cortex-docs.paloaltonetworks.com/cortex-agentix/detect-investigate-and-respond-to-threats/investigation-and-response/overview-of-cases/case-and-issue-domains.md): Organize cases and issues with domains in Cortex AgentiX. - [Overview of case teams and roles](https://cortex-docs.paloaltonetworks.com/cortex-agentix/detect-investigate-and-respond-to-threats/investigation-and-response/overview-of-cases/overview-of-case-teams-and-roles.md): Understand case teams and roles for collaborative investigations in Cortex AgentiX. - [Case concepts](https://cortex-docs.paloaltonetworks.com/cortex-agentix/detect-investigate-and-respond-to-threats/investigation-and-response/case-concepts.md): Learn core case concepts for managing investigations in Cortex AgentiX. - [Issues](https://cortex-docs.paloaltonetworks.com/cortex-agentix/detect-investigate-and-respond-to-threats/investigation-and-response/case-concepts/issues.md): Understand how issues identify security risks within Cortex AgentiX cases. - [Case grouping](https://cortex-docs.paloaltonetworks.com/cortex-agentix/detect-investigate-and-respond-to-threats/investigation-and-response/case-concepts/case-grouping.md): Learn how Cortex AgentiX groups related issues into cases. - [Case scoring](https://cortex-docs.paloaltonetworks.com/cortex-agentix/detect-investigate-and-respond-to-threats/investigation-and-response/case-concepts/case-scoring.md): Understand case scoring methods for prioritizing investigations in Cortex AgentiX. - [Case starring](https://cortex-docs.paloaltonetworks.com/cortex-agentix/detect-investigate-and-respond-to-threats/investigation-and-response/case-concepts/case-starring.md): Star and filter important cases to prioritize work in Cortex AgentiX. - [SLAs and tracking](https://cortex-docs.paloaltonetworks.com/cortex-agentix/detect-investigate-and-respond-to-threats/investigation-and-response/case-concepts/slas-and-tracking.md): You can set up Service Level Agreements (SLAs) to track your cases against SLA targets. - [Analyze and resolve cases](https://cortex-docs.paloaltonetworks.com/cortex-agentix/detect-investigate-and-respond-to-threats/investigation-and-response/analyze-and-resolve-cases.md): Review, analyze, and resolve security cases in Cortex AgentiX. - [Review all cases](https://cortex-docs.paloaltonetworks.com/cortex-agentix/detect-investigate-and-respond-to-threats/investigation-and-response/analyze-and-resolve-cases/review-all-cases.md): Review and prioritize open security cases in Cortex AgentiX. - [Start case analysis](https://cortex-docs.paloaltonetworks.com/cortex-agentix/detect-investigate-and-respond-to-threats/investigation-and-response/analyze-and-resolve-cases/start-case-analysis.md): Start case analysis and resolution workflows in Cortex AgentiX. - [Agentic Assistant - Case Investigation agent](https://cortex-docs.paloaltonetworks.com/cortex-agentix/detect-investigate-and-respond-to-threats/investigation-and-response/analyze-and-resolve-cases/start-case-analysis/agentic-assistant-case-investigation-agent.md): Use the Case Investigation agent to analyze cases in Cortex AgentiX. - [Establish case context](https://cortex-docs.paloaltonetworks.com/cortex-agentix/detect-investigate-and-respond-to-threats/investigation-and-response/analyze-and-resolve-cases/establish-case-context.md): Establish investigation context for a security case in Cortex AgentiX. - [Analyze case details](https://cortex-docs.paloaltonetworks.com/cortex-agentix/detect-investigate-and-respond-to-threats/investigation-and-response/analyze-and-resolve-cases/analyze-case-details.md): You can analyze detailed information about the case in the Overview section of the Case card. - [Grouping graph](https://cortex-docs.paloaltonetworks.com/cortex-agentix/detect-investigate-and-respond-to-threats/investigation-and-response/analyze-and-resolve-cases/analyze-case-details/grouping-graph.md): Use the grouping graph to analyze related case activity in Cortex AgentiX. - [Evidence](https://cortex-docs.paloaltonetworks.com/cortex-agentix/detect-investigate-and-respond-to-threats/investigation-and-response/analyze-and-resolve-cases/analyze-case-details/evidence.md): Review case evidence to support investigations in Cortex AgentiX. - [Issue feed](https://cortex-docs.paloaltonetworks.com/cortex-agentix/detect-investigate-and-respond-to-threats/investigation-and-response/analyze-and-resolve-cases/analyze-case-details/issue-feed.md): Analyze the issue feed for case investigation context in Cortex AgentiX. - [Associated assets and artifacts](https://cortex-docs.paloaltonetworks.com/cortex-agentix/detect-investigate-and-respond-to-threats/investigation-and-response/analyze-and-resolve-cases/analyze-case-details/associated-assets-and-artifacts.md): Investigate assets and artifacts associated with a case in Cortex AgentiX. - [MITRE ATT\&CK tactics and techniques](https://cortex-docs.paloaltonetworks.com/cortex-agentix/detect-investigate-and-respond-to-threats/investigation-and-response/analyze-and-resolve-cases/analyze-case-details/mitre-att-and-ck-tactics-and-techniques.md): Review MITRE ATT\&CK tactics and techniques for cases in Cortex AgentiX. - [Case timeline](https://cortex-docs.paloaltonetworks.com/cortex-agentix/detect-investigate-and-respond-to-threats/investigation-and-response/analyze-and-resolve-cases/analyze-case-details/case-timeline.md): Use the case timeline to review investigation activity in Cortex AgentiX. - [Detailed view](https://cortex-docs.paloaltonetworks.com/cortex-agentix/detect-investigate-and-respond-to-threats/investigation-and-response/analyze-and-resolve-cases/analyze-case-details/detailed-view.md): Use the detailed view to investigate case information in Cortex AgentiX. - [Resolve the case](https://cortex-docs.paloaltonetworks.com/cortex-agentix/detect-investigate-and-respond-to-threats/investigation-and-response/analyze-and-resolve-cases/resolve-the-case.md): You can start remediating a case by reviewing the actions in the Resolution Center. - [Resolution Center](https://cortex-docs.paloaltonetworks.com/cortex-agentix/detect-investigate-and-respond-to-threats/investigation-and-response/analyze-and-resolve-cases/resolve-the-case/resolution-center.md): Use Resolution Center to plan and execute case remediation in Cortex AgentiX. - [Collaborative notes and comments](https://cortex-docs.paloaltonetworks.com/cortex-agentix/detect-investigate-and-respond-to-threats/investigation-and-response/analyze-and-resolve-cases/resolve-the-case/collaborative-notes-and-comments.md): Add collaborative notes and comments to cases in Cortex AgentiX. - [How to resolve a case](https://cortex-docs.paloaltonetworks.com/cortex-agentix/detect-investigate-and-respond-to-threats/investigation-and-response/analyze-and-resolve-cases/resolve-the-case/resolve-a-case.md): Resolve a security case using guided response actions in Cortex AgentiX. - [Resolution reasons for cases and issues](https://cortex-docs.paloaltonetworks.com/cortex-agentix/detect-investigate-and-respond-to-threats/investigation-and-response/analyze-and-resolve-cases/resolve-the-case/resolution-reasons-for-cases-and-issues.md): Configure resolution reasons for cases and issues in Cortex AgentiX. - [Additional case actions](https://cortex-docs.paloaltonetworks.com/cortex-agentix/detect-investigate-and-respond-to-threats/investigation-and-response/analyze-and-resolve-cases/additional-case-actions.md): Perform additional case management actions in Cortex AgentiX. - [Create a case](https://cortex-docs.paloaltonetworks.com/cortex-agentix/detect-investigate-and-respond-to-threats/investigation-and-response/analyze-and-resolve-cases/additional-case-actions/create-a-case.md): You can manually create a new case, assign it to a specific domain, and define custom fields for the case. - [Merge a case](https://cortex-docs.paloaltonetworks.com/cortex-agentix/detect-investigate-and-respond-to-threats/investigation-and-response/analyze-and-resolve-cases/additional-case-actions/merge-a-case.md): Merge related cases to streamline investigations in Cortex AgentiX. - [Assign a case team and restrict access](https://cortex-docs.paloaltonetworks.com/cortex-agentix/detect-investigate-and-respond-to-threats/investigation-and-response/analyze-and-resolve-cases/additional-case-actions/assign-a-case-team-and-restrict-access.md): Assign case teams and restrict case access in Cortex AgentiX. - [Playbook examples](https://cortex-docs.paloaltonetworks.com/cortex-agentix/detect-investigate-and-respond-to-threats/investigation-and-response/analyze-and-resolve-cases/additional-case-actions/assign-a-case-team-and-restrict-access/playbook-examples.md): Use playbook examples to manage case teams in Cortex AgentiX. - [Investigate issues](https://cortex-docs.paloaltonetworks.com/cortex-agentix/detect-investigate-and-respond-to-threats/investigation-and-response/investigate-issues.md): Cortex AgentiX generates issues to bring your attention to security risks in your framework. - [Overview of the Issues page](https://cortex-docs.paloaltonetworks.com/cortex-agentix/detect-investigate-and-respond-to-threats/investigation-and-response/investigate-issues/overview-of-the-issues-page.md): The Issues page consolidates all non-informational issues from your detection sources. - [Issue card](https://cortex-docs.paloaltonetworks.com/cortex-agentix/detect-investigate-and-respond-to-threats/investigation-and-response/investigate-issues/issue-card.md): On the Issue card, you can see details of the selected issue and take actions on an issue. - [Resolution actions](https://cortex-docs.paloaltonetworks.com/cortex-agentix/detect-investigate-and-respond-to-threats/investigation-and-response/investigate-issues/resolution-actions.md): See all recommended remediation actions for an issue on the Resolution tab. - [Link or unlink issues from a case](https://cortex-docs.paloaltonetworks.com/cortex-agentix/detect-investigate-and-respond-to-threats/investigation-and-response/investigate-issues/link-or-unlink-issues-from-a-case.md): Link or unlink issues from cases in Cortex AgentiX. - [Run an automation on an issue](https://cortex-docs.paloaltonetworks.com/cortex-agentix/detect-investigate-and-respond-to-threats/investigation-and-response/investigate-issues/run-an-automation-on-an-issue.md): Save time and expense by using playbooks and Quick Actions to automatically investigate and take remedial action on issues. - [Use the War Room in an investigation](https://cortex-docs.paloaltonetworks.com/cortex-agentix/detect-investigate-and-respond-to-threats/investigation-and-response/investigate-issues/use-the-war-room-in-an-investigation.md): Use the War Room for real-time investigation into a case, to filter war room entries, and to disable indicator notifications. - [Use the Work Plan in an investigation](https://cortex-docs.paloaltonetworks.com/cortex-agentix/detect-investigate-and-respond-to-threats/investigation-and-response/investigate-issues/use-the-work-plan-in-an-investigation.md): A Work Plan is a visual representation of the running playbook that is assigned to a case. Use it to monitor and manage a playbook workflow. - [Manage synced tickets in issues](https://cortex-docs.paloaltonetworks.com/cortex-agentix/detect-investigate-and-respond-to-threats/investigation-and-response/investigate-issues/manage-synced-tickets-in-issues.md): Manage synced external tickets for issues in Cortex AgentiX. - [Issue investigation actions](https://cortex-docs.paloaltonetworks.com/cortex-agentix/detect-investigate-and-respond-to-threats/investigation-and-response/investigate-issues/issue-investigation-actions.md): Perform issue investigation and management actions in Cortex AgentiX. - [Copy issues](https://cortex-docs.paloaltonetworks.com/cortex-agentix/detect-investigate-and-respond-to-threats/investigation-and-response/investigate-issues/issue-investigation-actions/copy-issues.md): Copy issues to support investigation workflows in Cortex AgentiX. - [Investigate contributing events](https://cortex-docs.paloaltonetworks.com/cortex-agentix/detect-investigate-and-respond-to-threats/investigation-and-response/investigate-issues/issue-investigation-actions/investigate-contributing-events.md): Investigate contributing events for an issue in Cortex AgentiX. - [Export issue details to a file](https://cortex-docs.paloaltonetworks.com/cortex-agentix/detect-investigate-and-respond-to-threats/investigation-and-response/investigate-issues/issue-investigation-actions/export-issue-details-to-a-file.md): Export issue details to a file from Cortex AgentiX. - [Exclude an issue](https://cortex-docs.paloaltonetworks.com/cortex-agentix/detect-investigate-and-respond-to-threats/investigation-and-response/investigate-issues/issue-investigation-actions/exclude-an-issue.md): Exclude an issue from investigation workflows in Cortex AgentiX. - [Query case and issue data](https://cortex-docs.paloaltonetworks.com/cortex-agentix/detect-investigate-and-respond-to-threats/investigation-and-response/investigate-issues/issue-investigation-actions/query-case-and-issue-data.md): Query case and issue data with XQL in Cortex AgentiX. - [Run indicator extraction in the CLI](https://cortex-docs.paloaltonetworks.com/cortex-agentix/detect-investigate-and-respond-to-threats/investigation-and-response/investigate-issues/issue-investigation-actions/run-indicator-extraction-in-the-cli.md): Run indicator extraction from the CLI in Cortex AgentiX. - [Update issue fields](https://cortex-docs.paloaltonetworks.com/cortex-agentix/detect-investigate-and-respond-to-threats/investigation-and-response/investigate-issues/issue-investigation-actions/update-issue-fields.md): Update issue fields during investigations in Cortex AgentiX. - [Close an issue](https://cortex-docs.paloaltonetworks.com/cortex-agentix/detect-investigate-and-respond-to-threats/investigation-and-response/investigate-issues/issue-investigation-actions/close-an-issue.md): Close resolved issues in Cortex AgentiX. - [Investigate artifacts and assets](https://cortex-docs.paloaltonetworks.com/cortex-agentix/detect-investigate-and-respond-to-threats/investigation-and-response/investigate-artifacts-and-assets.md): Investigate security artifacts and assets in Cortex AgentiX. - [Investigate an IP address](https://cortex-docs.paloaltonetworks.com/cortex-agentix/detect-investigate-and-respond-to-threats/investigation-and-response/investigate-artifacts-and-assets/investigate-an-ip-address.md): Investigate IP address activity, cases, and intelligence in Cortex AgentiX. - [Investigate a file and process hash](https://cortex-docs.paloaltonetworks.com/cortex-agentix/detect-investigate-and-respond-to-threats/investigation-and-response/investigate-artifacts-and-assets/investigate-a-file-and-process-hash.md): Investigate file and process hashes in Cortex AgentiX. - [Agentic Assistant chat](https://cortex-docs.paloaltonetworks.com/cortex-agentix/detect-investigate-and-respond-to-threats/agentic-assistant-chat.md): Use natural-language chat with the Cortex Agentic Assistant in Cortex AgentiX. - [Get started with Agentic Assistant chat](https://cortex-docs.paloaltonetworks.com/cortex-agentix/detect-investigate-and-respond-to-threats/agentic-assistant-chat/get-started-with-agentic-assistant-chat.md): Enable and access Agentic Assistant chat in Cortex AgentiX. - [Choose an Agentic Assistant agent](https://cortex-docs.paloaltonetworks.com/cortex-agentix/detect-investigate-and-respond-to-threats/agentic-assistant-chat/choose-an-agentic-assistant-agent.md): Choose a system or custom chat agent in Cortex AgentiX. - [Chat with an Agentic Assistant agent](https://cortex-docs.paloaltonetworks.com/cortex-agentix/detect-investigate-and-respond-to-threats/agentic-assistant-chat/chat-with-an-agentic-assistant-agent.md): Use effective prompts with Agentic Assistant chat in Cortex AgentiX. - [Chat with the Agentic Assistant from Slack](https://cortex-docs.paloaltonetworks.com/cortex-agentix/detect-investigate-and-respond-to-threats/agentic-assistant-chat/chat-with-the-agentic-assistant-from-slack.md): Chat with an Agentic Assistant agent from Slack in Cortex AgentiX. - [Streamline troubleshooting and support with the Help Center agent](https://cortex-docs.paloaltonetworks.com/cortex-agentix/detect-investigate-and-respond-to-threats/agentic-assistant-chat/streamline-troubleshooting-and-support-with-the-help-center-agent.md) - [Help Center agent actions](https://cortex-docs.paloaltonetworks.com/cortex-agentix/detect-investigate-and-respond-to-threats/agentic-assistant-chat/streamline-troubleshooting-and-support-with-the-help-center-agent/help-center-agent-actions.md) - [Create and run XQL queries with Agentic Assistant chat](https://cortex-docs.paloaltonetworks.com/cortex-agentix/detect-investigate-and-respond-to-threats/agentic-assistant-chat/create-and-run-xql-queries-with-agentic-assistant-chat.md): Interact with Cortex Agentic Assistant agents to build and run XQL queries in Cortex AgentiX. - [Use natural language to query and visualize your data](https://cortex-docs.paloaltonetworks.com/cortex-agentix/detect-investigate-and-respond-to-threats/agentic-assistant-chat/use-natural-language-to-query-and-visualize-your-data.md): Prompt Cortex Agentic Assistant agents to create graphs and charts from its findings in Cortex AgentiX. - [Manage chat history](https://cortex-docs.paloaltonetworks.com/cortex-agentix/detect-investigate-and-respond-to-threats/agentic-assistant-chat/manage-chat-history.md): Manage and navigate your past chats with the Cortex Agentic Assistant in Cortex AgentiX. - [Extended Threat Intelligence](https://cortex-docs.paloaltonetworks.com/cortex-agentix/detect-investigate-and-respond-to-threats/extended-threat-intelligence.md): Research threats, investigate indicators, and apply intelligence across Cortex AgentiX workflows. - [XTI Threat Intel Library](https://cortex-docs.paloaltonetworks.com/cortex-agentix/detect-investigate-and-respond-to-threats/extended-threat-intelligence/xti-threat-intel-library.md): Research threat actors, malware, vulnerabilities, and reports in Cortex AgentiX. - [XTI Indicators](https://cortex-docs.paloaltonetworks.com/cortex-agentix/detect-investigate-and-respond-to-threats/extended-threat-intelligence/xti-indicators.md): Investigate, manage, and enrich threat indicators in Cortex AgentiX. - [Threat intel context in cases and issues](https://cortex-docs.paloaltonetworks.com/cortex-agentix/detect-investigate-and-respond-to-threats/extended-threat-intelligence/threat-intel-context-in-cases-and-issues.md): Analyze indicator intelligence and Behavioral Threat Analysis (BTA) findings in Cortex AgentiX cases and issues. - [Threat intel investigation through XQL](https://cortex-docs.paloaltonetworks.com/cortex-agentix/detect-investigate-and-respond-to-threats/extended-threat-intelligence/threat-intel-investigation-through-xql.md): Query XTI indicators, threat objects, and their relationships using Cortex Query Language in Cortex AgentiX. - [Threat Intel Dashboard](https://cortex-docs.paloaltonetworks.com/cortex-agentix/detect-investigate-and-respond-to-threats/extended-threat-intelligence/threat-intel-dashboard.md): Visualize threat intelligence data to monitor distribution, ingestion health, and emerging trends in Cortex AgentiX. - [Using XTI with Threat Intel Agent](https://cortex-docs.paloaltonetworks.com/cortex-agentix/detect-investigate-and-respond-to-threats/extended-threat-intelligence/using-xti-with-threat-intel-agent.md): Use the Threat Intel Agent to list, enrich, and update XTI indicators in Cortex AgentiX. - [Using XTI in playbooks](https://cortex-docs.paloaltonetworks.com/cortex-agentix/detect-investigate-and-respond-to-threats/extended-threat-intelligence/using-xti-in-playbooks.md): Automate XTI indicator triage, enrichment, and response with supported playbook commands in Cortex AgentiX. - [Threat Intel Management](https://cortex-docs.paloaltonetworks.com/cortex-agentix/detect-investigate-and-respond-to-threats/threat-intel-management.md): Manage, configure, and investigate threat indicators in Cortex AgentiX. - [Get started with Threat Intel Management](https://cortex-docs.paloaltonetworks.com/cortex-agentix/detect-investigate-and-respond-to-threats/threat-intel-management/get-started-with-threat-intel-management.md): Get started with Threat Intel Management investigations in Cortex AgentiX. - [What is Threat Intel Management?](https://cortex-docs.paloaltonetworks.com/cortex-agentix/detect-investigate-and-respond-to-threats/threat-intel-management/get-started-with-threat-intel-management/what-is-threat-intel-management.md): Understand Threat Intel Management and its capabilities in Cortex AgentiX. - [Threat Intel Management use cases](https://cortex-docs.paloaltonetworks.com/cortex-agentix/detect-investigate-and-respond-to-threats/threat-intel-management/get-started-with-threat-intel-management/threat-intel-management-use-cases.md): Explore Threat Intel Management use cases in Cortex AgentiX. - [Roles and responsibilities in Threat Intel Management](https://cortex-docs.paloaltonetworks.com/cortex-agentix/detect-investigate-and-respond-to-threats/threat-intel-management/get-started-with-threat-intel-management/roles-and-responsibilities-in-threat-intel-management.md): Understand Threat Intel Management roles and responsibilities in Cortex AgentiX. - [Indicator concepts](https://cortex-docs.paloaltonetworks.com/cortex-agentix/detect-investigate-and-respond-to-threats/threat-intel-management/get-started-with-threat-intel-management/indicator-concepts.md): Understand indicator ingestion, enrichment, merging, and expiration in Cortex AgentiX. - [Indicator lifecycle](https://cortex-docs.paloaltonetworks.com/cortex-agentix/detect-investigate-and-respond-to-threats/threat-intel-management/get-started-with-threat-intel-management/indicator-lifecycle.md): Track indicators through their lifecycle in Cortex AgentiX. - [Indicator configuration](https://cortex-docs.paloaltonetworks.com/cortex-agentix/detect-investigate-and-respond-to-threats/threat-intel-management/indicator-configuration.md): Configure indicator types, fields, extraction, reputation, and exclusions in Cortex AgentiX. - [Customize indicator fields and types](https://cortex-docs.paloaltonetworks.com/cortex-agentix/detect-investigate-and-respond-to-threats/threat-intel-management/indicator-configuration/customize-indicator-fields-and-types.md): Customize indicator fields, types, extraction, and expiration in Cortex AgentiX. - [Create an indicator type](https://cortex-docs.paloaltonetworks.com/cortex-agentix/detect-investigate-and-respond-to-threats/threat-intel-management/indicator-configuration/customize-indicator-fields-and-types/create-an-indicator-type.md): Create custom indicator types and configure enrichment behavior in Cortex AgentiX. - [Indicator type profile](https://cortex-docs.paloaltonetworks.com/cortex-agentix/detect-investigate-and-respond-to-threats/threat-intel-management/indicator-configuration/customize-indicator-fields-and-types/create-an-indicator-type/indicator-type-profile.md): Configure indicator type profiles, scripts, commands, and expiration in Cortex AgentiX. - [File indicators](https://cortex-docs.paloaltonetworks.com/cortex-agentix/detect-investigate-and-respond-to-threats/threat-intel-management/indicator-configuration/customize-indicator-fields-and-types/create-an-indicator-type/file-indicators.md): Understand file indicator properties and hash handling in Cortex AgentiX. - [Formatting scripts](https://cortex-docs.paloaltonetworks.com/cortex-agentix/detect-investigate-and-respond-to-threats/threat-intel-management/indicator-configuration/customize-indicator-fields-and-types/create-an-indicator-type/formatting-scripts.md): Format and validate indicator values with scripts in Cortex AgentiX. - [Enhancement scripts](https://cortex-docs.paloaltonetworks.com/cortex-agentix/detect-investigate-and-respond-to-threats/threat-intel-management/indicator-configuration/customize-indicator-fields-and-types/create-an-indicator-type/enhancement-scripts.md): Use enhancement scripts to enrich indicators in Cortex AgentiX. - [Reputation scripts](https://cortex-docs.paloaltonetworks.com/cortex-agentix/detect-investigate-and-respond-to-threats/threat-intel-management/indicator-configuration/customize-indicator-fields-and-types/create-an-indicator-type/reputation-scripts.md): Use reputation scripts to calculate indicator verdicts in Cortex AgentiX. - [Reputation commands](https://cortex-docs.paloaltonetworks.com/cortex-agentix/detect-investigate-and-respond-to-threats/threat-intel-management/indicator-configuration/customize-indicator-fields-and-types/create-an-indicator-type/reputation-commands.md): Use reputation commands to retrieve indicator verdicts in Cortex AgentiX. - [Map custom indicator fields](https://cortex-docs.paloaltonetworks.com/cortex-agentix/detect-investigate-and-respond-to-threats/threat-intel-management/indicator-configuration/customize-indicator-fields-and-types/create-an-indicator-type/map-custom-indicator-fields.md): Map enrichment context to custom indicator fields in Cortex AgentiX. - [Create an indicator field](https://cortex-docs.paloaltonetworks.com/cortex-agentix/detect-investigate-and-respond-to-threats/threat-intel-management/indicator-configuration/customize-indicator-fields-and-types/create-an-indicator-field.md): Create custom indicator fields for indicator types in Cortex AgentiX. - [Indicator field structure](https://cortex-docs.paloaltonetworks.com/cortex-agentix/detect-investigate-and-respond-to-threats/threat-intel-management/indicator-configuration/customize-indicator-fields-and-types/create-an-indicator-field/indicator-field-structure.md): Reference indicator field structures and supported types in Cortex AgentiX. - [Indicator field trigger scripts](https://cortex-docs.paloaltonetworks.com/cortex-agentix/detect-investigate-and-respond-to-threats/threat-intel-management/indicator-configuration/customize-indicator-fields-and-types/create-an-indicator-field/indicator-field-trigger-scripts.md): Configure scripts that run when indicator fields change in Cortex AgentiX. - [Indicator classification and mapping](https://cortex-docs.paloaltonetworks.com/cortex-agentix/detect-investigate-and-respond-to-threats/threat-intel-management/indicator-configuration/indicator-classification-and-mapping.md): Understand indicator classification and mapping in Cortex AgentiX. - [Indicator extraction](https://cortex-docs.paloaltonetworks.com/cortex-agentix/detect-investigate-and-respond-to-threats/threat-intel-management/indicator-configuration/indicator-extraction.md): Extract and enrich indicators from issue fields in Cortex AgentiX. - [Set the indicator extraction mode for a playbook task](https://cortex-docs.paloaltonetworks.com/cortex-agentix/detect-investigate-and-respond-to-threats/threat-intel-management/indicator-configuration/indicator-extraction/set-the-indicator-extraction-mode-for-a-playbook-task.md): Set indicator extraction modes for playbook tasks in Cortex AgentiX. - [Disable indicator extraction for scripts or integrations](https://cortex-docs.paloaltonetworks.com/cortex-agentix/detect-investigate-and-respond-to-threats/threat-intel-management/indicator-configuration/indicator-extraction/disable-indicator-extraction-for-scripts-or-integrations.md): Disable automatic indicator extraction for scripts or integrations in Cortex AgentiX. - [Configure indicator expiration](https://cortex-docs.paloaltonetworks.com/cortex-agentix/detect-investigate-and-respond-to-threats/threat-intel-management/indicator-configuration/configure-indicator-expiration.md): Configure default indicator expiration settings in Cortex AgentiX. - [Configure Threat Intelligence feed integrations](https://cortex-docs.paloaltonetworks.com/cortex-agentix/detect-investigate-and-respond-to-threats/threat-intel-management/indicator-configuration/configure-threat-intelligence-feed-integrations.md): Configure threat intelligence feed integrations in Cortex AgentiX. - [Exclude indicators from enrichment](https://cortex-docs.paloaltonetworks.com/cortex-agentix/detect-investigate-and-respond-to-threats/threat-intel-management/indicator-configuration/exclude-indicators-from-enrichment.md): Exclude indicators from automated enrichment in Cortex AgentiX. - [Export indicators](https://cortex-docs.paloaltonetworks.com/cortex-agentix/detect-investigate-and-respond-to-threats/threat-intel-management/indicator-configuration/export-indicators.md): Export indicators and configure external dynamic lists in Cortex AgentiX. - [Manage external dynamic lists](https://cortex-docs.paloaltonetworks.com/cortex-agentix/detect-investigate-and-respond-to-threats/threat-intel-management/indicator-configuration/manage-external-dynamic-lists.md): Manage external dynamic lists in Cortex AgentiX. - [Indicator management](https://cortex-docs.paloaltonetworks.com/cortex-agentix/detect-investigate-and-respond-to-threats/threat-intel-management/indicator-management.md): Create, edit, search, export, and delete indicators in Cortex AgentiX. - [Indicator investigation](https://cortex-docs.paloaltonetworks.com/cortex-agentix/detect-investigate-and-respond-to-threats/threat-intel-management/indicator-investigation.md): Investigate indicators and manage their relationships in Cortex AgentiX. - [Indicator verdict](https://cortex-docs.paloaltonetworks.com/cortex-agentix/detect-investigate-and-respond-to-threats/threat-intel-management/indicator-investigation/indicator-verdict.md): Configure and review indicator verdicts in Cortex AgentiX. - [Extract and enrich an indicator](https://cortex-docs.paloaltonetworks.com/cortex-agentix/detect-investigate-and-respond-to-threats/threat-intel-management/indicator-investigation/extract-and-enrich-an-indicator.md): Extract and enrich indicators during investigations in Cortex AgentiX. - [Expire an indicator](https://cortex-docs.paloaltonetworks.com/cortex-agentix/detect-investigate-and-respond-to-threats/threat-intel-management/indicator-investigation/expire-an-indicator.md): Expire indicators through the CLI or UI in Cortex AgentiX. - [Manage indicator relationships](https://cortex-docs.paloaltonetworks.com/cortex-agentix/detect-investigate-and-respond-to-threats/threat-intel-management/indicator-investigation/manage-indicator-relationships.md): Create and manage indicator relationships in Cortex AgentiX. - [Delete and exclude indicators](https://cortex-docs.paloaltonetworks.com/cortex-agentix/detect-investigate-and-respond-to-threats/threat-intel-management/indicator-investigation/delete-and-exclude-indicators.md): Delete indicators and manage indicator exclusions in Cortex AgentiX. - [Cortex AgentiX XQL](https://cortex-docs.paloaltonetworks.com/cortex-agentix/reference-and-developer-docs/cortex-agentix-xql.md): Learn to query security data with XQL in Cortex AgentiX. - [Get started with XQL](https://cortex-docs.paloaltonetworks.com/cortex-agentix/reference-and-developer-docs/cortex-agentix-xql/get-started-with-xql.md): Get started with Cortex Query Language (XQL) in Cortex AgentiX. - [XQL language features](https://cortex-docs.paloaltonetworks.com/cortex-agentix/reference-and-developer-docs/cortex-agentix-xql/get-started-with-xql/xql-language-features.md): Explore Cortex Query Language features for security data in Cortex AgentiX. - [XQL Language Structure](https://cortex-docs.paloaltonetworks.com/cortex-agentix/reference-and-developer-docs/cortex-agentix-xql/get-started-with-xql/xql-language-structure.md): Understand Cortex Query Language query structure in Cortex AgentiX. - [Adding comments in queries](https://cortex-docs.paloaltonetworks.com/cortex-agentix/reference-and-developer-docs/cortex-agentix-xql/get-started-with-xql/xql-language-structure/adding-comments-in-queries.md): Add comments to XQL queries in Cortex AgentiX. - [Supported operators](https://cortex-docs.paloaltonetworks.com/cortex-agentix/reference-and-developer-docs/cortex-agentix-xql/get-started-with-xql/supported-operators.md): Use supported XQL comparison, Boolean, and set operators in Cortex AgentiX. - [Datasets and presets](https://cortex-docs.paloaltonetworks.com/cortex-agentix/reference-and-developer-docs/cortex-agentix-xql/get-started-with-xql/datasets-and-presets.md): Use XQL datasets and presets to query security data in Cortex AgentiX. - [About examples](https://cortex-docs.paloaltonetworks.com/cortex-agentix/reference-and-developer-docs/cortex-agentix-xql/get-started-with-xql/about-examples.md): Explore XQL query examples for Cortex AgentiX. - [JSON functions](https://cortex-docs.paloaltonetworks.com/cortex-agentix/reference-and-developer-docs/cortex-agentix-xql/get-started-with-xql/json-functions.md): Use JSON functions in XQL queries in Cortex AgentiX. - [How to filter for empty values in the results table](https://cortex-docs.paloaltonetworks.com/cortex-agentix/reference-and-developer-docs/cortex-agentix-xql/get-started-with-xql/how-to-filter-for-empty-values-in-the-results-table.md): Filter empty values in XQL query results in Cortex AgentiX. - [Understanding string manipulation in XQL](https://cortex-docs.paloaltonetworks.com/cortex-agentix/reference-and-developer-docs/cortex-agentix-xql/get-started-with-xql/understanding-string-manipulation-in-xql.md): Use string manipulation in XQL queries in Cortex AgentiX. - [Build XQL queries](https://cortex-docs.paloaltonetworks.com/cortex-agentix/reference-and-developer-docs/cortex-agentix-xql/build-xql-queries.md): Build and run XQL queries with Query Builder in Cortex AgentiX. - [About the Query Builder](https://cortex-docs.paloaltonetworks.com/cortex-agentix/reference-and-developer-docs/cortex-agentix-xql/build-xql-queries/about-the-query-builder.md): Use Query Builder for XQL threat detection and analysis in Cortex AgentiX. - [How to build XQL queries](https://cortex-docs.paloaltonetworks.com/cortex-agentix/reference-and-developer-docs/cortex-agentix-xql/build-xql-queries/how-to-build-xql-queries.md): Build XQL queries with Query Builder in Cortex AgentiX. - [Get started with XQL queries](https://cortex-docs.paloaltonetworks.com/cortex-agentix/reference-and-developer-docs/cortex-agentix-xql/build-xql-queries/how-to-build-xql-queries/get-started-with-xql-queries.md): Get started with XQL queries in Cortex AgentiX. - [Useful XQL user interface features](https://cortex-docs.paloaltonetworks.com/cortex-agentix/reference-and-developer-docs/cortex-agentix-xql/build-xql-queries/how-to-build-xql-queries/useful-xql-user-interface-features.md): Use XQL query interface features in Cortex AgentiX. - [XQL Query best practices](https://cortex-docs.paloaltonetworks.com/cortex-agentix/reference-and-developer-docs/cortex-agentix-xql/build-xql-queries/how-to-build-xql-queries/xql-query-best-practices.md): Apply XQL query best practices in Cortex AgentiX. - [Expected results when querying fields](https://cortex-docs.paloaltonetworks.com/cortex-agentix/reference-and-developer-docs/cortex-agentix-xql/build-xql-queries/how-to-build-xql-queries/expected-results-when-querying-fields.md): Understand expected field query results in Cortex AgentiX. - [Create XQL query](https://cortex-docs.paloaltonetworks.com/cortex-agentix/reference-and-developer-docs/cortex-agentix-xql/build-xql-queries/how-to-build-xql-queries/create-xql-query.md): Create XQL queries in Cortex AgentiX. - [Review XQL query results](https://cortex-docs.paloaltonetworks.com/cortex-agentix/reference-and-developer-docs/cortex-agentix-xql/build-xql-queries/how-to-build-xql-queries/review-xql-query-results.md): Review XQL query results in Cortex AgentiX. - [Translate to XQL](https://cortex-docs.paloaltonetworks.com/cortex-agentix/reference-and-developer-docs/cortex-agentix-xql/build-xql-queries/how-to-build-xql-queries/translate-to-xql.md): Translate natural-language requests into XQL in Cortex AgentiX. - [Graph query results](https://cortex-docs.paloaltonetworks.com/cortex-agentix/reference-and-developer-docs/cortex-agentix-xql/build-xql-queries/how-to-build-xql-queries/graph-query-results.md): Graph XQL query results in Cortex AgentiX. - [Query Builder templates](https://cortex-docs.paloaltonetworks.com/cortex-agentix/reference-and-developer-docs/cortex-agentix-xql/build-xql-queries/query-builder-templates.md): Use Query Builder templates to query security data in Cortex AgentiX. - [Get started with Query Builder templates](https://cortex-docs.paloaltonetworks.com/cortex-agentix/reference-and-developer-docs/cortex-agentix-xql/build-xql-queries/query-builder-templates/get-started-with-query-builder-templates.md): Get started with Query Builder templates in Cortex AgentiX. - [Considerations for using Query Builder templates](https://cortex-docs.paloaltonetworks.com/cortex-agentix/reference-and-developer-docs/cortex-agentix-xql/build-xql-queries/query-builder-templates/considerations-for-using-query-builder-templates.md): Review Query Builder template considerations in Cortex AgentiX. - [Create a query from a template](https://cortex-docs.paloaltonetworks.com/cortex-agentix/reference-and-developer-docs/cortex-agentix-xql/build-xql-queries/query-builder-templates/create-a-query-from-a-template.md): Create queries from Query Builder templates in Cortex AgentiX. - [Run a free text query](https://cortex-docs.paloaltonetworks.com/cortex-agentix/reference-and-developer-docs/cortex-agentix-xql/build-xql-queries/query-builder-templates/run-a-free-text-query.md): Run free-text queries with Query Builder in Cortex AgentiX. - [Query Builder template examples](https://cortex-docs.paloaltonetworks.com/cortex-agentix/reference-and-developer-docs/cortex-agentix-xql/build-xql-queries/query-builder-templates/query-builder-template-examples.md): Explore Query Builder template examples in Cortex AgentiX. - [Overview of the Query Center](https://cortex-docs.paloaltonetworks.com/cortex-agentix/reference-and-developer-docs/cortex-agentix-xql/build-xql-queries/overview-of-the-query-center.md): Monitor in-progress and completed XQL queries in Query Center in Cortex AgentiX. - [Edit and run queries in Query Center](https://cortex-docs.paloaltonetworks.com/cortex-agentix/reference-and-developer-docs/cortex-agentix-xql/build-xql-queries/overview-of-the-query-center/edit-and-run-queries-in-query-center.md): Edit and run XQL queries in Query Center in Cortex AgentiX. - [Query Center reference information](https://cortex-docs.paloaltonetworks.com/cortex-agentix/reference-and-developer-docs/cortex-agentix-xql/build-xql-queries/overview-of-the-query-center/edit-and-run-queries-in-query-center/query-center-reference-information.md): Reference Query Center features and XQL query controls in Cortex AgentiX. - [Manage scheduled queries](https://cortex-docs.paloaltonetworks.com/cortex-agentix/reference-and-developer-docs/cortex-agentix-xql/build-xql-queries/manage-scheduled-queries.md): Manage scheduled and recurring XQL queries in Cortex AgentiX. - [Scheduled Queries reference information](https://cortex-docs.paloaltonetworks.com/cortex-agentix/reference-and-developer-docs/cortex-agentix-xql/build-xql-queries/manage-scheduled-queries/scheduled-queries-reference-information.md): Reference scheduled XQL query settings in Cortex AgentiX. - [Manage your personal query library](https://cortex-docs.paloaltonetworks.com/cortex-agentix/reference-and-developer-docs/cortex-agentix-xql/build-xql-queries/manage-your-personal-query-library.md): Save and manage personal XQL queries in Cortex AgentiX Query Library. - [XQL macros](https://cortex-docs.paloaltonetworks.com/cortex-agentix/reference-and-developer-docs/cortex-agentix-xql/build-xql-queries/xql-macros.md): Use XQL macros to reuse query logic in Cortex AgentiX. - [Manage your macros](https://cortex-docs.paloaltonetworks.com/cortex-agentix/reference-and-developer-docs/cortex-agentix-xql/build-xql-queries/manage-your-macros.md): Create and manage XQL macros in Cortex AgentiX. - [Legacy Query Builder](https://cortex-docs.paloaltonetworks.com/cortex-agentix/reference-and-developer-docs/cortex-agentix-xql/build-xql-queries/legacy-query-builder.md): Use the Legacy Query Builder for entity queries in Cortex AgentiX. - [Create authentication query](https://cortex-docs.paloaltonetworks.com/cortex-agentix/reference-and-developer-docs/cortex-agentix-xql/build-xql-queries/legacy-query-builder/create-authentication-query.md): Create authentication queries with Legacy Query Builder in Cortex AgentiX. - [Create event log query](https://cortex-docs.paloaltonetworks.com/cortex-agentix/reference-and-developer-docs/cortex-agentix-xql/build-xql-queries/legacy-query-builder/create-event-log-query.md): Create event log queries with Legacy Query Builder in Cortex AgentiX. - [Create file query](https://cortex-docs.paloaltonetworks.com/cortex-agentix/reference-and-developer-docs/cortex-agentix-xql/build-xql-queries/legacy-query-builder/create-file-query.md): Create file queries with Legacy Query Builder in Cortex AgentiX. - [Create image load query](https://cortex-docs.paloaltonetworks.com/cortex-agentix/reference-and-developer-docs/cortex-agentix-xql/build-xql-queries/legacy-query-builder/create-image-load-query.md): Create image load queries with Legacy Query Builder in Cortex AgentiX. - [Create network connections query](https://cortex-docs.paloaltonetworks.com/cortex-agentix/reference-and-developer-docs/cortex-agentix-xql/build-xql-queries/legacy-query-builder/create-network-connections-query.md): Create network connection queries with Legacy Query Builder in Cortex AgentiX. - [Create network query](https://cortex-docs.paloaltonetworks.com/cortex-agentix/reference-and-developer-docs/cortex-agentix-xql/build-xql-queries/legacy-query-builder/create-network-query.md): Create network queries with Legacy Query Builder in Cortex AgentiX. - [Create process query](https://cortex-docs.paloaltonetworks.com/cortex-agentix/reference-and-developer-docs/cortex-agentix-xql/build-xql-queries/legacy-query-builder/create-process-query.md): Create process queries with Legacy Query Builder in Cortex AgentiX. - [Create registry query](https://cortex-docs.paloaltonetworks.com/cortex-agentix/reference-and-developer-docs/cortex-agentix-xql/build-xql-queries/legacy-query-builder/create-registry-query.md): Create registry queries with Legacy Query Builder in Cortex AgentiX. - [Query across all entities](https://cortex-docs.paloaltonetworks.com/cortex-agentix/reference-and-developer-docs/cortex-agentix-xql/build-xql-queries/legacy-query-builder/query-across-all-entities.md): Query across all entities with Legacy Query Builder in Cortex AgentiX. - [Cortex XQL syntax, parameters, and examples](https://cortex-docs.paloaltonetworks.com/cortex-agentix/reference-and-developer-docs/cortex-agentix-xql/cortex-xql-syntax-parameters-and-examples.md): Reference XQL syntax, parameters, and query examples in Cortex AgentiX. - [Troubleshoot](https://cortex-docs.paloaltonetworks.com/cortex-agentix/reference-and-developer-docs/troubleshoot.md): Learn how to troubleshoot Cortex AgentiX, such as sending audit notifications to a Syslog Server. - [About health issues](https://cortex-docs.paloaltonetworks.com/cortex-agentix/reference-and-developer-docs/troubleshoot/about-health-issues.md): Monitor Cortex AgentiX health issues for data ingestion, collection, correlation, and event forwarding. - [Monitor data ingestion health](https://cortex-docs.paloaltonetworks.com/cortex-agentix/reference-and-developer-docs/troubleshoot/about-health-issues/monitor-data-ingestion-health.md): Monitor data ingestion health and identify issues in Cortex AgentiX. - [Monitor correlation rules](https://cortex-docs.paloaltonetworks.com/cortex-agentix/reference-and-developer-docs/troubleshoot/about-health-issues/monitor-correlation-rules.md): Monitor correlation rule execution and health in Cortex AgentiX. - [Investigate and resolve health issues](https://cortex-docs.paloaltonetworks.com/cortex-agentix/reference-and-developer-docs/troubleshoot/about-health-issues/investigate-and-resolve-health-issues.md): Investigate and resolve health issues in Cortex AgentiX. - [In-product support ticket creation](https://cortex-docs.paloaltonetworks.com/cortex-agentix/reference-and-developer-docs/troubleshoot/in-product-support-case-creation.md): Open a support ticket directly in Cortex AgentiX and record your console to capture your issues and have the ticket handled efficiently. - [Reference](https://cortex-docs.paloaltonetworks.com/cortex-agentix/reference-and-developer-docs/reference.md): Access Cortex AgentiX API documentation, reference resources, and fair usage policy information. - [Cortex AgentiX API](https://cortex-docs.paloaltonetworks.com/cortex-agentix/reference-and-developer-docs/reference/cortex-agentix-api.md): Generate API keys and make API calls in Cortex AgentiX. - [Fair Usage policy for Cortex AgentiX](https://cortex-docs.paloaltonetworks.com/cortex-agentix/reference-and-developer-docs/reference/fair-usage-policy-for-cortex-agentix.md): Understand the fair usage policy for Cortex AgentiX services and capabilities. ## Cortex XDR Agent Documentation - [Cortex XDR Agent Documentation](https://cortex-docs.paloaltonetworks.com/cortex-xdr-agent/cortex-xdr-agent-documentation.md): Start here to choose the right Cortex XDR Agent version. * [Introduction](https://cortex-docs.paloaltonetworks.com/cortex-xdr-agent/9.3/introduction.md): Learn about the Cortex XDR Agent installation procedures. * [Cortex XDR agent for Windows](https://cortex-docs.paloaltonetworks.com/cortex-xdr-agent/9.3/cortex-xdr-agent-for-windows.md): To install, use, upgrade, and uninstall the Cortex XDR agent on Windows endpoints, see the references in this topic. * [Cortex XDR agent for Windows requirements](https://cortex-docs.paloaltonetworks.com/cortex-xdr-agent/9.3/cortex-xdr-agent-for-windows/cortex-xdr-agent-for-windows-requirements.md): Windows endpoints must meet the following requirements to install the Cortex XDR agent. * [Install the Cortex XDR agent for Windows](https://cortex-docs.paloaltonetworks.com/cortex-xdr-agent/9.3/cortex-xdr-agent-for-windows/install-the-cortex-xdr-agent-for-windows.md): Learn about the Cortex XDR agent installation options and use the provided workflows to install the Cortex XDR agent on Windows endpoints. * [Install the Cortex XDR Agent with Installer and Content Update Package](https://cortex-docs.paloaltonetworks.com/cortex-xdr-agent/9.3/cortex-xdr-agent-for-windows/install-the-cortex-xdr-agent-with-installer-and-content-update-package.md): Deploy the Cortex XDR agent on Windows endpoints using the latest content and installer package. * [Cortex XDR agent for virtual environments and desktops](https://cortex-docs.paloaltonetworks.com/cortex-xdr-agent/9.3/cortex-xdr-agent-for-windows/cortex-xdr-agent-for-virtual-environments-and-desktops.md): Learn about the Cortex XDR agent virtual installation options and use the provided workflows to install the Cortex XDR agent on virtual Windows endpoints. * [Use Cortex XDR Agent for Windows](https://cortex-docs.paloaltonetworks.com/cortex-xdr-agent/9.3/cortex-xdr-agent-for-windows/use-cortex-xdr-agent-for-windows.md): Learn how to effectively use the Cortex XDR agent for Windows by the different options described in this topic. * [Upgrade the Cortex XDR Agent](https://cortex-docs.paloaltonetworks.com/cortex-xdr-agent/9.3/cortex-xdr-agent-for-windows/upgrade-the-cortex-xdr-agent.md): How to upgrade the Cortex XDR agent on Windows endpoints. * [Uninstall the Cortex XDR agent for Windows](https://cortex-docs.paloaltonetworks.com/cortex-xdr-agent/9.3/cortex-xdr-agent-for-windows/uninstall-the-cortex-xdr-agent-for-windows.md) * [Troubleshooting resources for Windows](https://cortex-docs.paloaltonetworks.com/cortex-xdr-agent/9.3/cortex-xdr-agent-for-windows/troubleshooting-resources-for-windows.md): Refer to the following troubleshooting resources for the Cortex XDR agent for Windows. * [Cytool for Windows](https://cortex-docs.paloaltonetworks.com/cortex-xdr-agent/9.3/cortex-xdr-agent-for-windows/troubleshooting-resources-for-windows/cytool-for-windows.md): To manage Traps functions from the command line on Windows endpoints, use Cytool. * [Cortex XDR Agents Deployed in Advertise Mode](https://cortex-docs.paloaltonetworks.com/cortex-xdr-agent/9.3/cortex-xdr-agent-for-windows/troubleshooting-resources-for-windows/cortex-xdr-agents-deployed-in-advertise-mode.md): Depending on your Cortex XDR agent release, you can install or upgrade the agent in Advertise mode. * [Cortex XDR Agent for MacOS](https://cortex-docs.paloaltonetworks.com/cortex-xdr-agent/9.3/cortex-xdr-agent-for-macos.md): To install, use, and uninstall the Cortex XDR agent on MacOS endpoints, see the references in this topic. * [Cortex XDR Agent for Mac Requirements](https://cortex-docs.paloaltonetworks.com/cortex-xdr-agent/9.3/cortex-xdr-agent-for-macos/cortex-xdr-agent-for-mac-requirements.md): Mac (macOS) endpoints must meet the following requirements to install the Cortex XDR agent. * [Install the Cortex XDR Agent for Mac](https://cortex-docs.paloaltonetworks.com/cortex-xdr-agent/9.3/cortex-xdr-agent-for-macos/install-the-cortex-xdr-agent-for-mac.md): Learn about the Cortex XDR agent installation options and use the provided workflows to install the Cortex XDR agent on macOS endpoints. * [Install with a unified configuration profile for MDMs](https://cortex-docs.paloaltonetworks.com/cortex-xdr-agent/9.3/cortex-xdr-agent-for-macos/install-the-cortex-xdr-agent-for-mac/install-with-a-unified-configuration-profile-for-mdms.md): Use the Palo Alto Networks unified configuration profile for MDMs to seamlessly install the Cortex XDR agent on macOS endpoints. * [macOS 15 Sequoia system extensions configuration file](https://cortex-docs.paloaltonetworks.com/cortex-xdr-agent/9.3/cortex-xdr-agent-for-macos/install-the-cortex-xdr-agent-for-mac/macos-15-sequoia-system-extensions-configuration-file.md) * [MacOS Bluetooth MDM profile](https://cortex-docs.paloaltonetworks.com/cortex-xdr-agent/9.3/cortex-xdr-agent-for-macos/install-the-cortex-xdr-agent-for-mac/macos-bluetooth-mdm-profile.md) * [Install the Cortex XDR Agent Using JAMF](https://cortex-docs.paloaltonetworks.com/cortex-xdr-agent/9.3/cortex-xdr-agent-for-macos/install-the-cortex-xdr-agent-for-mac/install-the-cortex-xdr-agent-using-jamf.md): Step-by-step instructions to configure a JAMF installation profile for the Cortex XDR agent on macOS endpoints. * [Install the Cortex XDR Agent Manually](https://cortex-docs.paloaltonetworks.com/cortex-xdr-agent/9.3/cortex-xdr-agent-for-macos/install-the-cortex-xdr-agent-for-mac/install-the-cortex-xdr-agent-manually.md): Learn how to install the Cortex XDR agent manually on macOS endpoints. * [Configure Cortex XDR Agent for Mac](https://cortex-docs.paloaltonetworks.com/cortex-xdr-agent/9.3/cortex-xdr-agent-for-macos/configure-cortex-xdr-agent-for-mac.md): Run the wizard to guide you through the settings to enable the agent to run on the macOS endpoint. * [Use the Cortex XDR Agent for Mac](https://cortex-docs.paloaltonetworks.com/cortex-xdr-agent/9.3/cortex-xdr-agent-for-macos/use-the-cortex-xdr-agent-for-mac.md): Learn how to effectively use the Cortex XDR agent for Mac by the different options described in this topic. * [Uninstall the Cortex XDR Agent for Mac](https://cortex-docs.paloaltonetworks.com/cortex-xdr-agent/9.3/cortex-xdr-agent-for-macos/uninstall-the-cortex-xdr-agent-for-mac.md): Learn how to uninstall the Cortex XDR agent from a Mac endpoint. * [Manage the Agent Deployment Notifications for Mac](https://cortex-docs.paloaltonetworks.com/cortex-xdr-agent/9.3/cortex-xdr-agent-for-macos/manage-the-agent-deployment-notifications-for-mac.md): An overview of user notifications for the Cortex XDR agent during installation, upgrade, and removal on a Mac. * [Troubleshooting Resources for Mac](https://cortex-docs.paloaltonetworks.com/cortex-xdr-agent/9.3/cortex-xdr-agent-for-macos/troubleshooting-resources-for-mac.md): Refer to the following troubleshooting resources for the Cortex XDR agent for Mac. * [Cytool for Mac](https://cortex-docs.paloaltonetworks.com/cortex-xdr-agent/9.3/cortex-xdr-agent-for-macos/troubleshooting-resources-for-mac/cytool-for-mac.md): In addition to being available for Windows and Linux endpoints, Cytool is also available for Mac endpoints. * [Cortex XDR Agent for Linux](https://cortex-docs.paloaltonetworks.com/cortex-xdr-agent/9.3/cortex-xdr-agent-for-linux.md): To install, use, and uninstall the Cortex XDR agent on Linux endpoints, see the references in this topic. * [Cortex XDR supported Kernel Module versions by distribution](https://cortex-docs.paloaltonetworks.com/cortex-xdr-agent/9.3/cortex-xdr-agent-for-linux/cortex-xdr-supported-kernel-module-versions-by-distribution.md): To enable full endpoint protection features on Linux endpoints, you must use a supported Linux Kernel version. * [Cortex XDR Agent for Linux Requirements](https://cortex-docs.paloaltonetworks.com/cortex-xdr-agent/9.3/cortex-xdr-agent-for-linux/cortex-xdr-agent-for-linux-requirements.md): Linux endpoints must meet the following requirements to install the Cortex XDR agent * [Install the Cortex XDR agent for Linux](https://cortex-docs.paloaltonetworks.com/cortex-xdr-agent/9.3/cortex-xdr-agent-for-linux/install-the-cortex-xdr-agent-for-linux.md): Learn how to install the Cortex XDR agent on a Linux endpoint. * [Install the Cortex XDR Agent for Kubernetes Hosts](https://cortex-docs.paloaltonetworks.com/cortex-xdr-agent/9.3/cortex-xdr-agent-for-linux/install-the-cortex-xdr-agent-for-kubernetes-hosts.md): How to install the Cortex XDR agent on a Kubernetes host. * [Use the Cortex XDR agent for Linux](https://cortex-docs.paloaltonetworks.com/cortex-xdr-agent/9.3/cortex-xdr-agent-for-linux/use-the-cortex-xdr-agent-for-linux.md): Learn how to effectively use the Cortex XDR agent for Linux by the different options described in this topic. * [Uninstall the Cortex XDR Agent for Linux](https://cortex-docs.paloaltonetworks.com/cortex-xdr-agent/9.3/cortex-xdr-agent-for-linux/uninstall-the-cortex-xdr-agent-for-linux.md): Learn how to uninstall the Cortex XDR agent from a Linux endpoint. * [Troubleshooting Resources for Linux](https://cortex-docs.paloaltonetworks.com/cortex-xdr-agent/9.3/cortex-xdr-agent-for-linux/troubleshooting-resources-for-linux.md): Refer to the following troubleshooting resources for the Cortex XDR agent for Linux. * [Cytool for Linux](https://cortex-docs.paloaltonetworks.com/cortex-xdr-agent/9.3/cortex-xdr-agent-for-linux/troubleshooting-resources-for-linux/cytool-for-linux.md): Cytool is a command-line tool integrated into the Cortex XDR agent that enables you to query and manage both basic and advanced functions of the agent. - [Introduction](https://cortex-docs.paloaltonetworks.com/cortex-xdr-agent/9.2/introduction.md) - [Cortex XDR agent for Windows](https://cortex-docs.paloaltonetworks.com/cortex-xdr-agent/9.2/cortex-xdr-agent-for-windows.md): To install, use, upgrade, and uninstall the Cortex XDR agent 9.2 on Windows endpoints, see the references in this topic. - [Cortex XDR agent for Windows requirements](https://cortex-docs.paloaltonetworks.com/cortex-xdr-agent/9.2/cortex-xdr-agent-for-windows/cortex-xdr-agent-for-windows-requirements.md): Windows endpoints must meet the following requirements to install the Cortex XDR agent. - [Install the Cortex XDR agent for Windows](https://cortex-docs.paloaltonetworks.com/cortex-xdr-agent/9.2/cortex-xdr-agent-for-windows/install-the-cortex-xdr-agent-for-windows.md): Learn about the Cortex XDR agent installation options and use the provided workflows to install the Cortex XDR agent on Windows endpoints. - [Install the Cortex XDR Agent with Installer and Content Update Package](https://cortex-docs.paloaltonetworks.com/cortex-xdr-agent/9.2/cortex-xdr-agent-for-windows/install-the-cortex-xdr-agent-with-installer-and-content-update-package.md): Deploy the Cortex XDR agent on Windows endpoints using the latest content and installer package. - [Cortex XDR agent for virtual environments and desktops](https://cortex-docs.paloaltonetworks.com/cortex-xdr-agent/9.2/cortex-xdr-agent-for-windows/cortex-xdr-agent-for-virtual-environments-and-desktops.md): Learn about the Cortex XDR agent virtual installation options and use the provided workflows to install the Cortex XDR agent on virtual Windows endpoints. - [Use Cortex XDR Agent for Windows](https://cortex-docs.paloaltonetworks.com/cortex-xdr-agent/9.2/cortex-xdr-agent-for-windows/use-cortex-xdr-agent-for-windows.md): Learn how to effectively use the Cortex XDR agent for Windows by the different options described in this topic. - [Upgrade the Cortex XDR Agent](https://cortex-docs.paloaltonetworks.com/cortex-xdr-agent/9.2/cortex-xdr-agent-for-windows/upgrade-the-cortex-xdr-agent.md): How to upgrade the Cortex XDR agent on Windows endpoints. - [Uninstall the Cortex XDR agent for Windows](https://cortex-docs.paloaltonetworks.com/cortex-xdr-agent/9.2/cortex-xdr-agent-for-windows/uninstall-the-cortex-xdr-agent-for-windows.md): Learn how to uninstall the Cortex XDR agent from a Windows endpoint. - [Troubleshooting resources for Windows](https://cortex-docs.paloaltonetworks.com/cortex-xdr-agent/9.2/cortex-xdr-agent-for-windows/troubleshooting-resources-for-windows.md): Refer to the following troubleshooting resources for the Cortex XDR agent for Windows. - [Cytool for Windows](https://cortex-docs.paloaltonetworks.com/cortex-xdr-agent/9.2/cortex-xdr-agent-for-windows/troubleshooting-resources-for-windows/cytool-for-windows.md): To manage Traps functions from the command line on Windows endpoints, use Cytool. - [Cortex XDR Agents Deployed in Advertise Mode](https://cortex-docs.paloaltonetworks.com/cortex-xdr-agent/9.2/cortex-xdr-agent-for-windows/troubleshooting-resources-for-windows/cortex-xdr-agents-deployed-in-advertise-mode.md): Depending on your Cortex XDR agent release, you can install or upgrade the agent in Advertise mode. - [Cortex XDR Agent for MacOS](https://cortex-docs.paloaltonetworks.com/cortex-xdr-agent/9.2/cortex-xdr-agent-for-macos.md): To install, use, and uninstall the Cortex XDR agent on MacOS endpoints, see the references in this topic. - [Cortex XDR Agent for Mac Requirements](https://cortex-docs.paloaltonetworks.com/cortex-xdr-agent/9.2/cortex-xdr-agent-for-macos/cortex-xdr-agent-for-mac-requirements.md): Mac (macOS) endpoints must meet the following requirements to install the Cortex XDR agent. - [Install the Cortex XDR Agent for Mac](https://cortex-docs.paloaltonetworks.com/cortex-xdr-agent/9.2/cortex-xdr-agent-for-macos/install-the-cortex-xdr-agent-for-mac.md): Learn about the Cortex XDR agent installation options and use the provided workflows to install the Cortex XDR agent on macOS endpoints. - [Install with a unified configuration profile for MDMs](https://cortex-docs.paloaltonetworks.com/cortex-xdr-agent/9.2/cortex-xdr-agent-for-macos/install-the-cortex-xdr-agent-for-mac/install-with-a-unified-configuration-profile-for-mdms.md): Use the Palo Alto Networks unified configuration profile for MDMs to seamlessly install the Cortex XDR agent on macOS endpoints. - [macOS 15 Sequoia system extensions configuration file](https://cortex-docs.paloaltonetworks.com/cortex-xdr-agent/9.2/cortex-xdr-agent-for-macos/install-the-cortex-xdr-agent-for-mac/macos-15-sequoia-system-extensions-configuration-file.md) - [MacOS Bluetooth MDM profile](https://cortex-docs.paloaltonetworks.com/cortex-xdr-agent/9.2/cortex-xdr-agent-for-macos/install-the-cortex-xdr-agent-for-mac/macos-bluetooth-mdm-profile.md) - [Install the Cortex XDR Agent Using JAMF](https://cortex-docs.paloaltonetworks.com/cortex-xdr-agent/9.2/cortex-xdr-agent-for-macos/install-the-cortex-xdr-agent-for-mac/install-the-cortex-xdr-agent-using-jamf.md): Step-by-step instructions to configure a JAMF installation profile for the Cortex XDR agent on macOS endpoints. - [Install the Cortex XDR Agent Manually](https://cortex-docs.paloaltonetworks.com/cortex-xdr-agent/9.2/cortex-xdr-agent-for-macos/install-the-cortex-xdr-agent-for-mac/install-the-cortex-xdr-agent-manually.md): Learn how to install the Cortex XDR agent manually on macOS endpoints. - [Configure Cortex XDR Agent for Mac](https://cortex-docs.paloaltonetworks.com/cortex-xdr-agent/9.2/cortex-xdr-agent-for-macos/configure-cortex-xdr-agent-for-mac.md): Run the wizard to guide you through the settings to enable the agent to run on the macOS endpoint. - [Use the Cortex XDR Agent for Mac](https://cortex-docs.paloaltonetworks.com/cortex-xdr-agent/9.2/cortex-xdr-agent-for-macos/use-the-cortex-xdr-agent-for-mac.md): Learn how to effectively use the Cortex XDR agent for Mac by the different options described in this topic. - [Uninstall the Cortex XDR Agent for Mac](https://cortex-docs.paloaltonetworks.com/cortex-xdr-agent/9.2/cortex-xdr-agent-for-macos/uninstall-the-cortex-xdr-agent-for-mac.md): Learn how to uninstall the Cortex XDR agent from a Mac endpoint. - [Manage the Agent Deployment Notifications for Mac](https://cortex-docs.paloaltonetworks.com/cortex-xdr-agent/9.2/cortex-xdr-agent-for-macos/manage-the-agent-deployment-notifications-for-mac.md): An overview of user notifications for the Cortex XDR agent during installation, upgrade, and removal on a Mac. - [Troubleshooting Resources for Mac](https://cortex-docs.paloaltonetworks.com/cortex-xdr-agent/9.2/cortex-xdr-agent-for-macos/troubleshooting-resources-for-mac.md): Refer to the following troubleshooting resources for the Cortex XDR agent for Mac. - [Cytool for Mac](https://cortex-docs.paloaltonetworks.com/cortex-xdr-agent/9.2/cortex-xdr-agent-for-macos/troubleshooting-resources-for-mac/cytool-for-mac.md): In addition to being available for Windows and Linux endpoints, Cytool is also available for Mac endpoints. - [Cortex XDR Agent for Linux](https://cortex-docs.paloaltonetworks.com/cortex-xdr-agent/9.2/cortex-xdr-agent-for-linux.md): To install, use, and uninstall the Cortex XDR agent on Linux endpoints, see the references in this topic. - [Cortex XDR supported Kernel Module versions by distribution](https://cortex-docs.paloaltonetworks.com/cortex-xdr-agent/9.2/cortex-xdr-agent-for-linux/cortex-xdr-supported-kernel-module-versions-by-distribution.md): To enable full endpoint protection features on Linux endpoints, you must use a supported Linux Kernel version. - [Cortex XDR Agent for Linux Requirements](https://cortex-docs.paloaltonetworks.com/cortex-xdr-agent/9.2/cortex-xdr-agent-for-linux/cortex-xdr-agent-for-linux-requirements.md): Linux endpoints must meet the following requirements to install the Cortex XDR agent. - [Install the Cortex XDR agent for Linux](https://cortex-docs.paloaltonetworks.com/cortex-xdr-agent/9.2/cortex-xdr-agent-for-linux/install-the-cortex-xdr-agent-for-linux.md): Learn how to install the Cortex XDR agent on a Linux endpoint. - [Install the Cortex XDR Agent for Kubernetes Hosts](https://cortex-docs.paloaltonetworks.com/cortex-xdr-agent/9.2/cortex-xdr-agent-for-linux/install-the-cortex-xdr-agent-for-kubernetes-hosts.md): How to install the Cortex XDR agent on a Kubernetes host. - [Use the Cortex XDR agent for Linux](https://cortex-docs.paloaltonetworks.com/cortex-xdr-agent/9.2/cortex-xdr-agent-for-linux/use-the-cortex-xdr-agent-for-linux.md): Learn how to effectively use the Cortex XDR agent for Linux by the different options described in this topic. - [Uninstall the Cortex XDR Agent for Linux](https://cortex-docs.paloaltonetworks.com/cortex-xdr-agent/9.2/cortex-xdr-agent-for-linux/uninstall-the-cortex-xdr-agent-for-linux.md): Learn how to uninstall the Cortex XDR agent from a Linux endpoint. - [Troubleshooting Resources for Linux](https://cortex-docs.paloaltonetworks.com/cortex-xdr-agent/9.2/cortex-xdr-agent-for-linux/troubleshooting-resources-for-linux.md): Refer to the following troubleshooting resources for the Cortex XDR agent for Linux. - [Cytool for Linux](https://cortex-docs.paloaltonetworks.com/cortex-xdr-agent/9.2/cortex-xdr-agent-for-linux/troubleshooting-resources-for-linux/cytool-for-linux.md): Cytool is a command-line tool integrated into the Cortex XDR agent that enables you to query and manage both basic and advanced functions of the agent. * [Introduction](https://cortex-docs.paloaltonetworks.com/cortex-xdr-agent/9.1/introduction.md): Learn about the Cortex XDR Agent installation procedures. * [Cortex XDR agent for Windows](https://cortex-docs.paloaltonetworks.com/cortex-xdr-agent/9.1/cortex-xdr-agent-for-windows.md): To install, use, upgrade, and uninstall the Cortex XDR agent on Windows endpoints, see the references in this topic. * [Cortex XDR agent for Windows requirements](https://cortex-docs.paloaltonetworks.com/cortex-xdr-agent/9.1/cortex-xdr-agent-for-windows/cortex-xdr-agent-for-windows-requirements.md): Windows endpoints must meet the following requirements to install the Cortex XDR agent. * [Install the Cortex XDR agent for Windows](https://cortex-docs.paloaltonetworks.com/cortex-xdr-agent/9.1/cortex-xdr-agent-for-windows/install-the-cortex-xdr-agent-for-windows.md): Learn about the Cortex XDR agent installation options and use the provided workflows to install the Cortex XDR agent on Windows endpoints. * [Install the Cortex XDR Agent with Installer and Content Update Package](https://cortex-docs.paloaltonetworks.com/cortex-xdr-agent/9.1/cortex-xdr-agent-for-windows/install-the-cortex-xdr-agent-with-installer-and-content-update-package.md): Deploy the Cortex XDR agent on Windows endpoints using the latest content and installer package. * [Cortex XDR agent for virtual environments and desktops](https://cortex-docs.paloaltonetworks.com/cortex-xdr-agent/9.1/cortex-xdr-agent-for-windows/cortex-xdr-agent-for-virtual-environments-and-desktops.md): Learn about the Cortex XDR agent virtual installation options and use the provided workflows to install the Cortex XDR agent on virtual Windows endpoints. * [Use Cortex XDR Agent for Windows](https://cortex-docs.paloaltonetworks.com/cortex-xdr-agent/9.1/cortex-xdr-agent-for-windows/use-cortex-xdr-agent-for-windows.md): Learn how to effectively use the Cortex XDR agent for Windows by the different options described in this topic. * [Upgrade the Cortex XDR Agent](https://cortex-docs.paloaltonetworks.com/cortex-xdr-agent/9.1/cortex-xdr-agent-for-windows/upgrade-the-cortex-xdr-agent.md): How to upgrade the Cortex XDR agent on Windows endpoints. * [Uninstall the Cortex XDR agent for Windows](https://cortex-docs.paloaltonetworks.com/cortex-xdr-agent/9.1/cortex-xdr-agent-for-windows/uninstall-the-cortex-xdr-agent-for-windows.md): Learn how to uninstall the Cortex XDR agent from a Windows endpoint. * [Troubleshooting resources for Windows](https://cortex-docs.paloaltonetworks.com/cortex-xdr-agent/9.1/cortex-xdr-agent-for-windows/troubleshooting-resources-for-windows.md): Refer to the following troubleshooting resources for the Cortex XDR agent for Windows. * [Cytool for Windows](https://cortex-docs.paloaltonetworks.com/cortex-xdr-agent/9.1/cortex-xdr-agent-for-windows/troubleshooting-resources-for-windows/cytool-for-windows.md): To manage Traps functions from the command line on Windows endpoints, use Cytool. * [Cortex XDR Agents Deployed in Advertise Mode](https://cortex-docs.paloaltonetworks.com/cortex-xdr-agent/9.1/cortex-xdr-agent-for-windows/troubleshooting-resources-for-windows/cortex-xdr-agents-deployed-in-advertise-mode.md): Depending on your Cortex XDR agent release, you can install or upgrade the agent in Advertise mode. * [Cortex XDR Agent for MacOS](https://cortex-docs.paloaltonetworks.com/cortex-xdr-agent/9.1/cortex-xdr-agent-for-macos.md): To install, use, and uninstall the Cortex XDR agent on MacOS endpoints, see the references in this topic. * [Cortex XDR Agent for Mac Requirements](https://cortex-docs.paloaltonetworks.com/cortex-xdr-agent/9.1/cortex-xdr-agent-for-macos/cortex-xdr-agent-for-mac-requirements.md): Mac (macOS) endpoints must meet the following requirements to install the Cortex XDR agent. * [Install the Cortex XDR Agent for Mac](https://cortex-docs.paloaltonetworks.com/cortex-xdr-agent/9.1/cortex-xdr-agent-for-macos/install-the-cortex-xdr-agent-for-mac.md): Learn about the Cortex XDR agent installation options and use the provided workflows to install the Cortex XDR agent on macOS endpoints. * [Install with a unified configuration profile for MDMs](https://cortex-docs.paloaltonetworks.com/cortex-xdr-agent/9.1/cortex-xdr-agent-for-macos/install-the-cortex-xdr-agent-for-mac/install-with-a-unified-configuration-profile-for-mdms.md): Use the Palo Alto Networks unified configuration profile for MDMs to seamlessly install the Cortex XDR agent on macOS endpoints. * [macOS 15 Sequoia system extensions configuration file](https://cortex-docs.paloaltonetworks.com/cortex-xdr-agent/9.1/cortex-xdr-agent-for-macos/install-the-cortex-xdr-agent-for-mac/macos-15-sequoia-system-extensions-configuration-file.md) * [MacOS Bluetooth MDM profile](https://cortex-docs.paloaltonetworks.com/cortex-xdr-agent/9.1/cortex-xdr-agent-for-macos/install-the-cortex-xdr-agent-for-mac/macos-bluetooth-mdm-profile.md) * [DLP MDM profile for macOS](https://cortex-docs.paloaltonetworks.com/cortex-xdr-agent/9.1/cortex-xdr-agent-for-macos/install-the-cortex-xdr-agent-for-mac/dlp-mdm-profile-for-macos.md) * [Install the Cortex XDR Agent Using JAMF](https://cortex-docs.paloaltonetworks.com/cortex-xdr-agent/9.1/cortex-xdr-agent-for-macos/install-the-cortex-xdr-agent-for-mac/install-the-cortex-xdr-agent-using-jamf.md): Step-by-step instructions to configure a JAMF installation profile for the Cortex XDR agent on macOS endpoints. * [Install the Cortex XDR Agent Manually](https://cortex-docs.paloaltonetworks.com/cortex-xdr-agent/9.1/cortex-xdr-agent-for-macos/install-the-cortex-xdr-agent-for-mac/install-the-cortex-xdr-agent-manually.md): Learn how to install the Cortex XDR agent manually on macOS endpoints. * [Configure Cortex XDR Agent for Mac](https://cortex-docs.paloaltonetworks.com/cortex-xdr-agent/9.1/cortex-xdr-agent-for-macos/configure-cortex-xdr-agent-for-mac.md): Run the wizard to guide you through the settings to enable the agent to run on the macOS endpoint. * [Use the Cortex XDR Agent for Mac](https://cortex-docs.paloaltonetworks.com/cortex-xdr-agent/9.1/cortex-xdr-agent-for-macos/use-the-cortex-xdr-agent-for-mac.md): Learn how to effectively use the Cortex XDR agent for Mac by the different options described in this topic. * [Uninstall the Cortex XDR Agent for Mac](https://cortex-docs.paloaltonetworks.com/cortex-xdr-agent/9.1/cortex-xdr-agent-for-macos/uninstall-the-cortex-xdr-agent-for-mac.md): Learn how to uninstall the Cortex XDR agent from a Mac endpoint. * [Manage the Agent Deployment Notifications for Mac](https://cortex-docs.paloaltonetworks.com/cortex-xdr-agent/9.1/cortex-xdr-agent-for-macos/manage-the-agent-deployment-notifications-for-mac.md): An overview of user notifications for the Cortex XDR agent during installation, upgrade, and removal on a Mac. * [Troubleshooting Resources for Mac](https://cortex-docs.paloaltonetworks.com/cortex-xdr-agent/9.1/cortex-xdr-agent-for-macos/troubleshooting-resources-for-mac.md): Refer to the following troubleshooting resources for the Cortex XDR agent for Mac. * [Cytool for Mac](https://cortex-docs.paloaltonetworks.com/cortex-xdr-agent/9.1/cortex-xdr-agent-for-macos/troubleshooting-resources-for-mac/cytool-for-mac.md): In addition to being available for Windows and Linux endpoints, Cytool is also available for Mac endpoints. * [Cortex XDR Agent for Linux](https://cortex-docs.paloaltonetworks.com/cortex-xdr-agent/9.1/cortex-xdr-agent-for-linux.md): To install, use, and uninstall the Cortex XDR agent on Linux endpoints, see the references in this topic. * [Cortex XDR supported Kernel Module versions by distribution](https://cortex-docs.paloaltonetworks.com/cortex-xdr-agent/9.1/cortex-xdr-agent-for-linux/cortex-xdr-supported-kernel-module-versions-by-distribution.md): To enable full endpoint protection features on Linux endpoints, you must use a supported Linux Kernel version. * [Cortex XDR Agent for Linux Requirements](https://cortex-docs.paloaltonetworks.com/cortex-xdr-agent/9.1/cortex-xdr-agent-for-linux/cortex-xdr-agent-for-linux-requirements.md): Linux endpoints must meet the following requirements to install the Cortex XDR agent * [Install the Cortex XDR agent for Linux](https://cortex-docs.paloaltonetworks.com/cortex-xdr-agent/9.1/cortex-xdr-agent-for-linux/install-the-cortex-xdr-agent-for-linux.md): Learn how to install the Cortex XDR agent on a Linux endpoint. * [Install the Cortex XDR Agent for Kubernetes Hosts](https://cortex-docs.paloaltonetworks.com/cortex-xdr-agent/9.1/cortex-xdr-agent-for-linux/install-the-cortex-xdr-agent-for-kubernetes-hosts.md): How to install the Cortex XDR agent on a Kubernetes host. * [Install the Cortex XDR agent on AWS ECS EC2 Clusters](https://cortex-docs.paloaltonetworks.com/cortex-xdr-agent/9.1/cortex-xdr-agent-for-linux/install-the-cortex-xdr-agent-on-aws-ecs-ec2-clusters.md): Learn how to install the Cortex XDR agent on AWS ECS EC2 clusters * [Use the Cortex XDR agent for Linux](https://cortex-docs.paloaltonetworks.com/cortex-xdr-agent/9.1/cortex-xdr-agent-for-linux/use-the-cortex-xdr-agent-for-linux.md): Learn how to effectively use the Cortex XDR agent for Linux by the different options described in this topic. * [Uninstall the Cortex XDR Agent for Linux](https://cortex-docs.paloaltonetworks.com/cortex-xdr-agent/9.1/cortex-xdr-agent-for-linux/uninstall-the-cortex-xdr-agent-for-linux.md): Learn how to uninstall the Cortex XDR agent from a Linux endpoint. * [Troubleshooting Resources for Linux](https://cortex-docs.paloaltonetworks.com/cortex-xdr-agent/9.1/cortex-xdr-agent-for-linux/troubleshooting-resources-for-linux.md): Refer to the following troubleshooting resources for the Cortex XDR agent for Linux. * [Cytool for Linux](https://cortex-docs.paloaltonetworks.com/cortex-xdr-agent/9.1/cortex-xdr-agent-for-linux/troubleshooting-resources-for-linux/cytool-for-linux.md): Cytool is a command-line tool integrated into the Cortex XDR agent that enables you to query and manage both basic and advanced functions of the agent. * [Introduction](https://cortex-docs.paloaltonetworks.com/cortex-xdr-agent/8.7/introduction.md): Learn about the Cortex XDR Agent installation procedures. * [Cortex XDR agent for Windows](https://cortex-docs.paloaltonetworks.com/cortex-xdr-agent/8.7/cortex-xdr-agent-for-windows.md): To install, use, upgrade, and uninstall the Cortex XDR agent on Windows endpoints, see the references in this topic. * [Cortex XDR agent for Windows requirements](https://cortex-docs.paloaltonetworks.com/cortex-xdr-agent/8.7/cortex-xdr-agent-for-windows/cortex-xdr-agent-for-windows-requirements.md): Windows endpoints must meet the following requirements to install the Cortex XDR agent. * [Install the Cortex XDR agent for Windows](https://cortex-docs.paloaltonetworks.com/cortex-xdr-agent/8.7/cortex-xdr-agent-for-windows/install-the-cortex-xdr-agent-for-windows.md): Learn about the Cortex XDR agent installation options and use the provided workflows to install the Cortex XDR agent on Windows endpoints. * [Install the Cortex XDR Agent with Installer and Content Update Package](https://cortex-docs.paloaltonetworks.com/cortex-xdr-agent/8.7/cortex-xdr-agent-for-windows/install-the-cortex-xdr-agent-with-installer-and-content-update-package.md): Deploy the Cortex XDR agent on Windows endpoints using the latest content and installer package. * [Cortex XDR agent for virtual environments and desktops](https://cortex-docs.paloaltonetworks.com/cortex-xdr-agent/8.7/cortex-xdr-agent-for-windows/cortex-xdr-agent-for-virtual-environments-and-desktops.md): Learn about the Cortex XDR agent virtual installation options and use the provided workflows to install the Cortex XDR agent on virtual Windows endpoints. * [Use Cortex XDR Agent for Windows](https://cortex-docs.paloaltonetworks.com/cortex-xdr-agent/8.7/cortex-xdr-agent-for-windows/use-cortex-xdr-agent-for-windows.md): Learn how to effectively use the Cortex XDR agent for Windows by the different options described in this topic. * [Upgrade the Cortex XDR Agent](https://cortex-docs.paloaltonetworks.com/cortex-xdr-agent/8.7/cortex-xdr-agent-for-windows/upgrade-the-cortex-xdr-agent.md): How to upgrade the Cortex XDR agent on Windows endpoints. * [Uninstall the Cortex XDR agent for Windows](https://cortex-docs.paloaltonetworks.com/cortex-xdr-agent/8.7/cortex-xdr-agent-for-windows/uninstall-the-cortex-xdr-agent-for-windows.md): Learn how to uninstall the Cortex XDR agent from a Windows endpoint. * [Troubleshooting resources for Windows](https://cortex-docs.paloaltonetworks.com/cortex-xdr-agent/8.7/cortex-xdr-agent-for-windows/troubleshooting-resources-for-windows.md): Refer to the following troubleshooting resources for the Cortex XDR agent for Windows. * [Cytool for Windows](https://cortex-docs.paloaltonetworks.com/cortex-xdr-agent/8.7/cortex-xdr-agent-for-windows/troubleshooting-resources-for-windows/cytool-for-windows.md): To manage Traps functions from the command line on Windows endpoints, use Cytool. * [Cortex XDR Agents Deployed in Advertise Mode](https://cortex-docs.paloaltonetworks.com/cortex-xdr-agent/8.7/cortex-xdr-agent-for-windows/troubleshooting-resources-for-windows/cortex-xdr-agents-deployed-in-advertise-mode.md): Depending on your Cortex XDR agent release, you can install or upgrade the agent in Advertise mode. * [Cortex XDR Agent for MacOS](https://cortex-docs.paloaltonetworks.com/cortex-xdr-agent/8.7/cortex-xdr-agent-for-macos.md): To install, use, and uninstall the Cortex XDR agent on MacOS endpoints, see the references in this topic. * [Cortex XDR Agent for Mac Requirements](https://cortex-docs.paloaltonetworks.com/cortex-xdr-agent/8.7/cortex-xdr-agent-for-macos/cortex-xdr-agent-for-mac-requirements.md): Mac (macOS) endpoints must meet the following requirements to install the Cortex XDR agent 8.2 * [Install the Cortex XDR Agent for Mac](https://cortex-docs.paloaltonetworks.com/cortex-xdr-agent/8.7/cortex-xdr-agent-for-macos/install-the-cortex-xdr-agent-for-mac.md): Learn about the Cortex XDR agent installation options and use the provided workflows to install the Cortex XDR agent on macOS endpoints. * [Install with a unified configuration profile for MDMs](https://cortex-docs.paloaltonetworks.com/cortex-xdr-agent/8.7/cortex-xdr-agent-for-macos/install-the-cortex-xdr-agent-for-mac/install-with-a-unified-configuration-profile-for-mdms.md): Use the Palo Alto Networks unified configuration profile for MDMs to seamlessly install the Cortex XDR agent on macOS endpoints. * [macOS 15 Sequoia system extensions configuration file](https://cortex-docs.paloaltonetworks.com/cortex-xdr-agent/8.7/cortex-xdr-agent-for-macos/install-the-cortex-xdr-agent-for-mac/macos-15-sequoia-system-extensions-configuration-file.md) * [MacOS Bluetooth MDM profile](https://cortex-docs.paloaltonetworks.com/cortex-xdr-agent/8.7/cortex-xdr-agent-for-macos/install-the-cortex-xdr-agent-for-mac/macos-bluetooth-mdm-profile.md) * [Install the Cortex XDR Agent Using JAMF](https://cortex-docs.paloaltonetworks.com/cortex-xdr-agent/8.7/cortex-xdr-agent-for-macos/install-the-cortex-xdr-agent-for-mac/install-the-cortex-xdr-agent-using-jamf.md): Step-by-step instructions to configure a JAMF installation profile for the Cortex XDR agent on macOS endpoints. * [Install the Cortex XDR Agent Manually](https://cortex-docs.paloaltonetworks.com/cortex-xdr-agent/8.7/cortex-xdr-agent-for-macos/install-the-cortex-xdr-agent-for-mac/install-the-cortex-xdr-agent-manually.md): Learn how to install the Cortex XDR agent manually on macOS endpoints. * [Configure Cortex XDR Agent for Mac](https://cortex-docs.paloaltonetworks.com/cortex-xdr-agent/8.7/cortex-xdr-agent-for-macos/configure-cortex-xdr-agent-for-mac.md): Run the wizard to guide you through the settings to enable the agent to run on the macOS endpoint. * [Use the Cortex XDR Agent for Mac](https://cortex-docs.paloaltonetworks.com/cortex-xdr-agent/8.7/cortex-xdr-agent-for-macos/use-the-cortex-xdr-agent-for-mac.md): Learn how to effectively use the Cortex XDR agent for Mac by the different options described in this topic. * [Uninstall the Cortex XDR Agent for Mac](https://cortex-docs.paloaltonetworks.com/cortex-xdr-agent/8.7/cortex-xdr-agent-for-macos/uninstall-the-cortex-xdr-agent-for-mac.md): Learn how to uninstall the Cortex XDR agent from a Mac endpoint. * [Manage the Agent Deployment Notifications for Mac](https://cortex-docs.paloaltonetworks.com/cortex-xdr-agent/8.7/cortex-xdr-agent-for-macos/manage-the-agent-deployment-notifications-for-mac.md): An overview of user notifications for the Cortex XDR agent during installation, upgrade, and removal on a Mac. * [Troubleshooting Resources for Mac](https://cortex-docs.paloaltonetworks.com/cortex-xdr-agent/8.7/cortex-xdr-agent-for-macos/troubleshooting-resources-for-mac.md): Refer to the following troubleshooting resources for the Cortex XDR agent for Mac. * [Cytool for Mac](https://cortex-docs.paloaltonetworks.com/cortex-xdr-agent/8.7/cortex-xdr-agent-for-macos/troubleshooting-resources-for-mac/cytool-for-mac.md): In addition to being available for Windows and Linux endpoints, Cytool is also available for Mac endpoints. * [Cortex XDR Agent for Linux](https://cortex-docs.paloaltonetworks.com/cortex-xdr-agent/8.7/cortex-xdr-agent-for-linux.md): To install, use, and uninstall the Cortex XDR agent on Linux endpoints, see the references in this topic. * [Cortex XDR Agent for Linux Requirements](https://cortex-docs.paloaltonetworks.com/cortex-xdr-agent/8.7/cortex-xdr-agent-for-linux/cortex-xdr-agent-for-linux-requirements.md): Linux endpoints must meet the following requirements to install the Cortex XDR agent * [Install the Cortex XDR agent for Linux](https://cortex-docs.paloaltonetworks.com/cortex-xdr-agent/8.7/cortex-xdr-agent-for-linux/install-the-cortex-xdr-agent-for-linux.md): Learn how to install the Cortex XDR agent on a Linux endpoint. * [Install the Cortex XDR Agent for Kubernetes Hosts](https://cortex-docs.paloaltonetworks.com/cortex-xdr-agent/8.7/cortex-xdr-agent-for-linux/install-the-cortex-xdr-agent-for-kubernetes-hosts.md): How to install the Cortex XDR agent on a Kubernetes host. * [Use the Cortex XDR agent for Linux](https://cortex-docs.paloaltonetworks.com/cortex-xdr-agent/8.7/cortex-xdr-agent-for-linux/use-the-cortex-xdr-agent-for-linux.md): Learn how to effectively use the Cortex XDR agent for Linux by the different options described in this topic. * [Uninstall the Cortex XDR Agent for Linux](https://cortex-docs.paloaltonetworks.com/cortex-xdr-agent/8.7/cortex-xdr-agent-for-linux/uninstall-the-cortex-xdr-agent-for-linux.md): Learn how to uninstall the Cortex XDR agent from a Linux endpoint. * [Troubleshooting Resources for Linux](https://cortex-docs.paloaltonetworks.com/cortex-xdr-agent/8.7/cortex-xdr-agent-for-linux/troubleshooting-resources-for-linux.md): Refer to the following troubleshooting resources for the Cortex XDR agent for Linux. * [Cytool for Linux](https://cortex-docs.paloaltonetworks.com/cortex-xdr-agent/8.7/cortex-xdr-agent-for-linux/troubleshooting-resources-for-linux/cytool-for-linux.md): Cytool is a command-line tool integrated into the Cortex XDR agent that enables you to query and manage both basic and advanced functions of the agent. * [Cortex XDR Agent and Content upgrades](https://cortex-docs.paloaltonetworks.com/cortex-xdr-agent/8.7/cortex-xdr-agent-and-content-upgrades.md): Palo Alto Networks deployment recommendations for Cortex XDR agents. * [Introduction](https://cortex-docs.paloaltonetworks.com/cortex-xdr-agent/7.9-ce/introduction.md): Learn about the Cortex XDR Agent installation procedures. * [Cortex XDR Agent 7.9 for Windows](https://cortex-docs.paloaltonetworks.com/cortex-xdr-agent/7.9-ce/cortex-xdr-agent-7.9-for-windows.md): To install, use, upgrade, and uninstall the Cortex XDR agent 7.9 on Windows endpoints, see the references in this topic. * [Cortex XDR Agent for Windows Requirements](https://cortex-docs.paloaltonetworks.com/cortex-xdr-agent/7.9-ce/cortex-xdr-agent-7.9-for-windows/cortex-xdr-agent-for-windows-requirements.md): Windows endpoints must meet the following requirements to install the Cortex XDR agent. * [Install the Cortex XDR agent on unsupported-ACS OS versions](https://cortex-docs.paloaltonetworks.com/cortex-xdr-agent/7.9-ce/cortex-xdr-agent-7.9-for-windows/install-the-cortex-xdr-agent-on-unsupported-acs-os-versions.md): To install, use, upgrade, and uninstall the Cortex XDR agent 7.9 on Windows endpoints, see the references in this topic. * [Install the Cortex XDR Agent for Windows](https://cortex-docs.paloaltonetworks.com/cortex-xdr-agent/7.9-ce/cortex-xdr-agent-7.9-for-windows/install-the-cortex-xdr-agent-for-windows.md): Learn about the Cortex XDR agent installation options and use the provided workflows to install the Cortex XDR agent on Windows endpoints. * [Install the Cortex XDR Agent with Installer and Content Update Package](https://cortex-docs.paloaltonetworks.com/cortex-xdr-agent/7.9-ce/cortex-xdr-agent-7.9-for-windows/install-the-cortex-xdr-agent-with-installer-and-content-update-package.md): Deploy the Cortex XDR agent 8.2 on Windows endpoints using the latest content and installer package. * [Cortex XDR Agent for Virtual Environments and Desktops](https://cortex-docs.paloaltonetworks.com/cortex-xdr-agent/7.9-ce/cortex-xdr-agent-7.9-for-windows/cortex-xdr-agent-for-virtual-environments-and-desktops.md): Learn about the Cortex XDR agent virtual installation options and use the provided workflows to install the Cortex XDR agent on virtual Windows endpoints. * [Use Cortex XDR Agent for Windows](https://cortex-docs.paloaltonetworks.com/cortex-xdr-agent/7.9-ce/cortex-xdr-agent-7.9-for-windows/use-cortex-xdr-agent-for-windows.md): Learn how to effectively use the Cortex XDR agent for Windows by the different options described in this topic. * [Upgrade the Cortex XDR Agent](https://cortex-docs.paloaltonetworks.com/cortex-xdr-agent/7.9-ce/cortex-xdr-agent-7.9-for-windows/upgrade-the-cortex-xdr-agent.md): How to upgrade the Cortex XDR agent on Windows endpoints. * [Uninstall the Cortex XDR Agent for Windows](https://cortex-docs.paloaltonetworks.com/cortex-xdr-agent/7.9-ce/cortex-xdr-agent-7.9-for-windows/uninstall-the-cortex-xdr-agent-for-windows.md): Learn how to uninstall the Cortex XDR agent from a Windows endpoint. * [Troubleshooting Resources for Windows](https://cortex-docs.paloaltonetworks.com/cortex-xdr-agent/7.9-ce/cortex-xdr-agent-7.9-for-windows/troubleshooting-resources-for-windows.md): Refer to the following troubleshooting resources for the Cortex XDR agent for Windows. * [Cytool for Windows](https://cortex-docs.paloaltonetworks.com/cortex-xdr-agent/7.9-ce/cortex-xdr-agent-7.9-for-windows/troubleshooting-resources-for-windows/cytool-for-windows.md): To manage Traps functions from the command line on Windows endpoints, use Cytool. * [Cortex XDR Agents Deployed in Advertise Mode](https://cortex-docs.paloaltonetworks.com/cortex-xdr-agent/7.9-ce/cortex-xdr-agent-7.9-for-windows/troubleshooting-resources-for-windows/cortex-xdr-agents-deployed-in-advertise-mode.md): Depending on your Cortex XDR agent release, you can install or upgrade the agent in Advertise mode. * [Cortex XDR Agent 7.9 for Mac](https://cortex-docs.paloaltonetworks.com/cortex-xdr-agent/7.9-ce/cortex-xdr-agent-7.9-for-mac.md): To install, use, and uninstall the Cortex XDR agent 7.8 on Mac endpoints, see the references in this topic. * [Cortex XDR Agent for Mac Requirements](https://cortex-docs.paloaltonetworks.com/cortex-xdr-agent/7.9-ce/cortex-xdr-agent-7.9-for-mac/cortex-xdr-agent-for-mac-requirements.md): Mac (macOS) endpoints must meet the following requirements to install the Cortex XDR agent 7.9 * [Install the Cortex XDR Agent for Mac](https://cortex-docs.paloaltonetworks.com/cortex-xdr-agent/7.9-ce/cortex-xdr-agent-7.9-for-mac/install-the-cortex-xdr-agent-for-mac.md): Learn about the Cortex XDR agent installation options and use the provided workflows to install the Cortex XDR agent on macOS endpoints. * [Install with a unified configuration profile for MDMs](https://cortex-docs.paloaltonetworks.com/cortex-xdr-agent/7.9-ce/cortex-xdr-agent-7.9-for-mac/install-the-cortex-xdr-agent-for-mac/install-with-a-unified-configuration-profile-for-mdms.md): Use the Palo Alto Networks unified configuration profile for MDMs to seamlessly install the Cortex XDR agent on macOS endpoints. * [Install the Cortex XDR Agent Using JAMF](https://cortex-docs.paloaltonetworks.com/cortex-xdr-agent/7.9-ce/cortex-xdr-agent-7.9-for-mac/install-the-cortex-xdr-agent-for-mac/install-the-cortex-xdr-agent-using-jamf.md): Step-by-step instructions to configure a JAMF installation profile for the Cortex XDR agent on macOS endpoints. * [Install the Cortex XDR Agent Manually](https://cortex-docs.paloaltonetworks.com/cortex-xdr-agent/7.9-ce/cortex-xdr-agent-7.9-for-mac/install-the-cortex-xdr-agent-for-mac/install-the-cortex-xdr-agent-manually.md): Learn how to install the Cortex XDR agent manually on macOS endpoints. * [Configure Cortex XDR Agent for Mac](https://cortex-docs.paloaltonetworks.com/cortex-xdr-agent/7.9-ce/cortex-xdr-agent-7.9-for-mac/install-the-cortex-xdr-agent-for-mac/configure-cortex-xdr-agent-for-mac.md): Run the wizard to guide you through the settings to enable the agent to run on the macOS endpoint. * [Use the Cortex XDR Agent for Mac](https://cortex-docs.paloaltonetworks.com/cortex-xdr-agent/7.9-ce/cortex-xdr-agent-7.9-for-mac/use-the-cortex-xdr-agent-for-mac.md): Learn how to effectively use the Cortex XDR agent for Mac by the different options described in this topic. * [Uninstall the Cortex XDR Agent for Mac](https://cortex-docs.paloaltonetworks.com/cortex-xdr-agent/7.9-ce/cortex-xdr-agent-7.9-for-mac/uninstall-the-cortex-xdr-agent-for-mac.md): Learn how to uninstall the Cortex XDR agent from a Mac endpoint. * [Manage the Agent Deployment Notifications for Mac](https://cortex-docs.paloaltonetworks.com/cortex-xdr-agent/7.9-ce/cortex-xdr-agent-7.9-for-mac/manage-the-agent-deployment-notifications-for-mac.md): An overview of user notifications for the Cortex XDR agent during installation, upgrade, and removal on a Mac. * [Troubleshooting Resources for Mac](https://cortex-docs.paloaltonetworks.com/cortex-xdr-agent/7.9-ce/cortex-xdr-agent-7.9-for-mac/troubleshooting-resources-for-mac.md): Refer to the following troubleshooting resources for the Cortex XDR agent for Mac. * [Cytool for Mac](https://cortex-docs.paloaltonetworks.com/cortex-xdr-agent/7.9-ce/cortex-xdr-agent-7.9-for-mac/troubleshooting-resources-for-mac/cytool-for-mac.md): In addition to being available for Windows and Linux endpoints, Cytool is also available for Mac endpoints. * [Cortex XDR Agent 7.9 for Linux](https://cortex-docs.paloaltonetworks.com/cortex-xdr-agent/7.9-ce/cortex-xdr-agent-7.9-for-linux.md): To install, use, and uninstall the Cortex XDR agent 7.9 on Linux endpoints, see the references in this topic. * [Cortex XDR Agent for Linux Requirements](https://cortex-docs.paloaltonetworks.com/cortex-xdr-agent/7.9-ce/cortex-xdr-agent-7.9-for-linux/cortex-xdr-agent-for-linux-requirements.md): Linux endpoints must meet the following requirements to install the Cortex XDR agent * [Install the Cortex XDR Agent for Linux](https://cortex-docs.paloaltonetworks.com/cortex-xdr-agent/7.9-ce/cortex-xdr-agent-7.9-for-linux/install-the-cortex-xdr-agent-for-linux.md): Learn how to install the Cortex XDR agent on a Linux endpoint. * [Install the Cortex XDR Agent for Kubernetes Hosts](https://cortex-docs.paloaltonetworks.com/cortex-xdr-agent/7.9-ce/cortex-xdr-agent-7.9-for-linux/install-the-cortex-xdr-agent-for-kubernetes-hosts.md): Learn how to install the Cortex XDR agent for a Kubernetes host. * [Use the Cortex XDR agent for Linux](https://cortex-docs.paloaltonetworks.com/cortex-xdr-agent/7.9-ce/cortex-xdr-agent-7.9-for-linux/use-the-cortex-xdr-agent-for-linux.md): Learn how to effectively use the Cortex XDR agent for Linux by the different options described in this topic. * [Uninstall the Cortex XDR Agent for Linux](https://cortex-docs.paloaltonetworks.com/cortex-xdr-agent/7.9-ce/cortex-xdr-agent-7.9-for-linux/uninstall-the-cortex-xdr-agent-for-linux.md): Learn how to uninstall the Cortex XDR agent from a Linux endpoint. * [Troubleshooting Resources for Linux](https://cortex-docs.paloaltonetworks.com/cortex-xdr-agent/7.9-ce/cortex-xdr-agent-7.9-for-linux/troubleshooting-resources-for-linux.md): Refer to the following troubleshooting resources for the Cortex XDR agent for Linux. * [Cortex XDR Agent version 7.6](https://cortex-docs.paloaltonetworks.com/cortex-xdr-agent/7.6-eol/cortex-xdr-agent-version-7.6.md) * [Traps Agent 5.0 for Windows](https://cortex-docs.paloaltonetworks.com/cortex-xdr-agent/5.0/traps-agent-5.0-for-windows.md): To uninstall, use, and upgrade the Traps agent 5.0 on Windows endpoints, follow the instructions in this section. * [Traps Agent for Windows Requirements](https://cortex-docs.paloaltonetworks.com/cortex-xdr-agent/5.0/traps-agent-5.0-for-windows/traps-agent-for-windows-requirements.md): Windows endpoints must meet the following requirements to install the Traps agent 5.0. * [Install Traps Agent for Windows](https://cortex-docs.paloaltonetworks.com/cortex-xdr-agent/5.0/traps-agent-5.0-for-windows/install-traps-agent-for-windows.md): Use the following workflows to install the Traps agent 5.0 on Windows endpoints. This topic provides options to use the MSI, Msiexec, and how to configure on a non-persistent VDI. * [Use Traps Agent for Windows](https://cortex-docs.paloaltonetworks.com/cortex-xdr-agent/5.0/traps-agent-5.0-for-windows/use-traps-agent-for-windows.md): Use the Traps console to view the agent status, initiate a connection to the server, view and send logs, view security events that occurred on the endpoint, and change the display language of the Trap * [Uninstall Traps Agent for Windows](https://cortex-docs.paloaltonetworks.com/cortex-xdr-agent/5.0/traps-agent-5.0-for-windows/uninstall-traps-agent-for-windows.md): Use this workflow to uninstall Traps agent 5.0 on a Windows endpoint. * [Troubleshooting Resources for Traps Agent for Windows](https://cortex-docs.paloaltonetworks.com/cortex-xdr-agent/5.0/traps-agent-5.0-for-windows/troubleshooting-resources-for-traps-agent-for-windows.md): Use the resources in this topic to troubleshoot the Traps agent 5.0 on Windows endpoints. * [Cytool for Windows](https://cortex-docs.paloaltonetworks.com/cortex-xdr-agent/5.0/traps-agent-5.0-for-windows/troubleshooting-resources-for-traps-agent-for-windows/cytool-for-windows.md): To manage Traps functions from the command line on Windows endpoints, use Cytool. * [Traps Agent 5.0 for Mac](https://cortex-docs.paloaltonetworks.com/cortex-xdr-agent/5.0/traps-agent-5.0-for-mac.md): To uninstall, use, and upgrade the Traps agent 5.0 on Mac endpoints, follow the instructions in this section. * [Traps for Mac Requirements](https://cortex-docs.paloaltonetworks.com/cortex-xdr-agent/5.0/traps-agent-5.0-for-mac/traps-for-mac-requirements.md): Refer to requirements for Traps agent for Mac. * [Install the Traps Agent for Mac](https://cortex-docs.paloaltonetworks.com/cortex-xdr-agent/5.0/traps-agent-5.0-for-mac/install-the-traps-agent-for-mac.md): Perform steps to install the traps agent for Mac. * [Use the Traps Agent for Mac](https://cortex-docs.paloaltonetworks.com/cortex-xdr-agent/5.0/traps-agent-5.0-for-mac/use-the-traps-agent-for-mac.md) * [Uninstall the Traps Agent for Mac](https://cortex-docs.paloaltonetworks.com/cortex-xdr-agent/5.0/traps-agent-5.0-for-mac/uninstall-the-traps-agent-for-mac.md) * [Troubleshooting Resources for the Traps Agent for Mac](https://cortex-docs.paloaltonetworks.com/cortex-xdr-agent/5.0/traps-agent-5.0-for-mac/troubleshooting-resources-for-the-traps-agent-for-mac.md) * [Cytool for Mac](https://cortex-docs.paloaltonetworks.com/cortex-xdr-agent/5.0/traps-agent-5.0-for-mac/troubleshooting-resources-for-the-traps-agent-for-mac/cytool-for-mac.md) * [Traps Agent 5.0 for Linux](https://cortex-docs.paloaltonetworks.com/cortex-xdr-agent/5.0/traps-agent-5.0-for-linux.md) * [Traps for Linux Requirements](https://cortex-docs.paloaltonetworks.com/cortex-xdr-agent/5.0/traps-agent-5.0-for-linux/traps-for-linux-requirements.md) * [Traps for Linux Limitations](https://cortex-docs.paloaltonetworks.com/cortex-xdr-agent/5.0/traps-agent-5.0-for-linux/traps-for-linux-requirements/traps-for-linux-limitations.md) * [Install the Traps Agent for Linux](https://cortex-docs.paloaltonetworks.com/cortex-xdr-agent/5.0/traps-agent-5.0-for-linux/install-the-traps-agent-for-linux.md) * [Use the Traps Agent for Linux](https://cortex-docs.paloaltonetworks.com/cortex-xdr-agent/5.0/traps-agent-5.0-for-linux/use-the-traps-agent-for-linux.md) * [Uninstall the Traps Agent for Linux](https://cortex-docs.paloaltonetworks.com/cortex-xdr-agent/5.0/traps-agent-5.0-for-linux/uninstall-the-traps-agent-for-linux.md) * [Troubleshooting Resources for the Traps Agent for Linux](https://cortex-docs.paloaltonetworks.com/cortex-xdr-agent/5.0/traps-agent-5.0-for-linux/troubleshooting-resources-for-the-traps-agent-for-linux.md) * [Traps App 5.0 for Android](https://cortex-docs.paloaltonetworks.com/cortex-xdr-agent/5.0/traps-app-5.0-for-android.md) * [Traps for Android Requirements](https://cortex-docs.paloaltonetworks.com/cortex-xdr-agent/5.0/traps-app-5.0-for-android/traps-for-android-requirements.md) * [Install Traps App for Android](https://cortex-docs.paloaltonetworks.com/cortex-xdr-agent/5.0/traps-app-5.0-for-android/install-traps-app-for-android.md): Use this workflow to install Traps 5.0 for Android. * [Use Traps for Android](https://cortex-docs.paloaltonetworks.com/cortex-xdr-agent/5.0/traps-app-5.0-for-android/use-traps-for-android.md) * [Troubleshoot Traps for Android](https://cortex-docs.paloaltonetworks.com/cortex-xdr-agent/5.0/traps-app-5.0-for-android/troubleshoot-traps-for-android.md) ## Cortex XDR Agent iOS Guides - [Cortex XDR Agent iOS Guides](https://cortex-docs.paloaltonetworks.com/cortex-xdr-agent-ios-guide/cortex-xdr-agent-ios-guides.md) * [Get Started](https://cortex-docs.paloaltonetworks.com/cortex-xdr-agent-ios-guide/9.3/get-started.md): Learn more about the Cortex XDR Agent app for iOS. * [Cortex XDR Agent App for iOS Overview](https://cortex-docs.paloaltonetworks.com/cortex-xdr-agent-ios-guide/9.3/get-started/cortex-xdr-agent-app-for-ios-overview.md): Learn about deploying and configuring the Cortex XDR agent app for iOS on iOS-based endpoints. * [Release Notes for Cortex XDR Agent App for iOS](https://cortex-docs.paloaltonetworks.com/cortex-xdr-agent-ios-guide/9.3/get-started/release-notes-for-cortex-xdr-agent-app-for-ios.md) * [Cortex XDR Agent App for iOS Requirements](https://cortex-docs.paloaltonetworks.com/cortex-xdr-agent-ios-guide/9.3/get-started/cortex-xdr-agent-app-for-ios-requirements.md): Learn about requirements for the Cortex XDR Agent app for iOS. * [Administrator Tasks](https://cortex-docs.paloaltonetworks.com/cortex-xdr-agent-ios-guide/9.3/administrator-tasks.md) * [Prepare for Installation (Administrator Task)](https://cortex-docs.paloaltonetworks.com/cortex-xdr-agent-ios-guide/9.3/administrator-tasks/prepare-for-installation-administrator-task.md): Learn about the Administrator’s tasks required to prepare for installation of the Cortex XDR Agent app for iOS. * [Add a Malware Prevention Profile (Administrator Task)](https://cortex-docs.paloaltonetworks.com/cortex-xdr-agent-ios-guide/9.3/administrator-tasks/add-a-malware-prevention-profile-administrator-task.md): From the Cortex XDR or XSIAM tenant, you can configure the action that Cortex XDR agents on iOS devices take for known malicious URLs and spam numbers. You can also configure granular control and moni * [Add an Agent Settings Prevention Profile (Administrator Task)](https://cortex-docs.paloaltonetworks.com/cortex-xdr-agent-ios-guide/9.3/administrator-tasks/add-an-agent-settings-prevention-profile-administrator-task.md): You can use Agent Settings prevention profiles to customize Cortex XDR agent settings for different platforms and groups of users. * [Configuration for Installation by MDM (Administrator Task)](https://cortex-docs.paloaltonetworks.com/cortex-xdr-agent-ios-guide/9.3/administrator-tasks/configuration-for-installation-by-mdm-administrator-task.md): Instructions to configure the Cortex XDR iOS app by MDM. * [Configure Network Filtering on Supervised Devices (Administrator Task)](https://cortex-docs.paloaltonetworks.com/cortex-xdr-agent-ios-guide/9.3/administrator-tasks/configuration-for-installation-by-mdm-administrator-task/configure-network-filtering-on-supervised-devices-administrator-task.md) * [Configuring iOS Network Filter Profile in Workspace ONE UEM](https://cortex-docs.paloaltonetworks.com/cortex-xdr-agent-ios-guide/9.3/administrator-tasks/configuration-for-installation-by-mdm-administrator-task/configuring-ios-network-filter-profile-in-workspace-one-uem.md) * [Configuration for Installation by JAMF (Administrator Task)](https://cortex-docs.paloaltonetworks.com/cortex-xdr-agent-ios-guide/9.3/administrator-tasks/configuration-for-installation-by-mdm-administrator-task/configuration-for-installation-by-jamf-administrator-task.md) * [Install the Cortex XDR agent app on iOS using Microsoft Intune](https://cortex-docs.paloaltonetworks.com/cortex-xdr-agent-ios-guide/9.3/administrator-tasks/install-the-cortex-xdr-agent-app-on-ios-using-microsoft-intune.md) * [Device User Tasks](https://cortex-docs.paloaltonetworks.com/cortex-xdr-agent-ios-guide/9.3/device-user-tasks.md) * [Install Cortex XDR Agent iOS App on the iOS Device](https://cortex-docs.paloaltonetworks.com/cortex-xdr-agent-ios-guide/9.3/device-user-tasks/install-cortex-xdr-agent-ios-app-on-the-ios-device.md): Use this workflow to install Cortex XDR Agent for iOS on your device. * [Configure Phone Call Blocking](https://cortex-docs.paloaltonetworks.com/cortex-xdr-agent-ios-guide/9.3/device-user-tasks/configure-phone-call-blocking.md): Learn how to configure phone call blocking on iPhones, using the Cortex XDR agent app for iOS. * [Configure Message and Call Reporting](https://cortex-docs.paloaltonetworks.com/cortex-xdr-agent-ios-guide/9.3/device-user-tasks/configure-message-and-call-reporting.md): Learn how to enable your iPhone to report spam messages. * [Check Links before Clicking or Using Them](https://cortex-docs.paloaltonetworks.com/cortex-xdr-agent-ios-guide/9.3/device-user-tasks/check-links-before-clicking-or-using-them.md): Check that links aren't malicious before clicking or using them. * [Report Spam Messages](https://cortex-docs.paloaltonetworks.com/cortex-xdr-agent-ios-guide/9.3/device-user-tasks/report-spam-messages.md): Learn how to enable your device to report spam messages from unknown senders. * [Check Your Device](https://cortex-docs.paloaltonetworks.com/cortex-xdr-agent-ios-guide/9.3/device-user-tasks/check-your-device.md): Learn about checking Cortex XDR agent app activity on your iOS device. * [View Security Events](https://cortex-docs.paloaltonetworks.com/cortex-xdr-agent-ios-guide/9.3/device-user-tasks/view-security-events.md): Learn how to view the security events identified by the Cortex XDR Agent app installed on your iOS device. * [View and Modify Use of Security Modules](https://cortex-docs.paloaltonetworks.com/cortex-xdr-agent-ios-guide/9.3/device-user-tasks/view-and-modify-use-of-security-modules.md): View and modify the use of security modules used by your device's Cortex XDR app. * [View Device and App Status and Information](https://cortex-docs.paloaltonetworks.com/cortex-xdr-agent-ios-guide/9.3/device-user-tasks/view-device-and-app-status-and-information.md) * [View Device Information](https://cortex-docs.paloaltonetworks.com/cortex-xdr-agent-ios-guide/9.3/device-user-tasks/view-device-and-app-status-and-information/view-device-information.md): Learn how to view Cortex XDR agent app for iOS device endpoint information. * [View Connection](https://cortex-docs.paloaltonetworks.com/cortex-xdr-agent-ios-guide/9.3/device-user-tasks/view-device-and-app-status-and-information/view-connection.md): View general and connection information for your Cortex XDR agent app for iOS. * [Using the Cortex XDR iOS Widgets](https://cortex-docs.paloaltonetworks.com/cortex-xdr-agent-ios-guide/9.3/device-user-tasks/view-device-and-app-status-and-information/using-the-cortex-xdr-ios-widgets.md): Learn how to use the Cortex XDR widgets on your iOS device. * [Troubleshooting](https://cortex-docs.paloaltonetworks.com/cortex-xdr-agent-ios-guide/9.3/device-user-tasks/troubleshooting.md): Learn about troubleshooting issues with the Cortex XDR Agent app for iOS. * [Send Logs](https://cortex-docs.paloaltonetworks.com/cortex-xdr-agent-ios-guide/9.3/device-user-tasks/troubleshooting/send-logs.md): Learn how to send logs from the Cortex XDR Agent app for iOS to Palo Alto Networks for analysis. - [Get Started](https://cortex-docs.paloaltonetworks.com/cortex-xdr-agent-ios-guide/9.2/get-started.md): Learn more about the Cortex XDR Agent app for iOS. The Cortex XDR Agent app enforces your organization’s security policy on iOS-based endpoints, as defined in Cortex XDR or Cortex XSIAM. - [Cortex XDR Agent App for iOS Overview](https://cortex-docs.paloaltonetworks.com/cortex-xdr-agent-ios-guide/9.2/get-started/cortex-xdr-agent-app-for-ios-overview.md): Learn about deploying and configuring the Cortex XDR agent app for iOS on iOS-based endpoints. - [Release Notes for Cortex XDR Agent App for iOS](https://cortex-docs.paloaltonetworks.com/cortex-xdr-agent-ios-guide/9.2/get-started/release-notes-for-cortex-xdr-agent-app-for-ios.md) - [Cortex XDR Agent App for iOS Requirements](https://cortex-docs.paloaltonetworks.com/cortex-xdr-agent-ios-guide/9.2/get-started/cortex-xdr-agent-app-for-ios-requirements.md): Learn about requirements for the Cortex XDR Agent app for iOS. - [Administrator Tasks](https://cortex-docs.paloaltonetworks.com/cortex-xdr-agent-ios-guide/9.2/administrator-tasks.md): The tasks in this section are performed by the Cortex XDR or Cortex XSIAM administrator. - [Prepare for Installation (Administrator Task)](https://cortex-docs.paloaltonetworks.com/cortex-xdr-agent-ios-guide/9.2/administrator-tasks/prepare-for-installation-administrator-task.md): Learn about the Administrator’s tasks required to prepare for installation of the Cortex XDR Agent app for iOS. - [Add a Malware Prevention Profile (Administrator Task)](https://cortex-docs.paloaltonetworks.com/cortex-xdr-agent-ios-guide/9.2/administrator-tasks/prepare-for-installation-administrator-task/add-a-malware-prevention-profile-administrator-task.md): From the Cortex XDR or XSIAM tenant, you can configure the action that Cortex XDR agents on iOS devices take for known malicious URLs and spam numbers. You can also configure granular control and moni - [Add an Agent Settings Prevention Profile (Administrator Task)](https://cortex-docs.paloaltonetworks.com/cortex-xdr-agent-ios-guide/9.2/administrator-tasks/prepare-for-installation-administrator-task/add-an-agent-settings-prevention-profile-administrator-task.md): You can use Agent Settings prevention profiles to customize Cortex XDR agent settings for different platforms and groups of users. - [Configuration for Installation by MDM (Administrator Task)](https://cortex-docs.paloaltonetworks.com/cortex-xdr-agent-ios-guide/9.2/administrator-tasks/prepare-for-installation-administrator-task/configuration-for-installation-by-mdm-administrator-task.md): Instructions to configure the Cortex XDR iOS app by MDM. - [Configure Network Filtering on Supervised Devices (Administrator Task)](https://cortex-docs.paloaltonetworks.com/cortex-xdr-agent-ios-guide/9.2/administrator-tasks/prepare-for-installation-administrator-task/configuration-for-installation-by-mdm-administrator-task/configure-network-filtering-on-supervised-devices-administrator-task.md) - [Configuration for Installation by JAMF (Administrator Task)](https://cortex-docs.paloaltonetworks.com/cortex-xdr-agent-ios-guide/9.2/administrator-tasks/prepare-for-installation-administrator-task/configuration-for-installation-by-mdm-administrator-task/configuration-for-installation-by-jamf-administrator-task.md) - [Install the Cortex XDR agent app on iOS using Microsoft Intune](https://cortex-docs.paloaltonetworks.com/cortex-xdr-agent-ios-guide/9.2/administrator-tasks/prepare-for-installation-administrator-task/install-the-cortex-xdr-agent-app-on-ios-using-microsoft-intune.md) - [Device User Tasks](https://cortex-docs.paloaltonetworks.com/cortex-xdr-agent-ios-guide/9.2/device-user-tasks.md): The tasks in this section are performed by the iOS device user. - [Install Cortex XDR Agent iOS App on the iOS Device](https://cortex-docs.paloaltonetworks.com/cortex-xdr-agent-ios-guide/9.2/device-user-tasks/install-cortex-xdr-agent-ios-app-on-the-ios-device.md): Use this workflow to install Cortex XDR Agent for iOS on your device. - [Configure Phone Call Blocking](https://cortex-docs.paloaltonetworks.com/cortex-xdr-agent-ios-guide/9.2/device-user-tasks/configure-phone-call-blocking.md): Learn how to configure phone call blocking on iPhones, using the Cortex XDR agent app for iOS. - [Configure Message and Call Reporting](https://cortex-docs.paloaltonetworks.com/cortex-xdr-agent-ios-guide/9.2/device-user-tasks/configure-message-and-call-reporting.md): Learn how to enable your iPhone to report spam messages. - [Check Links before Clicking or Using Them](https://cortex-docs.paloaltonetworks.com/cortex-xdr-agent-ios-guide/9.2/device-user-tasks/check-links-before-clicking-or-using-them.md): Check that links aren't malicious before clicking or using them. - [Report Spam Messages](https://cortex-docs.paloaltonetworks.com/cortex-xdr-agent-ios-guide/9.2/device-user-tasks/report-spam-messages.md): Learn how to enable your device to report spam messages from unknown senders. - [Check Your Device](https://cortex-docs.paloaltonetworks.com/cortex-xdr-agent-ios-guide/9.2/device-user-tasks/check-your-device.md): Learn about checking Cortex XDR agent app activity on your iOS device. - [View Security Events](https://cortex-docs.paloaltonetworks.com/cortex-xdr-agent-ios-guide/9.2/device-user-tasks/view-security-events.md): Learn how to view the security events identified by the Cortex XDR Agent app installed on your iOS device. - [View and Modify Use of Security Modules](https://cortex-docs.paloaltonetworks.com/cortex-xdr-agent-ios-guide/9.2/device-user-tasks/view-and-modify-use-of-security-modules.md): View and modify the use of security modules used by your device's Cortex XDR app. - [View Device and App Status and Information](https://cortex-docs.paloaltonetworks.com/cortex-xdr-agent-ios-guide/9.2/device-user-tasks/view-device-and-app-status-and-information.md) - [View Device Information](https://cortex-docs.paloaltonetworks.com/cortex-xdr-agent-ios-guide/9.2/device-user-tasks/view-device-and-app-status-and-information/view-device-information.md): Learn how to view Cortex XDR agent app for iOS device endpoint information. - [View Connection](https://cortex-docs.paloaltonetworks.com/cortex-xdr-agent-ios-guide/9.2/device-user-tasks/view-device-and-app-status-and-information/view-connection.md): View general and connection information for your Cortex XDR agent app for iOS. - [Using the Cortex XDR iOS Widgets](https://cortex-docs.paloaltonetworks.com/cortex-xdr-agent-ios-guide/9.2/device-user-tasks/view-device-and-app-status-and-information/using-the-cortex-xdr-ios-widgets.md): Learn how to use the Cortex XDR widgets on your iOS device. - [Troubleshooting](https://cortex-docs.paloaltonetworks.com/cortex-xdr-agent-ios-guide/9.2/device-user-tasks/troubleshooting.md): Learn about troubleshooting issues with the Cortex XDR Agent app for iOS. - [Send Logs](https://cortex-docs.paloaltonetworks.com/cortex-xdr-agent-ios-guide/9.2/device-user-tasks/troubleshooting/send-logs.md): Learn how to send logs from the Cortex XDR Agent app for iOS to Palo Alto Networks for analysis. * [Get Started](https://cortex-docs.paloaltonetworks.com/cortex-xdr-agent-ios-guide/9.1/get-started.md): Learn more about the Cortex XDR Agent app for iOS. The Cortex XDR Agent app enforces your organization’s security policy on iOS-based endpoints, as defined in Cortex XDR or Cortex XSIAM. * [Cortex XDR Agent App for iOS Overview](https://cortex-docs.paloaltonetworks.com/cortex-xdr-agent-ios-guide/9.1/get-started/cortex-xdr-agent-app-for-ios-overview.md): Learn about deploying and configuring the Cortex XDR agent app for iOS on iOS-based endpoints. * [Release Notes for Cortex XDR Agent App for iOS](https://cortex-docs.paloaltonetworks.com/cortex-xdr-agent-ios-guide/9.1/get-started/release-notes-for-cortex-xdr-agent-app-for-ios.md) * [Cortex XDR Agent App for iOS Requirements](https://cortex-docs.paloaltonetworks.com/cortex-xdr-agent-ios-guide/9.1/get-started/cortex-xdr-agent-app-for-ios-requirements.md): Learn about requirements for the Cortex XDR Agent app for iOS. * [Administrator Tasks](https://cortex-docs.paloaltonetworks.com/cortex-xdr-agent-ios-guide/9.1/administrator-tasks.md): The tasks in this section are performed by the Cortex XDR or Cortex XSIAM administrator. * [Prepare for Installation (Administrator Task)](https://cortex-docs.paloaltonetworks.com/cortex-xdr-agent-ios-guide/9.1/administrator-tasks/prepare-for-installation-administrator-task.md): Learn about the Administrator’s tasks required to prepare for installation of the Cortex XDR Agent app for iOS. * [Add a Malware Prevention Profile (Administrator Task)](https://cortex-docs.paloaltonetworks.com/cortex-xdr-agent-ios-guide/9.1/administrator-tasks/prepare-for-installation-administrator-task/add-a-malware-prevention-profile-administrator-task.md): From the Cortex XDR or XSIAM tenant, you can configure the action that Cortex XDR agents on iOS devices take for known malicious URLs and spam numbers. You can also configure granular control and moni * [Add an Agent Settings Prevention Profile (Administrator Task)](https://cortex-docs.paloaltonetworks.com/cortex-xdr-agent-ios-guide/9.1/administrator-tasks/prepare-for-installation-administrator-task/add-an-agent-settings-prevention-profile-administrator-task.md): You can use Agent Settings prevention profiles to customize Cortex XDR agent settings for different platforms and groups of users. * [Configuration for Installation by MDM (Administrator Task)](https://cortex-docs.paloaltonetworks.com/cortex-xdr-agent-ios-guide/9.1/administrator-tasks/prepare-for-installation-administrator-task/configuration-for-installation-by-mdm-administrator-task.md): Instructions to configure the Cortex XDR iOS app by MDM. * [Install the Cortex XDR agent app on iOS using Microsoft Intune](https://cortex-docs.paloaltonetworks.com/cortex-xdr-agent-ios-guide/9.1/administrator-tasks/prepare-for-installation-administrator-task/install-the-cortex-xdr-agent-app-on-ios-using-microsoft-intune.md) * [Device User Tasks](https://cortex-docs.paloaltonetworks.com/cortex-xdr-agent-ios-guide/9.1/device-user-tasks.md): The tasks in this section are performed by the iOS device user. * [Install Cortex XDR Agent iOS App on the iOS Device](https://cortex-docs.paloaltonetworks.com/cortex-xdr-agent-ios-guide/9.1/device-user-tasks/install-cortex-xdr-agent-ios-app-on-the-ios-device.md): Use this workflow to install Cortex XDR Agent for iOS on your device. * [Configure Phone Call Blocking](https://cortex-docs.paloaltonetworks.com/cortex-xdr-agent-ios-guide/9.1/device-user-tasks/configure-phone-call-blocking.md): Learn how to configure phone call blocking on iPhones, using the Cortex XDR agent app for iOS. * [Configure Message and Call Reporting](https://cortex-docs.paloaltonetworks.com/cortex-xdr-agent-ios-guide/9.1/device-user-tasks/configure-message-and-call-reporting.md): Learn how to enable your iPhone to report spam messages. * [Check Links before Clicking or Using Them](https://cortex-docs.paloaltonetworks.com/cortex-xdr-agent-ios-guide/9.1/device-user-tasks/check-links-before-clicking-or-using-them.md): Check that links aren't malicious before clicking or using them. * [Report Spam Messages](https://cortex-docs.paloaltonetworks.com/cortex-xdr-agent-ios-guide/9.1/device-user-tasks/report-spam-messages.md): Learn how to enable your device to report spam messages from unknown senders. * [Check Your Device](https://cortex-docs.paloaltonetworks.com/cortex-xdr-agent-ios-guide/9.1/device-user-tasks/check-your-device.md): Learn about checking Cortex XDR agent app activity on your iOS device. * [View Security Events](https://cortex-docs.paloaltonetworks.com/cortex-xdr-agent-ios-guide/9.1/device-user-tasks/view-security-events.md): Learn how to view the security events identified by the Cortex XDR Agent app installed on your iOS device. * [View and Modify Use of Security Modules](https://cortex-docs.paloaltonetworks.com/cortex-xdr-agent-ios-guide/9.1/device-user-tasks/view-and-modify-use-of-security-modules.md): View and modify the use of security modules used by your device's Cortex XDR app. * [View Device and App Status and Information](https://cortex-docs.paloaltonetworks.com/cortex-xdr-agent-ios-guide/9.1/device-user-tasks/view-device-and-app-status-and-information.md) * [View Device Information](https://cortex-docs.paloaltonetworks.com/cortex-xdr-agent-ios-guide/9.1/device-user-tasks/view-device-and-app-status-and-information/view-device-information.md): Learn how to view Cortex XDR agent app for iOS device endpoint information. * [View Connection](https://cortex-docs.paloaltonetworks.com/cortex-xdr-agent-ios-guide/9.1/device-user-tasks/view-device-and-app-status-and-information/view-connection.md): View general and connection information for your Cortex XDR agent app for iOS. * [Using the Cortex XDR iOS Widgets](https://cortex-docs.paloaltonetworks.com/cortex-xdr-agent-ios-guide/9.1/device-user-tasks/view-device-and-app-status-and-information/using-the-cortex-xdr-ios-widgets.md): Learn how to use the Cortex XDR widgets on your iOS device. * [Troubleshooting](https://cortex-docs.paloaltonetworks.com/cortex-xdr-agent-ios-guide/9.1/device-user-tasks/troubleshooting.md): Learn about troubleshooting issues with the Cortex XDR Agent app for iOS. * [Send Logs](https://cortex-docs.paloaltonetworks.com/cortex-xdr-agent-ios-guide/9.1/device-user-tasks/troubleshooting/send-logs.md): Learn how to send logs from the Cortex XDR Agent app for iOS to Palo Alto Networks for analysis. - [Get Started](https://cortex-docs.paloaltonetworks.com/cortex-xdr-agent-ios-guide/9.0/get-started.md): Learn more about the Cortex XDR Agent app for iOS. The Cortex XDR Agent app enforces your organization’s security policy on iOS-based endpoints, as defined in Cortex XDR or Cortex XSIAM. - [Cortex XDR Agent App for iOS Overview](https://cortex-docs.paloaltonetworks.com/cortex-xdr-agent-ios-guide/9.0/get-started/cortex-xdr-agent-app-for-ios-overview.md): Learn about deploying and configuring the Cortex XDR agent app for iOS on iOS-based endpoints. - [Release Notes for Cortex XDR Agent App for iOS](https://cortex-docs.paloaltonetworks.com/cortex-xdr-agent-ios-guide/9.0/get-started/release-notes-for-cortex-xdr-agent-app-for-ios.md) - [Cortex XDR Agent App for iOS Requirements](https://cortex-docs.paloaltonetworks.com/cortex-xdr-agent-ios-guide/9.0/get-started/cortex-xdr-agent-app-for-ios-requirements.md): Learn about requirements for the Cortex XDR Agent app for iOS. - [Administrator Tasks](https://cortex-docs.paloaltonetworks.com/cortex-xdr-agent-ios-guide/9.0/administrator-tasks.md): The tasks in this section are performed by the Cortex XDR or Cortex XSIAM administrator. - [Prepare for Installation (Administrator Task)](https://cortex-docs.paloaltonetworks.com/cortex-xdr-agent-ios-guide/9.0/administrator-tasks/prepare-for-installation-administrator-task.md): Learn about the Administrator’s tasks required to prepare for installation of the Cortex XDR Agent app for iOS. - [Add a Malware Prevention Profile (Administrator Task)](https://cortex-docs.paloaltonetworks.com/cortex-xdr-agent-ios-guide/9.0/administrator-tasks/prepare-for-installation-administrator-task/add-a-malware-prevention-profile-administrator-task.md): From the Cortex XDR or XSIAM tenant, you can configure the action that Cortex XDR agents on iOS devices take for known malicious URLs and spam numbers. You can also configure granular control and moni - [Add an Agent Settings Prevention Profile (Administrator Task)](https://cortex-docs.paloaltonetworks.com/cortex-xdr-agent-ios-guide/9.0/administrator-tasks/prepare-for-installation-administrator-task/add-an-agent-settings-prevention-profile-administrator-task.md): You can use Agent Settings prevention profiles to customize Cortex XDR agent settings for different platforms and groups of users. - [Configuration for Installation by MDM (Administrator Task)](https://cortex-docs.paloaltonetworks.com/cortex-xdr-agent-ios-guide/9.0/administrator-tasks/prepare-for-installation-administrator-task/configuration-for-installation-by-mdm-administrator-task.md): Instructions to configure the Cortex XDR iOS app by MDM. - [Install the Cortex XDR agent app on iOS using Microsoft Intune](https://cortex-docs.paloaltonetworks.com/cortex-xdr-agent-ios-guide/9.0/administrator-tasks/prepare-for-installation-administrator-task/install-the-cortex-xdr-agent-app-on-ios-using-microsoft-intune.md) - [Device User Tasks](https://cortex-docs.paloaltonetworks.com/cortex-xdr-agent-ios-guide/9.0/device-user-tasks.md): The tasks in this section are performed by the iOS device user. - [Install Cortex XDR Agent iOS App on the iOS Device](https://cortex-docs.paloaltonetworks.com/cortex-xdr-agent-ios-guide/9.0/device-user-tasks/install-cortex-xdr-agent-ios-app-on-the-ios-device.md): Use this workflow to install Cortex XDR Agent for iOS on your device. - [Configure Phone Call Blocking](https://cortex-docs.paloaltonetworks.com/cortex-xdr-agent-ios-guide/9.0/device-user-tasks/configure-phone-call-blocking.md): Learn how to configure phone call blocking on iPhones, using the Cortex XDR agent app for iOS. - [Configure Message and Call Reporting](https://cortex-docs.paloaltonetworks.com/cortex-xdr-agent-ios-guide/9.0/device-user-tasks/configure-message-and-call-reporting.md): Learn how to enable your iPhone to report spam messages. - [Check Links before Clicking or Using Them](https://cortex-docs.paloaltonetworks.com/cortex-xdr-agent-ios-guide/9.0/device-user-tasks/check-links-before-clicking-or-using-them.md): Check that links aren't malicious before clicking or using them. - [Report Spam Messages](https://cortex-docs.paloaltonetworks.com/cortex-xdr-agent-ios-guide/9.0/device-user-tasks/report-spam-messages.md): Learn how to enable your device to report spam messages from unknown senders. - [Check Your Device](https://cortex-docs.paloaltonetworks.com/cortex-xdr-agent-ios-guide/9.0/device-user-tasks/check-your-device.md): Learn about checking Cortex XDR agent app activity on your iOS device. - [View Security Events](https://cortex-docs.paloaltonetworks.com/cortex-xdr-agent-ios-guide/9.0/device-user-tasks/view-security-events.md): Learn how to view the security events identified by the Cortex XDR Agent app installed on your iOS device. - [View and Modify Use of Security Modules](https://cortex-docs.paloaltonetworks.com/cortex-xdr-agent-ios-guide/9.0/device-user-tasks/view-and-modify-use-of-security-modules.md): View and modify the use of security modules used by your device's Cortex XDR app. - [View Device and App Status and Information](https://cortex-docs.paloaltonetworks.com/cortex-xdr-agent-ios-guide/9.0/device-user-tasks/view-device-and-app-status-and-information.md) - [View Device Information](https://cortex-docs.paloaltonetworks.com/cortex-xdr-agent-ios-guide/9.0/device-user-tasks/view-device-and-app-status-and-information/view-device-information.md): Learn how to view Cortex XDR agent app for iOS device endpoint information. - [View Connection](https://cortex-docs.paloaltonetworks.com/cortex-xdr-agent-ios-guide/9.0/device-user-tasks/view-device-and-app-status-and-information/view-connection.md): View general and connection information for your Cortex XDR agent app for iOS. - [Using the Cortex XDR iOS Widgets](https://cortex-docs.paloaltonetworks.com/cortex-xdr-agent-ios-guide/9.0/device-user-tasks/view-device-and-app-status-and-information/using-the-cortex-xdr-ios-widgets.md): Learn how to use the Cortex XDR widgets on your iOS device. - [Troubleshooting](https://cortex-docs.paloaltonetworks.com/cortex-xdr-agent-ios-guide/9.0/device-user-tasks/troubleshooting.md): Learn about troubleshooting issues with the Cortex XDR Agent app for iOS. - [Send Logs](https://cortex-docs.paloaltonetworks.com/cortex-xdr-agent-ios-guide/9.0/device-user-tasks/troubleshooting/send-logs.md): Learn how to send logs from the Cortex XDR Agent app for iOS to Palo Alto Networks for analysis. * [Get Started](https://cortex-docs.paloaltonetworks.com/cortex-xdr-agent-ios-guide/8.9-agent-ios-guide/get-started.md): Learn more about the Cortex XDR Agent app for iOS. The Cortex XDR Agent app enforces your organization’s security policy on iOS-based endpoints, as defined in Cortex XDR or Cortex XSIAM. * [Cortex XDR Agent App for iOS Overview](https://cortex-docs.paloaltonetworks.com/cortex-xdr-agent-ios-guide/8.9-agent-ios-guide/get-started/cortex-xdr-agent-app-for-ios-overview.md): Learn about deploying and configuring the Cortex XDR agent app for iOS on iOS-based endpoints. * [Release Notes for Cortex XDR Agent App for iOS](https://cortex-docs.paloaltonetworks.com/cortex-xdr-agent-ios-guide/8.9-agent-ios-guide/get-started/release-notes-for-cortex-xdr-agent-app-for-ios.md) * [Cortex XDR Agent App for iOS Requirements](https://cortex-docs.paloaltonetworks.com/cortex-xdr-agent-ios-guide/8.9-agent-ios-guide/get-started/cortex-xdr-agent-app-for-ios-requirements.md): Learn about requirements for the Cortex XDR Agent app for iOS. * [Administrator Tasks](https://cortex-docs.paloaltonetworks.com/cortex-xdr-agent-ios-guide/8.9-agent-ios-guide/administrator-tasks.md): The tasks in this section are performed by the Cortex XDR or Cortex XSIAM administrator. * [Prepare for Installation (Administrator Task)](https://cortex-docs.paloaltonetworks.com/cortex-xdr-agent-ios-guide/8.9-agent-ios-guide/administrator-tasks/prepare-for-installation-administrator-task.md): Learn about the Administrator’s tasks required to prepare for installation of the Cortex XDR Agent app for iOS. * [Add a Malware Prevention Profile (Administrator Task)](https://cortex-docs.paloaltonetworks.com/cortex-xdr-agent-ios-guide/8.9-agent-ios-guide/administrator-tasks/prepare-for-installation-administrator-task/add-a-malware-prevention-profile-administrator-task.md): From the Cortex XDR or XSIAM tenant, you can configure the action that Cortex XDR agents on iOS devices take for known malicious URLs and spam numbers. You can also configure granular control and moni * [Add an Agent Settings Prevention Profile (Administrator Task)](https://cortex-docs.paloaltonetworks.com/cortex-xdr-agent-ios-guide/8.9-agent-ios-guide/administrator-tasks/prepare-for-installation-administrator-task/add-an-agent-settings-prevention-profile-administrator-task.md): You can use Agent Settings prevention profiles to customize Cortex XDR agent settings for different platforms and groups of users. * [Configuration for Installation by MDM (Administrator Task)](https://cortex-docs.paloaltonetworks.com/cortex-xdr-agent-ios-guide/8.9-agent-ios-guide/administrator-tasks/prepare-for-installation-administrator-task/configuration-for-installation-by-mdm-administrator-task.md): Instructions to configure the Cortex XDR iOS app by MDM. * [Device User Tasks](https://cortex-docs.paloaltonetworks.com/cortex-xdr-agent-ios-guide/8.9-agent-ios-guide/device-user-tasks.md): The tasks in this section are performed by the iOS device user. * [Install Cortex XDR Agent iOS App on the iOS Device](https://cortex-docs.paloaltonetworks.com/cortex-xdr-agent-ios-guide/8.9-agent-ios-guide/device-user-tasks/install-cortex-xdr-agent-ios-app-on-the-ios-device.md): Use this workflow to install Cortex XDR Agent for iOS on your device. * [Configure Phone Call Blocking](https://cortex-docs.paloaltonetworks.com/cortex-xdr-agent-ios-guide/8.9-agent-ios-guide/device-user-tasks/configure-phone-call-blocking.md): Learn how to configure phone call blocking on iPhones, using the Cortex XDR agent app for iOS. * [Configure Message and Call Reporting](https://cortex-docs.paloaltonetworks.com/cortex-xdr-agent-ios-guide/8.9-agent-ios-guide/device-user-tasks/configure-message-and-call-reporting.md): Learn how to enable your iPhone to report spam messages. * [Check Links before Clicking or Using Them](https://cortex-docs.paloaltonetworks.com/cortex-xdr-agent-ios-guide/8.9-agent-ios-guide/device-user-tasks/check-links-before-clicking-or-using-them.md): Check that links aren't malicious before clicking or using them. * [Report Spam Messages](https://cortex-docs.paloaltonetworks.com/cortex-xdr-agent-ios-guide/8.9-agent-ios-guide/device-user-tasks/report-spam-messages.md): Learn how to enable your device to report spam messages from unknown senders. * [Check Your Device](https://cortex-docs.paloaltonetworks.com/cortex-xdr-agent-ios-guide/8.9-agent-ios-guide/device-user-tasks/check-your-device.md): Learn about checking Cortex XDR agent app activity on your iOS device. * [View Security Events](https://cortex-docs.paloaltonetworks.com/cortex-xdr-agent-ios-guide/8.9-agent-ios-guide/device-user-tasks/view-security-events.md): Learn how to view the security events identified by the Cortex XDR Agent app installed on your iOS device. * [View and Modify Use of Security Modules](https://cortex-docs.paloaltonetworks.com/cortex-xdr-agent-ios-guide/8.9-agent-ios-guide/device-user-tasks/view-and-modify-use-of-security-modules.md): View and modify the use of security modules used by your device's Cortex XDR app. * [View Device and App Status and Information](https://cortex-docs.paloaltonetworks.com/cortex-xdr-agent-ios-guide/8.9-agent-ios-guide/device-user-tasks/view-device-and-app-status-and-information.md) * [View Device Information](https://cortex-docs.paloaltonetworks.com/cortex-xdr-agent-ios-guide/8.9-agent-ios-guide/device-user-tasks/view-device-and-app-status-and-information/view-device-information.md): Learn how to view Cortex XDR agent app for iOS device endpoint information. * [View Connection](https://cortex-docs.paloaltonetworks.com/cortex-xdr-agent-ios-guide/8.9-agent-ios-guide/device-user-tasks/view-device-and-app-status-and-information/view-connection.md): View general and connection information for your Cortex XDR agent app for iOS. * [Using the Cortex XDR iOS Widgets](https://cortex-docs.paloaltonetworks.com/cortex-xdr-agent-ios-guide/8.9-agent-ios-guide/device-user-tasks/view-device-and-app-status-and-information/using-the-cortex-xdr-ios-widgets.md): Learn how to use the Cortex XDR widgets on your iOS device. * [Troubleshooting](https://cortex-docs.paloaltonetworks.com/cortex-xdr-agent-ios-guide/8.9-agent-ios-guide/device-user-tasks/troubleshooting.md): Learn about troubleshooting issues with the Cortex XDR Agent app for iOS. * [Send Logs](https://cortex-docs.paloaltonetworks.com/cortex-xdr-agent-ios-guide/8.9-agent-ios-guide/device-user-tasks/troubleshooting/send-logs.md): Learn how to send logs from the Cortex XDR Agent app for iOS to Palo Alto Networks for analysis. - [Get Started](https://cortex-docs.paloaltonetworks.com/cortex-xdr-agent-ios-guide/8.8/get-started.md): Learn more about the Cortex XDR Agent app for iOS. The Cortex XDR Agent app enforces your organization’s security policy on iOS-based endpoints, as defined in Cortex XDR or Cortex XSIAM. - [Cortex XDR Agent App for iOS Overview](https://cortex-docs.paloaltonetworks.com/cortex-xdr-agent-ios-guide/8.8/get-started/cortex-xdr-agent-app-for-ios-overview.md): Learn about deploying and configuring the Cortex XDR agent app for iOS on iOS-based endpoints. - [Release Notes for Cortex XDR Agent App for iOS](https://cortex-docs.paloaltonetworks.com/cortex-xdr-agent-ios-guide/8.8/get-started/release-notes-for-cortex-xdr-agent-app-for-ios.md) - [Cortex XDR Agent App for iOS Requirements](https://cortex-docs.paloaltonetworks.com/cortex-xdr-agent-ios-guide/8.8/get-started/cortex-xdr-agent-app-for-ios-requirements.md): Learn about requirements for the Cortex XDR Agent app for iOS. - [Administrator Tasks](https://cortex-docs.paloaltonetworks.com/cortex-xdr-agent-ios-guide/8.8/administrator-tasks.md): The tasks in this section are performed by the Cortex XDR or Cortex XSIAM administrator. - [Prepare for Installation (Administrator Task)](https://cortex-docs.paloaltonetworks.com/cortex-xdr-agent-ios-guide/8.8/administrator-tasks/prepare-for-installation-administrator-task.md): Learn about the Administrator’s tasks required to prepare for installation of the Cortex XDR Agent app for iOS. - [Add a Malware Prevention Profile (Administrator Task)](https://cortex-docs.paloaltonetworks.com/cortex-xdr-agent-ios-guide/8.8/administrator-tasks/prepare-for-installation-administrator-task/add-a-malware-prevention-profile-administrator-task.md): From the Cortex XDR or XSIAM tenant, you can configure the action that Cortex XDR agents on iOS devices take for known malicious URLs and spam numbers. You can also configure granular control and moni - [Add an Agent Settings Prevention Profile (Administrator Task)](https://cortex-docs.paloaltonetworks.com/cortex-xdr-agent-ios-guide/8.8/administrator-tasks/prepare-for-installation-administrator-task/add-an-agent-settings-prevention-profile-administrator-task.md): You can use Agent Settings prevention profiles to customize Cortex XDR agent settings for different platforms and groups of users. - [Configuration for Installation by MDM (Administrator Task)](https://cortex-docs.paloaltonetworks.com/cortex-xdr-agent-ios-guide/8.8/administrator-tasks/prepare-for-installation-administrator-task/configuration-for-installation-by-mdm-administrator-task.md): Instructions to configure the Cortex XDR iOS app by MDM. - [Device User Tasks](https://cortex-docs.paloaltonetworks.com/cortex-xdr-agent-ios-guide/8.8/device-user-tasks.md): The tasks in this section are performed by the iOS device user. - [Install Cortex XDR Agent iOS App on the iOS Device](https://cortex-docs.paloaltonetworks.com/cortex-xdr-agent-ios-guide/8.8/device-user-tasks/install-cortex-xdr-agent-ios-app-on-the-ios-device.md): Use this workflow to install Cortex XDR Agent for iOS on your device. - [Configure Phone Call Blocking](https://cortex-docs.paloaltonetworks.com/cortex-xdr-agent-ios-guide/8.8/device-user-tasks/configure-phone-call-blocking.md): Learn how to configure phone call blocking on iPhones, using the Cortex XDR agent app for iOS. - [Configure Message and Call Reporting](https://cortex-docs.paloaltonetworks.com/cortex-xdr-agent-ios-guide/8.8/device-user-tasks/configure-message-and-call-reporting.md): Learn how to enable your iPhone to report spam messages. - [Check Links before Clicking or Using Them](https://cortex-docs.paloaltonetworks.com/cortex-xdr-agent-ios-guide/8.8/device-user-tasks/check-links-before-clicking-or-using-them.md): Check that links aren't malicious before clicking or using them. - [Report Spam Messages](https://cortex-docs.paloaltonetworks.com/cortex-xdr-agent-ios-guide/8.8/device-user-tasks/report-spam-messages.md): Learn how to enable your device to report spam messages from unknown senders. - [Check Your Device](https://cortex-docs.paloaltonetworks.com/cortex-xdr-agent-ios-guide/8.8/device-user-tasks/check-your-device.md): Learn about checking Cortex XDR agent app activity on your iOS device. - [View Security Events](https://cortex-docs.paloaltonetworks.com/cortex-xdr-agent-ios-guide/8.8/device-user-tasks/view-security-events.md): Learn how to view the security events identified by the Cortex XDR Agent app installed on your iOS device. - [View and Modify Use of Security Modules](https://cortex-docs.paloaltonetworks.com/cortex-xdr-agent-ios-guide/8.8/device-user-tasks/view-and-modify-use-of-security-modules.md): View and modify the use of security modules used by your device's Cortex XDR app. - [View Device and App Status and Information](https://cortex-docs.paloaltonetworks.com/cortex-xdr-agent-ios-guide/8.8/device-user-tasks/view-device-and-app-status-and-information.md) - [View Device Information](https://cortex-docs.paloaltonetworks.com/cortex-xdr-agent-ios-guide/8.8/device-user-tasks/view-device-and-app-status-and-information/view-device-information.md): Learn how to view Cortex XDR agent app for iOS device endpoint information. - [View Connection](https://cortex-docs.paloaltonetworks.com/cortex-xdr-agent-ios-guide/8.8/device-user-tasks/view-device-and-app-status-and-information/view-connection.md): View general and connection information for your Cortex XDR agent app for iOS. - [Using the Cortex XDR iOS Widgets](https://cortex-docs.paloaltonetworks.com/cortex-xdr-agent-ios-guide/8.8/device-user-tasks/view-device-and-app-status-and-information/using-the-cortex-xdr-ios-widgets.md): Learn how to use the Cortex XDR widgets on your iOS device. - [Troubleshooting](https://cortex-docs.paloaltonetworks.com/cortex-xdr-agent-ios-guide/8.8/device-user-tasks/troubleshooting.md): Learn about troubleshooting issues with the Cortex XDR Agent app for iOS. - [Send Logs](https://cortex-docs.paloaltonetworks.com/cortex-xdr-agent-ios-guide/8.8/device-user-tasks/troubleshooting/send-logs.md): Learn how to send logs from the Cortex XDR Agent app for iOS to Palo Alto Networks for analysis. * [Get Started](https://cortex-docs.paloaltonetworks.com/cortex-xdr-agent-ios-guide/8.7/get-started.md): Learn more about the Cortex XDR Agent app for iOS. The Cortex XDR Agent app enforces your organization’s security policy on iOS-based endpoints, as defined in Cortex XDR or Cortex XSIAM. * [Cortex XDR Agent App for iOS Overview](https://cortex-docs.paloaltonetworks.com/cortex-xdr-agent-ios-guide/8.7/get-started/cortex-xdr-agent-app-for-ios-overview.md): Learn about deploying and configuring the Cortex XDR agent app for iOS on iOS-based endpoints. * [Release Notes for Cortex XDR Agent App for iOS](https://cortex-docs.paloaltonetworks.com/cortex-xdr-agent-ios-guide/8.7/get-started/release-notes-for-cortex-xdr-agent-app-for-ios.md) * [Cortex XDR Agent App for iOS Requirements](https://cortex-docs.paloaltonetworks.com/cortex-xdr-agent-ios-guide/8.7/get-started/cortex-xdr-agent-app-for-ios-requirements.md): Learn about requirements for the Cortex XDR Agent app for iOS. * [Administrator Tasks](https://cortex-docs.paloaltonetworks.com/cortex-xdr-agent-ios-guide/8.7/administrator-tasks.md): The tasks in this section are performed by the Cortex XDR or Cortex XSIAM administrator. * [Prepare for Installation (Administrator Task)](https://cortex-docs.paloaltonetworks.com/cortex-xdr-agent-ios-guide/8.7/administrator-tasks/prepare-for-installation-administrator-task.md): Learn about the Administrator’s tasks required to prepare for installation of the Cortex XDR Agent app for iOS. * [Add a Malware Prevention Profile (Administrator Task)](https://cortex-docs.paloaltonetworks.com/cortex-xdr-agent-ios-guide/8.7/administrator-tasks/prepare-for-installation-administrator-task/add-a-malware-prevention-profile-administrator-task.md): From the Cortex XDR or XSIAM tenant, you can configure the action that Cortex XDR agents on iOS devices take for known malicious URLs and spam numbers. You can also configure granular control and moni * [Add an Agent Settings Prevention Profile (Administrator Task)](https://cortex-docs.paloaltonetworks.com/cortex-xdr-agent-ios-guide/8.7/administrator-tasks/prepare-for-installation-administrator-task/add-an-agent-settings-prevention-profile-administrator-task.md): You can use Agent Settings prevention profiles to customize Cortex XDR agent settings for different platforms and groups of users. * [Configuration for Installation by MDM (Administrator Task)](https://cortex-docs.paloaltonetworks.com/cortex-xdr-agent-ios-guide/8.7/administrator-tasks/prepare-for-installation-administrator-task/configuration-for-installation-by-mdm-administrator-task.md): Instructions to configure the Cortex XDR iOS app by MDM. * [Device User Tasks](https://cortex-docs.paloaltonetworks.com/cortex-xdr-agent-ios-guide/8.7/device-user-tasks.md): The tasks in this section are performed by the iOS device user. * [Install Cortex XDR Agent iOS App on the iOS Device](https://cortex-docs.paloaltonetworks.com/cortex-xdr-agent-ios-guide/8.7/device-user-tasks/install-cortex-xdr-agent-ios-app-on-the-ios-device.md): Use this workflow to install Cortex XDR Agent for iOS on your device. * [Configure Phone Call Blocking](https://cortex-docs.paloaltonetworks.com/cortex-xdr-agent-ios-guide/8.7/device-user-tasks/configure-phone-call-blocking.md): Learn how to configure phone call blocking on iPhones, using the Cortex XDR agent app for iOS. * [Configure Message and Call Reporting](https://cortex-docs.paloaltonetworks.com/cortex-xdr-agent-ios-guide/8.7/device-user-tasks/configure-message-and-call-reporting.md): Learn how to enable your iPhone to report spam messages. * [Report Spam Messages](https://cortex-docs.paloaltonetworks.com/cortex-xdr-agent-ios-guide/8.7/device-user-tasks/report-spam-messages.md): Learn how to enable your device to report spam messages from unknown senders. * [Check Your Device](https://cortex-docs.paloaltonetworks.com/cortex-xdr-agent-ios-guide/8.7/device-user-tasks/check-your-device.md): Learn about checking Cortex XDR agent app activity on your iOS device. * [View Security Events](https://cortex-docs.paloaltonetworks.com/cortex-xdr-agent-ios-guide/8.7/device-user-tasks/view-security-events.md): Learn how to view the security events identified by the Cortex XDR Agent app installed on your iOS device. * [View and Modify Use of Security Modules](https://cortex-docs.paloaltonetworks.com/cortex-xdr-agent-ios-guide/8.7/device-user-tasks/view-and-modify-use-of-security-modules.md): View and modify the use of security modules used by your device's Cortex XDR app. * [View Device and App Status and Information](https://cortex-docs.paloaltonetworks.com/cortex-xdr-agent-ios-guide/8.7/device-user-tasks/view-device-and-app-status-and-information.md) * [View Device Information](https://cortex-docs.paloaltonetworks.com/cortex-xdr-agent-ios-guide/8.7/device-user-tasks/view-device-and-app-status-and-information/view-device-information.md): Learn how to view Cortex XDR agent app for iOS device endpoint information. * [View Connection](https://cortex-docs.paloaltonetworks.com/cortex-xdr-agent-ios-guide/8.7/device-user-tasks/view-device-and-app-status-and-information/view-connection.md): View general and connection information for your Cortex XDR agent app for iOS. * [Using the Cortex XDR iOS Widgets](https://cortex-docs.paloaltonetworks.com/cortex-xdr-agent-ios-guide/8.7/device-user-tasks/view-device-and-app-status-and-information/using-the-cortex-xdr-ios-widgets.md): Learn how to use the Cortex XDR widgets on your iOS device. * [Troubleshooting](https://cortex-docs.paloaltonetworks.com/cortex-xdr-agent-ios-guide/8.7/device-user-tasks/troubleshooting.md): Learn about troubleshooting issues with the Cortex XDR Agent app for iOS. * [Send Logs](https://cortex-docs.paloaltonetworks.com/cortex-xdr-agent-ios-guide/8.7/device-user-tasks/troubleshooting/send-logs.md): Learn how to send logs from the Cortex XDR Agent app for iOS to Palo Alto Networks for analysis. - [Get Started](https://cortex-docs.paloaltonetworks.com/cortex-xdr-agent-ios-guide/8.6/get-started.md): Learn more about the Cortex XDR Agent app for iOS. The Cortex XDR Agent app enforces your organization’s security policy on iOS-based endpoints, as defined in Cortex XDR or Cortex XSIAM. - [Cortex XDR Agent App for iOS Overview](https://cortex-docs.paloaltonetworks.com/cortex-xdr-agent-ios-guide/8.6/get-started/cortex-xdr-agent-app-for-ios-overview.md): Learn about deploying and configuring the Cortex XDR agent app for iOS on iOS-based endpoints. - [Release Notes for Cortex XDR Agent App for iOS](https://cortex-docs.paloaltonetworks.com/cortex-xdr-agent-ios-guide/8.6/get-started/release-notes-for-cortex-xdr-agent-app-for-ios.md) - [Cortex XDR Agent App for iOS Requirements](https://cortex-docs.paloaltonetworks.com/cortex-xdr-agent-ios-guide/8.6/get-started/cortex-xdr-agent-app-for-ios-requirements.md): Learn about requirements for the Cortex XDR Agent app for iOS. - [Administrator Tasks](https://cortex-docs.paloaltonetworks.com/cortex-xdr-agent-ios-guide/8.6/administrator-tasks.md): The tasks in this section are performed by the Cortex XDR or Cortex XSIAM administrator. - [Prepare for Installation (Administrator Task)](https://cortex-docs.paloaltonetworks.com/cortex-xdr-agent-ios-guide/8.6/administrator-tasks/prepare-for-installation-administrator-task.md): Learn about the Administrator’s tasks required to prepare for installation of the Cortex XDR Agent app for iOS. - [Add a Malware Prevention Profile (Administrator Task)](https://cortex-docs.paloaltonetworks.com/cortex-xdr-agent-ios-guide/8.6/administrator-tasks/prepare-for-installation-administrator-task/add-a-malware-prevention-profile-administrator-task.md): From the Cortex XDR or XSIAM tenant, you can configure the action that Cortex XDR agents on iOS devices take for known malicious URLs and spam numbers. You can also configure granular control and moni - [Add an Agent Settings Prevention Profile (Administrator Task)](https://cortex-docs.paloaltonetworks.com/cortex-xdr-agent-ios-guide/8.6/administrator-tasks/prepare-for-installation-administrator-task/add-an-agent-settings-prevention-profile-administrator-task.md): You can use Agent Settings prevention profiles to customize Cortex XDR agent settings for different platforms and groups of users. - [Configuration for Installation by MDM (Administrator Task)](https://cortex-docs.paloaltonetworks.com/cortex-xdr-agent-ios-guide/8.6/administrator-tasks/prepare-for-installation-administrator-task/configuration-for-installation-by-mdm-administrator-task.md): Instructions to configure the Cortex XDR iOS app by MDM. - [Device User Tasks](https://cortex-docs.paloaltonetworks.com/cortex-xdr-agent-ios-guide/8.6/device-user-tasks.md): The tasks in this section are performed by the iOS device user. - [Install Cortex XDR Agent iOS App on the iOS Device](https://cortex-docs.paloaltonetworks.com/cortex-xdr-agent-ios-guide/8.6/device-user-tasks/install-cortex-xdr-agent-ios-app-on-the-ios-device.md): Use this workflow to install Cortex XDR Agent for iOS on your device. - [Configure Phone Call Blocking](https://cortex-docs.paloaltonetworks.com/cortex-xdr-agent-ios-guide/8.6/device-user-tasks/configure-phone-call-blocking.md): Learn how to configure phone call blocking on iPhones, using the Cortex XDR agent app for iOS. - [Configure Message and Call Reporting](https://cortex-docs.paloaltonetworks.com/cortex-xdr-agent-ios-guide/8.6/device-user-tasks/configure-message-and-call-reporting.md): Learn how to enable your iPhone to report spam messages. - [Report Spam Messages](https://cortex-docs.paloaltonetworks.com/cortex-xdr-agent-ios-guide/8.6/device-user-tasks/report-spam-messages.md): Learn how to enable your device to report spam messages from unknown senders. - [Check Your Device](https://cortex-docs.paloaltonetworks.com/cortex-xdr-agent-ios-guide/8.6/device-user-tasks/check-your-device.md): Learn about checking Cortex XDR agent app activity on your iOS device. - [View Security Events](https://cortex-docs.paloaltonetworks.com/cortex-xdr-agent-ios-guide/8.6/device-user-tasks/view-security-events.md): Learn how to view the security events identified by the Cortex XDR Agent app installed on your iOS device. - [View and Modify Use of Security Modules](https://cortex-docs.paloaltonetworks.com/cortex-xdr-agent-ios-guide/8.6/device-user-tasks/view-and-modify-use-of-security-modules.md): View and modify the use of security modules used by your device's Cortex XDR app. - [View Device and App Status and Information](https://cortex-docs.paloaltonetworks.com/cortex-xdr-agent-ios-guide/8.6/device-user-tasks/view-device-and-app-status-and-information.md) - [View Device Information](https://cortex-docs.paloaltonetworks.com/cortex-xdr-agent-ios-guide/8.6/device-user-tasks/view-device-and-app-status-and-information/view-device-information.md): Learn how to view Cortex XDR agent app for iOS device endpoint information. - [View Connection](https://cortex-docs.paloaltonetworks.com/cortex-xdr-agent-ios-guide/8.6/device-user-tasks/view-device-and-app-status-and-information/view-connection.md): View general and connection information for your Cortex XDR agent app for iOS. - [Using the Cortex XDR iOS Widgets](https://cortex-docs.paloaltonetworks.com/cortex-xdr-agent-ios-guide/8.6/device-user-tasks/view-device-and-app-status-and-information/using-the-cortex-xdr-ios-widgets.md): Learn how to use the Cortex XDR widgets on your iOS device. - [Troubleshooting](https://cortex-docs.paloaltonetworks.com/cortex-xdr-agent-ios-guide/8.6/device-user-tasks/troubleshooting.md): Learn about troubleshooting issues with the Cortex XDR Agent app for iOS. - [Send Logs](https://cortex-docs.paloaltonetworks.com/cortex-xdr-agent-ios-guide/8.6/device-user-tasks/troubleshooting/send-logs.md): Learn how to send logs from the Cortex XDR Agent app for iOS to Palo Alto Networks for analysis. * [Get Started](https://cortex-docs.paloaltonetworks.com/cortex-xdr-agent-ios-guide/8.5/get-started.md): Learn more about the Cortex XDR Agent app for iOS. The Cortex XDR Agent app enforces your organization’s security policy on iOS-based endpoints, as defined in Cortex XDR or Cortex XSIAM. * [Cortex XDR Agent App for iOS Overview](https://cortex-docs.paloaltonetworks.com/cortex-xdr-agent-ios-guide/8.5/get-started/cortex-xdr-agent-app-for-ios-overview.md): Learn about deploying and configuring the Cortex XDR agent app for iOS on iOS-based endpoints. * [Release Notes for Cortex XDR Agent App for iOS](https://cortex-docs.paloaltonetworks.com/cortex-xdr-agent-ios-guide/8.5/get-started/release-notes-for-cortex-xdr-agent-app-for-ios.md) * [Cortex XDR Agent App for iOS Requirements](https://cortex-docs.paloaltonetworks.com/cortex-xdr-agent-ios-guide/8.5/get-started/cortex-xdr-agent-app-for-ios-requirements.md): Learn about requirements for the Cortex XDR Agent app for iOS. * [Administrator Tasks](https://cortex-docs.paloaltonetworks.com/cortex-xdr-agent-ios-guide/8.5/administrator-tasks.md): The tasks in this section are performed by the Cortex XDR or Cortex XSIAM administrator. * [Prepare for Installation (Administrator Task)](https://cortex-docs.paloaltonetworks.com/cortex-xdr-agent-ios-guide/8.5/administrator-tasks/prepare-for-installation-administrator-task.md): Learn about the Administrator’s tasks required to prepare for installation of the Cortex XDR Agent app for iOS. * [Add a Malware Prevention Profile (Administrator Task)](https://cortex-docs.paloaltonetworks.com/cortex-xdr-agent-ios-guide/8.5/administrator-tasks/prepare-for-installation-administrator-task/add-a-malware-prevention-profile-administrator-task.md): From the Cortex XDR or XSIAM tenant, you can configure the action that Cortex XDR agents on iOS devices take for known malicious URLs and spam numbers. You can also configure granular control and moni * [Add an Agent Settings Prevention Profile (Administrator Task)](https://cortex-docs.paloaltonetworks.com/cortex-xdr-agent-ios-guide/8.5/administrator-tasks/prepare-for-installation-administrator-task/add-an-agent-settings-prevention-profile-administrator-task.md): You can use Agent Settings prevention profiles to customize Cortex XDR agent settings for different platforms and groups of users. * [Configuration for Installation by MDM (Administrator Task)](https://cortex-docs.paloaltonetworks.com/cortex-xdr-agent-ios-guide/8.5/administrator-tasks/prepare-for-installation-administrator-task/configuration-for-installation-by-mdm-administrator-task.md): Instructions to configure the Cortex XDR iOS app by MDM. * [Device User Tasks](https://cortex-docs.paloaltonetworks.com/cortex-xdr-agent-ios-guide/8.5/device-user-tasks.md): The tasks in this section are performed by the iOS device user. * [Install Cortex XDR Agent iOS App on the iOS Device](https://cortex-docs.paloaltonetworks.com/cortex-xdr-agent-ios-guide/8.5/device-user-tasks/install-cortex-xdr-agent-ios-app-on-the-ios-device.md): Use this workflow to install Cortex XDR Agent for iOS on your device. * [Configure Phone Call Blocking](https://cortex-docs.paloaltonetworks.com/cortex-xdr-agent-ios-guide/8.5/device-user-tasks/configure-phone-call-blocking.md): Learn how to configure phone call blocking on iPhones, using the Cortex XDR agent app for iOS. * [Configure Message and Call Reporting](https://cortex-docs.paloaltonetworks.com/cortex-xdr-agent-ios-guide/8.5/device-user-tasks/configure-message-and-call-reporting.md): Learn how to enable your iPhone to report spam messages. * [Report Spam Messages](https://cortex-docs.paloaltonetworks.com/cortex-xdr-agent-ios-guide/8.5/device-user-tasks/report-spam-messages.md): Learn how to enable your device to report spam messages from unknown senders. * [Check Your Device](https://cortex-docs.paloaltonetworks.com/cortex-xdr-agent-ios-guide/8.5/device-user-tasks/check-your-device.md): Learn about checking Cortex XDR agent app activity on your iOS device. * [View Security Events](https://cortex-docs.paloaltonetworks.com/cortex-xdr-agent-ios-guide/8.5/device-user-tasks/view-security-events.md): Learn how to view the security events identified by the Cortex XDR Agent app installed on your iOS device. * [View and Modify Use of Security Modules](https://cortex-docs.paloaltonetworks.com/cortex-xdr-agent-ios-guide/8.5/device-user-tasks/view-and-modify-use-of-security-modules.md): View and modify the use of security modules used by your device's Cortex XDR app. * [View Device and App Status and Information](https://cortex-docs.paloaltonetworks.com/cortex-xdr-agent-ios-guide/8.5/device-user-tasks/view-device-and-app-status-and-information.md) * [View Device Information](https://cortex-docs.paloaltonetworks.com/cortex-xdr-agent-ios-guide/8.5/device-user-tasks/view-device-and-app-status-and-information/view-device-information.md): Learn how to view Cortex XDR agent app for iOS device endpoint information. * [View Connection](https://cortex-docs.paloaltonetworks.com/cortex-xdr-agent-ios-guide/8.5/device-user-tasks/view-device-and-app-status-and-information/view-connection.md): View general and connection information for your Cortex XDR agent app for iOS. * [Using the Cortex XDR iOS Widgets](https://cortex-docs.paloaltonetworks.com/cortex-xdr-agent-ios-guide/8.5/device-user-tasks/view-device-and-app-status-and-information/using-the-cortex-xdr-ios-widgets.md): Learn how to use the Cortex XDR widgets on your iOS device. * [Troubleshooting](https://cortex-docs.paloaltonetworks.com/cortex-xdr-agent-ios-guide/8.5/device-user-tasks/troubleshooting.md): Learn about troubleshooting issues with the Cortex XDR Agent app for iOS. * [Send Logs](https://cortex-docs.paloaltonetworks.com/cortex-xdr-agent-ios-guide/8.5/device-user-tasks/troubleshooting/send-logs.md): Learn how to send logs from the Cortex XDR Agent app for iOS to Palo Alto Networks for analysis. - [Get Started](https://cortex-docs.paloaltonetworks.com/cortex-xdr-agent-ios-guide/8.4/get-started.md): Learn more about the Cortex XDR Agent app for iOS. The Cortex XDR Agent app enforces your organization’s security policy on iOS-based endpoints, as defined in Cortex XDR or Cortex XSIAM. - [Release Notes for Cortex XDR Agent App for iOS](https://cortex-docs.paloaltonetworks.com/cortex-xdr-agent-ios-guide/8.4/get-started/release-notes-for-cortex-xdr-agent-app-for-ios.md) - [Cortex XDR Agent App for iOS Requirements](https://cortex-docs.paloaltonetworks.com/cortex-xdr-agent-ios-guide/8.4/get-started/cortex-xdr-agent-app-for-ios-requirements.md): Learn about requirements for the Cortex XDR Agent app for iOS. - [Administrator Tasks](https://cortex-docs.paloaltonetworks.com/cortex-xdr-agent-ios-guide/8.4/administrator-tasks.md): The tasks in this section are performed by the Cortex XDR or Cortex XSIAM administrator. - [Add a Malware Security Profile (Administrator Task)](https://cortex-docs.paloaltonetworks.com/cortex-xdr-agent-ios-guide/8.4/administrator-tasks/add-a-malware-security-profile-administrator-task.md): From the Cortex XDR or Cortex XSIAM tenant, administrators can configure what action Cortex XDR agents on iOS devices take for known malicious URLs and spam numbers. - [Add an Agent Settings Prevention Profile (Administrator Task)](https://cortex-docs.paloaltonetworks.com/cortex-xdr-agent-ios-guide/8.4/administrator-tasks/add-an-agent-settings-prevention-profile-administrator-task.md): You can use Agent Settings prevention profiles to customize Cortex XDR agent settings for different platforms and groups of users. - [Configuration for Installation by MDM (Administrator Task)](https://cortex-docs.paloaltonetworks.com/cortex-xdr-agent-ios-guide/8.4/administrator-tasks/configuration-for-installation-by-mdm-administrator-task.md): Instructions to configure the Cortex XDR iOS app by MDM. - [Configure Network Filtering on Supervised Devices (Administrator Task)](https://cortex-docs.paloaltonetworks.com/cortex-xdr-agent-ios-guide/8.4/administrator-tasks/configuration-for-installation-by-mdm-administrator-task/configure-network-filtering-on-supervised-devices-administrator-task.md): When your organization manages iOS devices, the administrator can set up the Network Shield feature to block network activity for specific URLs. - [Configuration for Installation by JAMF (Administrator Task)](https://cortex-docs.paloaltonetworks.com/cortex-xdr-agent-ios-guide/8.4/administrator-tasks/configuration-for-installation-by-mdm-administrator-task/configuration-for-installation-by-jamf-administrator-task.md): Instructions to configure Cortex XDR iOS app by JAMF MDM. - [Prepare for Installation (Administrator Task)](https://cortex-docs.paloaltonetworks.com/cortex-xdr-agent-ios-guide/8.4/administrator-tasks/prepare-for-installation-administrator-task.md): Learn about the Administrator’s tasks required to prepare for installation of the Cortex XDR Agent app for iOS. - [Device User Tasks](https://cortex-docs.paloaltonetworks.com/cortex-xdr-agent-ios-guide/8.4/device-user-tasks.md): The tasks in this section are performed by the iOS device user. - [Install Cortex XDR Agent iOS App on the iOS Device](https://cortex-docs.paloaltonetworks.com/cortex-xdr-agent-ios-guide/8.4/device-user-tasks/install-cortex-xdr-agent-ios-app-on-the-ios-device.md): Use this workflow to install Cortex XDR Agent for iOS on your device. - [Configure Phone Call Blocking](https://cortex-docs.paloaltonetworks.com/cortex-xdr-agent-ios-guide/8.4/device-user-tasks/configure-phone-call-blocking.md): Learn how to configure phone call blocking on iPhones, using the Cortex XDR agent app for iOS. - [Configure Message and Call Reporting](https://cortex-docs.paloaltonetworks.com/cortex-xdr-agent-ios-guide/8.4/device-user-tasks/configure-message-and-call-reporting.md): Learn how to enable your iPhone to report spam messages. - [Report Spam Messages](https://cortex-docs.paloaltonetworks.com/cortex-xdr-agent-ios-guide/8.4/device-user-tasks/report-spam-messages.md): Learn how to enable your device to report spam messages from unknown senders. - [Check Your Device](https://cortex-docs.paloaltonetworks.com/cortex-xdr-agent-ios-guide/8.4/device-user-tasks/check-your-device.md): Learn about checking Cortex XDR agent app activity on your iOS device. - [View Security Events](https://cortex-docs.paloaltonetworks.com/cortex-xdr-agent-ios-guide/8.4/device-user-tasks/view-security-events.md): Learn how to view the security events identified by the Cortex XDR Agent app installed on your iOS device. - [View and Modify Use of Security Modules](https://cortex-docs.paloaltonetworks.com/cortex-xdr-agent-ios-guide/8.4/device-user-tasks/view-and-modify-use-of-security-modules.md): View and modify the use of security modules used by your device's Cortex XDR app. - [View Device and App Status and Information](https://cortex-docs.paloaltonetworks.com/cortex-xdr-agent-ios-guide/8.4/device-user-tasks/view-device-and-app-status-and-information.md) - [View Device Information](https://cortex-docs.paloaltonetworks.com/cortex-xdr-agent-ios-guide/8.4/device-user-tasks/view-device-and-app-status-and-information/view-device-information.md): Learn how to view Cortex XDR agent app for iOS device endpoint information. - [View Connection](https://cortex-docs.paloaltonetworks.com/cortex-xdr-agent-ios-guide/8.4/device-user-tasks/view-device-and-app-status-and-information/view-connection.md): View general and connection information for your Cortex XDR agent app for iOS. - [Using the Cortex XDR iOS Widgets](https://cortex-docs.paloaltonetworks.com/cortex-xdr-agent-ios-guide/8.4/device-user-tasks/view-device-and-app-status-and-information/using-the-cortex-xdr-ios-widgets.md): Learn how to use the Cortex XDR widgets on your iOS device. - [Troubleshooting](https://cortex-docs.paloaltonetworks.com/cortex-xdr-agent-ios-guide/8.4/device-user-tasks/troubleshooting.md): Learn about troubleshooting issues with the Cortex XDR Agent app for iOS. - [Send Logs](https://cortex-docs.paloaltonetworks.com/cortex-xdr-agent-ios-guide/8.4/device-user-tasks/troubleshooting/send-logs.md): Learn how to send logs from the Cortex XDR Agent app for iOS to Palo Alto Networks for analysis. * [Get Started](https://cortex-docs.paloaltonetworks.com/cortex-xdr-agent-ios-guide/8.3/get-started.md): Learn more about the Cortex XDR Agent app for iOS. The Cortex XDR Agent app enforces your organization’s security policy on iOS-based endpoints, as defined in Cortex XDR or Cortex XSIAM. * [Release Notes for Cortex XDR Agent App for iOS](https://cortex-docs.paloaltonetworks.com/cortex-xdr-agent-ios-guide/8.3/get-started/release-notes-for-cortex-xdr-agent-app-for-ios.md) * [Cortex XDR Agent App for iOS Requirements](https://cortex-docs.paloaltonetworks.com/cortex-xdr-agent-ios-guide/8.3/get-started/cortex-xdr-agent-app-for-ios-requirements.md): Learn about requirements for the Cortex XDR Agent app for iOS. * [Install and Connect Cortex XDR Agent App for iOS](https://cortex-docs.paloaltonetworks.com/cortex-xdr-agent-ios-guide/8.3/install-and-connect-cortex-xdr-agent-app-for-ios.md) * [Add a Malware Security Profile (Administrator Task)](https://cortex-docs.paloaltonetworks.com/cortex-xdr-agent-ios-guide/8.3/install-and-connect-cortex-xdr-agent-app-for-ios/add-a-malware-security-profile-administrator-task.md): From the Cortex XDR management console, administrators can configure what action Cortex XDR agents on iOS devices take for known malicious URLs and spam numbers. * [Add an Agent Settings Security Profile (Administrator Task)](https://cortex-docs.paloaltonetworks.com/cortex-xdr-agent-ios-guide/8.3/install-and-connect-cortex-xdr-agent-app-for-ios/add-an-agent-settings-security-profile-administrator-task.md): Agent Settings profiles enable you to customize Cortex XDR agent settings for different platforms and groups of users. * [Prepare for Installation (Administrator Task)](https://cortex-docs.paloaltonetworks.com/cortex-xdr-agent-ios-guide/8.3/install-and-connect-cortex-xdr-agent-app-for-ios/prepare-for-installation-administrator-task.md): Learn about the Administrator’s tasks required prior to installation of the Cortex XDR Agent app for iOS. * [Install Cortex XDR Agent iOS App on the iOS Device](https://cortex-docs.paloaltonetworks.com/cortex-xdr-agent-ios-guide/8.3/install-and-connect-cortex-xdr-agent-app-for-ios/install-cortex-xdr-agent-ios-app-on-the-ios-device.md): Use this workflow to install Cortex XDR Agent for iOS on your device. * [Configuration for Installation by MDM (Administrator Task)](https://cortex-docs.paloaltonetworks.com/cortex-xdr-agent-ios-guide/8.3/configuration-for-installation-by-mdm-administrator-task.md): Instructions to configure the Cortex XDR iOS app by MDM. * [Configuration for Installation by JAMF (Administrator Task)](https://cortex-docs.paloaltonetworks.com/cortex-xdr-agent-ios-guide/8.3/configuration-for-installation-by-mdm-administrator-task/configuration-for-installation-by-jamf-administrator-task.md): Instructions to configure Cortex XDR iOS app by JAMF MDM. * [Configure Cortex XDR Agent App for iOS](https://cortex-docs.paloaltonetworks.com/cortex-xdr-agent-ios-guide/8.3/configure-cortex-xdr-agent-app-for-ios.md) * [Configure Phone Call Blocking](https://cortex-docs.paloaltonetworks.com/cortex-xdr-agent-ios-guide/8.3/configure-cortex-xdr-agent-app-for-ios/configure-phone-call-blocking.md): Learn how to configure phone call blocking on iPhones, using the Cortex XDR agent app for iOS. * [Configure Message and Call Reporting](https://cortex-docs.paloaltonetworks.com/cortex-xdr-agent-ios-guide/8.3/configure-cortex-xdr-agent-app-for-ios/configure-message-and-call-reporting.md): Learn how to enable your iPhone to report spam messages. * [Configure Network Filtering on Supervised Devices (Administrator Task)](https://cortex-docs.paloaltonetworks.com/cortex-xdr-agent-ios-guide/8.3/configure-cortex-xdr-agent-app-for-ios/configure-network-filtering-on-supervised-devices-administrator-task.md): When your organization supervises iOS devices, the administrator can set up network filtering to block network activity for specific URLs. * [Report Spam Messages](https://cortex-docs.paloaltonetworks.com/cortex-xdr-agent-ios-guide/8.3/configure-cortex-xdr-agent-app-for-ios/report-spam-messages.md): Learn how to enable your device to report spam messages from unknown senders. * [Manage Security Events](https://cortex-docs.paloaltonetworks.com/cortex-xdr-agent-ios-guide/8.3/manage-security-events.md) * [Check Your Device](https://cortex-docs.paloaltonetworks.com/cortex-xdr-agent-ios-guide/8.3/manage-security-events/check-your-device.md): Learn about checking Cortex XDR agent app activity on your iOS device. * [View Security Events](https://cortex-docs.paloaltonetworks.com/cortex-xdr-agent-ios-guide/8.3/manage-security-events/view-security-events.md): Learn how to view the security events identified by the Cortex XDR Agent app installed on your iOS device. * [View Device and App Status and Information](https://cortex-docs.paloaltonetworks.com/cortex-xdr-agent-ios-guide/8.3/view-device-and-app-status-and-information.md) * [View Device Information](https://cortex-docs.paloaltonetworks.com/cortex-xdr-agent-ios-guide/8.3/view-device-and-app-status-and-information/view-device-information.md): Learn how to view Cortex XDR agent app for iOS device endpoint information. * [View Connection](https://cortex-docs.paloaltonetworks.com/cortex-xdr-agent-ios-guide/8.3/view-device-and-app-status-and-information/view-connection.md): View general and connection information for your Cortex XDR agent app for iOS. * [Using the Cortex XDR iOS Widgets](https://cortex-docs.paloaltonetworks.com/cortex-xdr-agent-ios-guide/8.3/view-device-and-app-status-and-information/using-the-cortex-xdr-ios-widgets.md): Learn how to use the Cortex XDR widgets on your iOS device. * [Troubleshooting](https://cortex-docs.paloaltonetworks.com/cortex-xdr-agent-ios-guide/8.3/troubleshooting.md): Learn about troubleshooting issues with the Cortex XDR Agent app for iOS. * [Send Logs](https://cortex-docs.paloaltonetworks.com/cortex-xdr-agent-ios-guide/8.3/troubleshooting/send-logs.md): Learn how to send logs from the Cortex XDR Agent app for iOS to Palo Alto Networks for analysis. - [Get Started](https://cortex-docs.paloaltonetworks.com/cortex-xdr-agent-ios-guide/8.2/get-started.md): Learn more about the Cortex XDR Agent app for iOS. The Cortex XDR Agent app enforces your organization’s security policy on iOS-based endpoints, as defined in Cortex XDR or Cortex XSIAM. - [Release Notes for Cortex XDR Agent App for iOS](https://cortex-docs.paloaltonetworks.com/cortex-xdr-agent-ios-guide/8.2/get-started/release-notes-for-cortex-xdr-agent-app-for-ios.md) - [Cortex XDR Agent App for iOS Requirements](https://cortex-docs.paloaltonetworks.com/cortex-xdr-agent-ios-guide/8.2/get-started/cortex-xdr-agent-app-for-ios-requirements.md): Learn about requirements for the Cortex XDR Agent app for iOS. - [Install and Connect Cortex XDR Agent App for iOS](https://cortex-docs.paloaltonetworks.com/cortex-xdr-agent-ios-guide/8.2/install-and-connect-cortex-xdr-agent-app-for-ios.md) - [Add a Malware Security Profile (Administrator Task)](https://cortex-docs.paloaltonetworks.com/cortex-xdr-agent-ios-guide/8.2/install-and-connect-cortex-xdr-agent-app-for-ios/add-a-malware-security-profile-administrator-task.md): From the Cortex XDR management console, administrators can configure what action Cortex XDR agents on iOS devices take for known malicious URLs and spam numbers. - [Add an Agent Settings Security Profile (Administrator Task)](https://cortex-docs.paloaltonetworks.com/cortex-xdr-agent-ios-guide/8.2/install-and-connect-cortex-xdr-agent-app-for-ios/add-an-agent-settings-security-profile-administrator-task.md): Agent Settings profiles enable you to customize Cortex XDR agent settings for different platforms and groups of users. - [Prepare for Installation (Administrator Task)](https://cortex-docs.paloaltonetworks.com/cortex-xdr-agent-ios-guide/8.2/install-and-connect-cortex-xdr-agent-app-for-ios/prepare-for-installation-administrator-task.md): Learn about the Administrator’s tasks required prior to installation of the Cortex XDR Agent app for iOS. - [Install Cortex XDR Agent iOS App on the iOS Device](https://cortex-docs.paloaltonetworks.com/cortex-xdr-agent-ios-guide/8.2/install-and-connect-cortex-xdr-agent-app-for-ios/install-cortex-xdr-agent-ios-app-on-the-ios-device.md): Use this workflow to install Cortex XDR Agent for iOS on your device. - [Configuration for Installation by MDM (Administrator Task)](https://cortex-docs.paloaltonetworks.com/cortex-xdr-agent-ios-guide/8.2/configuration-for-installation-by-mdm-administrator-task.md): Instructions to configure the Cortex XDR iOS app by MDM. - [Configuration for Installation by JAMF (Administrator Task)](https://cortex-docs.paloaltonetworks.com/cortex-xdr-agent-ios-guide/8.2/configuration-for-installation-by-mdm-administrator-task/configuration-for-installation-by-jamf-administrator-task.md): Instructions to configure Cortex XDR iOS app by JAMF MDM. - [Configure Cortex XDR Agent App for iOS](https://cortex-docs.paloaltonetworks.com/cortex-xdr-agent-ios-guide/8.2/configure-cortex-xdr-agent-app-for-ios.md) - [Configure Phone Call Blocking](https://cortex-docs.paloaltonetworks.com/cortex-xdr-agent-ios-guide/8.2/configure-cortex-xdr-agent-app-for-ios/configure-phone-call-blocking.md): Learn how to configure phone call blocking on iPhones, using the Cortex XDR agent app for iOS. - [Configure Message and Call Reporting](https://cortex-docs.paloaltonetworks.com/cortex-xdr-agent-ios-guide/8.2/configure-cortex-xdr-agent-app-for-ios/configure-message-and-call-reporting.md): Learn how to enable your iPhone to report spam messages. - [Configure Network Filtering on Supervised Devices (Administrator Task)](https://cortex-docs.paloaltonetworks.com/cortex-xdr-agent-ios-guide/8.2/configure-cortex-xdr-agent-app-for-ios/configure-network-filtering-on-supervised-devices-administrator-task.md): When your organization supervises iOS devices, the administrator can set up network filtering to block network activity for specific URLs. - [Report Spam Messages](https://cortex-docs.paloaltonetworks.com/cortex-xdr-agent-ios-guide/8.2/configure-cortex-xdr-agent-app-for-ios/report-spam-messages.md): Learn how to enable your device to report spam messages from unknown senders. - [Manage Security Events](https://cortex-docs.paloaltonetworks.com/cortex-xdr-agent-ios-guide/8.2/manage-security-events.md) - [Check Your Device](https://cortex-docs.paloaltonetworks.com/cortex-xdr-agent-ios-guide/8.2/manage-security-events/check-your-device.md): Learn about checking Cortex XDR agent app activity on your iOS device. - [View Security Events](https://cortex-docs.paloaltonetworks.com/cortex-xdr-agent-ios-guide/8.2/manage-security-events/view-security-events.md): Learn how to view the security events identified by the Cortex XDR Agent app installed on your iOS device. - [View Device and App Status and Information](https://cortex-docs.paloaltonetworks.com/cortex-xdr-agent-ios-guide/8.2/view-device-and-app-status-and-information.md) - [View Device Information](https://cortex-docs.paloaltonetworks.com/cortex-xdr-agent-ios-guide/8.2/view-device-and-app-status-and-information/view-device-information.md): Learn how to view Cortex XDR agent app for iOS device endpoint information. - [View Connection](https://cortex-docs.paloaltonetworks.com/cortex-xdr-agent-ios-guide/8.2/view-device-and-app-status-and-information/view-connection.md): View general and connection information for your Cortex XDR agent app for iOS. - [Using the Cortex XDR iOS Widgets](https://cortex-docs.paloaltonetworks.com/cortex-xdr-agent-ios-guide/8.2/view-device-and-app-status-and-information/using-the-cortex-xdr-ios-widgets.md): Learn how to use the Cortex XDR widgets on your iOS device. - [Troubleshooting](https://cortex-docs.paloaltonetworks.com/cortex-xdr-agent-ios-guide/8.2/troubleshooting.md): Learn about troubleshooting issues with the Cortex XDR Agent app for iOS. - [Send Logs](https://cortex-docs.paloaltonetworks.com/cortex-xdr-agent-ios-guide/8.2/troubleshooting/send-logs.md): Learn how to send logs from the Cortex XDR Agent app for iOS to Palo Alto Networks for analysis. * [Get Started](https://cortex-docs.paloaltonetworks.com/cortex-xdr-agent-ios-guide/8.1-agent-ios-guide/get-started.md): Learn more about the Cortex XDR Agent app for iOS. The Cortex XDR Agent app enforces your organization’s security policy on iOS-based endpoints, as defined in Cortex XDR or Cortex XSIAM. * [Cortex XDR Agent App for iOS Requirements](https://cortex-docs.paloaltonetworks.com/cortex-xdr-agent-ios-guide/8.1-agent-ios-guide/get-started/cortex-xdr-agent-app-for-ios-requirements.md): Learn about requirements for the Cortex XDR Agent app for iOS. * [Release Notes](https://cortex-docs.paloaltonetworks.com/cortex-xdr-agent-ios-guide/8.1-agent-ios-guide/get-started/release-notes.md): Learn about new features added to Cortex XDR agent app for iOS. * [Install and Connect Cortex XDR Agent App for iOS](https://cortex-docs.paloaltonetworks.com/cortex-xdr-agent-ios-guide/8.1-agent-ios-guide/install-and-connect-cortex-xdr-agent-app-for-ios.md) * [Add a Malware Security Profile (Administrator Task)](https://cortex-docs.paloaltonetworks.com/cortex-xdr-agent-ios-guide/8.1-agent-ios-guide/install-and-connect-cortex-xdr-agent-app-for-ios/add-a-malware-security-profile-administrator-task.md): From the Cortex XDR management console, administrators can configure what action Cortex XDR agents on iOS devices take for known malicious URLs and spam numbers. * [Add an Agent Settings Security Profile (Administrator Task)](https://cortex-docs.paloaltonetworks.com/cortex-xdr-agent-ios-guide/8.1-agent-ios-guide/install-and-connect-cortex-xdr-agent-app-for-ios/add-an-agent-settings-security-profile-administrator-task.md): Agent Settings profiles enable you to customize Cortex XDR agent settings for different platforms and groups of users. * [Prepare for Installation (Administrator Task)](https://cortex-docs.paloaltonetworks.com/cortex-xdr-agent-ios-guide/8.1-agent-ios-guide/install-and-connect-cortex-xdr-agent-app-for-ios/prepare-for-installation-administrator-task.md): Learn about the Administrator’s tasks required prior to installation of the Cortex XDR Agent app for iOS. * [Install Cortex XDR Agent iOS App on the iOS Device](https://cortex-docs.paloaltonetworks.com/cortex-xdr-agent-ios-guide/8.1-agent-ios-guide/install-and-connect-cortex-xdr-agent-app-for-ios/install-cortex-xdr-agent-ios-app-on-the-ios-device.md): Use this workflow to install Cortex XDR Agent for iOS on your device. * [Configuration for Installation by MDM (Administrator Task)](https://cortex-docs.paloaltonetworks.com/cortex-xdr-agent-ios-guide/8.1-agent-ios-guide/configuration-for-installation-by-mdm-administrator-task.md): Instructions to configure the Cortex XDR iOS app by MDM. * [Configuration for Installation by JAMF (Administrator Task)](https://cortex-docs.paloaltonetworks.com/cortex-xdr-agent-ios-guide/8.1-agent-ios-guide/configuration-for-installation-by-mdm-administrator-task/configuration-for-installation-by-jamf-administrator-task.md): Instructions to configure Cortex XDR iOS app by JAMF MDM. * [Configure Cortex XDR Agent App for iOS](https://cortex-docs.paloaltonetworks.com/cortex-xdr-agent-ios-guide/8.1-agent-ios-guide/configure-cortex-xdr-agent-app-for-ios.md) * [Configure Phone Call Blocking](https://cortex-docs.paloaltonetworks.com/cortex-xdr-agent-ios-guide/8.1-agent-ios-guide/configure-cortex-xdr-agent-app-for-ios/configure-phone-call-blocking.md): Learn how to configure phone call blocking on iPhones, using the Cortex XDR agent app for iOS. * [Configure Message and Call Reporting](https://cortex-docs.paloaltonetworks.com/cortex-xdr-agent-ios-guide/8.1-agent-ios-guide/configure-cortex-xdr-agent-app-for-ios/configure-message-and-call-reporting.md): Learn how to enable your iPhone to report spam messages. * [Report Spam Messages](https://cortex-docs.paloaltonetworks.com/cortex-xdr-agent-ios-guide/8.1-agent-ios-guide/configure-cortex-xdr-agent-app-for-ios/report-spam-messages.md): Learn how to enable your device to report spam messages from unknown senders. * [Manage Security Events](https://cortex-docs.paloaltonetworks.com/cortex-xdr-agent-ios-guide/8.1-agent-ios-guide/manage-security-events.md) * [Check Your Device](https://cortex-docs.paloaltonetworks.com/cortex-xdr-agent-ios-guide/8.1-agent-ios-guide/manage-security-events/check-your-device.md): Learn about checking Cortex XDR agent app activity on your iOS device. * [View Security Events](https://cortex-docs.paloaltonetworks.com/cortex-xdr-agent-ios-guide/8.1-agent-ios-guide/manage-security-events/view-security-events.md): Learn how to view the security events identified by the Cortex XDR Agent app installed on your iOS device. * [View Device and App Status and Information](https://cortex-docs.paloaltonetworks.com/cortex-xdr-agent-ios-guide/8.1-agent-ios-guide/view-device-and-app-status-and-information.md) * [View Device Information](https://cortex-docs.paloaltonetworks.com/cortex-xdr-agent-ios-guide/8.1-agent-ios-guide/view-device-and-app-status-and-information/view-device-information.md): Learn how to view Cortex XDR agent app for iOS device endpoint information. * [View Connection](https://cortex-docs.paloaltonetworks.com/cortex-xdr-agent-ios-guide/8.1-agent-ios-guide/view-device-and-app-status-and-information/view-connection.md): View general and connection information for your Cortex XDR agent app for iOS. * [Using the Cortex XDR iOS Widgets](https://cortex-docs.paloaltonetworks.com/cortex-xdr-agent-ios-guide/8.1-agent-ios-guide/view-device-and-app-status-and-information/using-the-cortex-xdr-ios-widgets.md): Learn how to use the Cortex XDR widgets on your iOS device. * [Troubleshooting](https://cortex-docs.paloaltonetworks.com/cortex-xdr-agent-ios-guide/8.1-agent-ios-guide/troubleshooting.md): Learn about troubleshooting issues with the Cortex XDR Agent app for iOS. * [Send Logs](https://cortex-docs.paloaltonetworks.com/cortex-xdr-agent-ios-guide/8.1-agent-ios-guide/troubleshooting/send-logs.md): Learn how to send logs from the Cortex XDR Agent app for iOS to Palo Alto Networks for analysis. - [Get Started](https://cortex-docs.paloaltonetworks.com/cortex-xdr-agent-ios-guide/8.0/cortex-xdr-agent-ios-app/readme.md): Learn more about the Cortex XDR Agent app for iOS. The Cortex XDR Agent app enforces your organization’s security policy on iOS-based endpoints, as defined in Cortex XDR or Cortex XSIAM. - [Cortex XDR Agent App for iOS Requirements](https://cortex-docs.paloaltonetworks.com/cortex-xdr-agent-ios-guide/8.0/cortex-xdr-agent-ios-app/readme/cortex-xdr-agent-app-for-ios-requirements.md): Learn about requirements for the Cortex XDR Agent app for iOS. - [Release Notes](https://cortex-docs.paloaltonetworks.com/cortex-xdr-agent-ios-guide/8.0/cortex-xdr-agent-ios-app/readme/release-notes.md): Learn about new features added to Cortex XDR agent app for iOS. - [Install and Connect Cortex XDR Agent App for iOS](https://cortex-docs.paloaltonetworks.com/cortex-xdr-agent-ios-guide/8.0/cortex-xdr-agent-ios-app/install-and-connect-cortex-xdr-agent-app-for-ios.md) - [Add a Malware Security Profile (Administrator Task)](https://cortex-docs.paloaltonetworks.com/cortex-xdr-agent-ios-guide/8.0/cortex-xdr-agent-ios-app/install-and-connect-cortex-xdr-agent-app-for-ios/add-a-malware-security-profile-administrator-task.md): From the Cortex XDR management console, administrators can configure what action Cortex XDR agents on iOS devices take for known malicious URLs and spam numbers. - [Add an Agent Settings Security Profile (Administrator Task)](https://cortex-docs.paloaltonetworks.com/cortex-xdr-agent-ios-guide/8.0/cortex-xdr-agent-ios-app/install-and-connect-cortex-xdr-agent-app-for-ios/add-an-agent-settings-security-profile-administrator-task.md) - [Prepare for Installation (Administrator Task)](https://cortex-docs.paloaltonetworks.com/cortex-xdr-agent-ios-guide/8.0/cortex-xdr-agent-ios-app/install-and-connect-cortex-xdr-agent-app-for-ios/prepare-for-installation-administrator-task.md): Learn about the Administrator’s tasks required prior to installation of the Cortex XDR Agent app for iOS. - [Install Cortex XDR Agent iOS App on the iOS Device](https://cortex-docs.paloaltonetworks.com/cortex-xdr-agent-ios-guide/8.0/cortex-xdr-agent-ios-app/install-and-connect-cortex-xdr-agent-app-for-ios/install-cortex-xdr-agent-ios-app-on-the-ios-device.md): Use this workflow to install Cortex XDR Agent for iOS on your device. - [Configuration for Installation by MDM (Administrator Task)](https://cortex-docs.paloaltonetworks.com/cortex-xdr-agent-ios-guide/8.0/cortex-xdr-agent-ios-app/configuration-for-installation-by-mdm-administrator-task.md): Instructions to configure the Cortex XDR iOS app by MDM. - [Configuration for Installation by JAMF (Administrator Task)](https://cortex-docs.paloaltonetworks.com/cortex-xdr-agent-ios-guide/8.0/cortex-xdr-agent-ios-app/configuration-for-installation-by-mdm-administrator-task/configuration-for-installation-by-jamf-administrator-task.md): Instructions to configure Cortex XDR iOS app by JAMF MDM. - [Configure Cortex XDR Agent App for iOS](https://cortex-docs.paloaltonetworks.com/cortex-xdr-agent-ios-guide/8.0/cortex-xdr-agent-ios-app/configure-cortex-xdr-agent-app-for-ios.md) - [Configure Phone Call Blocking](https://cortex-docs.paloaltonetworks.com/cortex-xdr-agent-ios-guide/8.0/cortex-xdr-agent-ios-app/configure-cortex-xdr-agent-app-for-ios/configure-phone-call-blocking.md): Learn how to configure phone call blocking on iPhones, using the Cortex XDR agent app for iOS. - [Configure Message and Call Reporting](https://cortex-docs.paloaltonetworks.com/cortex-xdr-agent-ios-guide/8.0/cortex-xdr-agent-ios-app/configure-cortex-xdr-agent-app-for-ios/configure-message-and-call-reporting.md): Learn how to enable your iPhone to report spam messages. - [Report Spam Messages](https://cortex-docs.paloaltonetworks.com/cortex-xdr-agent-ios-guide/8.0/cortex-xdr-agent-ios-app/configure-cortex-xdr-agent-app-for-ios/report-spam-messages.md): Learn how to enable your device to report spam messages from unknown senders. - [Manage Security Events](https://cortex-docs.paloaltonetworks.com/cortex-xdr-agent-ios-guide/8.0/cortex-xdr-agent-ios-app/manage-security-events.md) - [Check Your Device](https://cortex-docs.paloaltonetworks.com/cortex-xdr-agent-ios-guide/8.0/cortex-xdr-agent-ios-app/manage-security-events/check-your-device.md): Learn about checking Cortex XDR agent app activity on your iOS device. - [View Security Events](https://cortex-docs.paloaltonetworks.com/cortex-xdr-agent-ios-guide/8.0/cortex-xdr-agent-ios-app/manage-security-events/view-security-events.md): Learn how to view the security events identified by the Cortex XDR Agent app installed on your iOS device. - [View Device and App Status and Information](https://cortex-docs.paloaltonetworks.com/cortex-xdr-agent-ios-guide/8.0/cortex-xdr-agent-ios-app/view-device-and-app-status-and-information.md) - [View Device Information](https://cortex-docs.paloaltonetworks.com/cortex-xdr-agent-ios-guide/8.0/cortex-xdr-agent-ios-app/view-device-and-app-status-and-information/view-device-information.md): Learn how to view Cortex XDR agent app for iOS device endpoint information. - [View Connection](https://cortex-docs.paloaltonetworks.com/cortex-xdr-agent-ios-guide/8.0/cortex-xdr-agent-ios-app/view-device-and-app-status-and-information/view-connection.md): View general and connection information for your Cortex XDR agent app for iOS. - [Using the Cortex XDR iOS Widgets](https://cortex-docs.paloaltonetworks.com/cortex-xdr-agent-ios-guide/8.0/cortex-xdr-agent-ios-app/view-device-and-app-status-and-information/using-the-cortex-xdr-ios-widgets.md): Learn how to use the Cortex XDR widgets on your iOS device. - [Troubleshooting](https://cortex-docs.paloaltonetworks.com/cortex-xdr-agent-ios-guide/8.0/cortex-xdr-agent-ios-app/troubleshooting.md): Learn about troubleshooting issues with the Cortex XDR Agent app for iOS. - [Send Logs](https://cortex-docs.paloaltonetworks.com/cortex-xdr-agent-ios-guide/8.0/cortex-xdr-agent-ios-app/troubleshooting/send-logs.md): Learn how to send logs from the Cortex XDR Agent app for iOS to Palo Alto Networks for analysis. * [Get Started](https://cortex-docs.paloaltonetworks.com/cortex-xdr-agent-ios-guide/7.9/get-started.md): Learn more about the Cortex XDR Agent app for iOS. The Cortex XDR Agent app enforces your organization’s security policy on iOS-based endpoints, as defined in Cortex XDR or Cortex XSIAM. * [Cortex XDR Agent App for iOS Requirements](https://cortex-docs.paloaltonetworks.com/cortex-xdr-agent-ios-guide/7.9/get-started/cortex-xdr-agent-app-for-ios-requirements.md): Learn about requirements for the Cortex XDR Agent app for iOS. * [Release Notes](https://cortex-docs.paloaltonetworks.com/cortex-xdr-agent-ios-guide/7.9/get-started/release-notes.md): Learn about new features added to Cortex XDR agent app for iOS. * [Install and Connect Cortex XDR Agent App for iOS](https://cortex-docs.paloaltonetworks.com/cortex-xdr-agent-ios-guide/7.9/install-and-connect-cortex-xdr-agent-app-for-ios.md) * [Add a Malware Security Profile (Administrator Task)](https://cortex-docs.paloaltonetworks.com/cortex-xdr-agent-ios-guide/7.9/install-and-connect-cortex-xdr-agent-app-for-ios/add-a-malware-security-profile-administrator-task.md): From the Cortex XDR management console, administrators can configure what action Cortex XDR agents on iOS devices take for known malicious URLs and spam numbers. * [Add an Agent Settings Security Profile (Administrator Task)](https://cortex-docs.paloaltonetworks.com/cortex-xdr-agent-ios-guide/7.9/install-and-connect-cortex-xdr-agent-app-for-ios/add-an-agent-settings-security-profile-administrator-task.md): Agent Settings profiles enable you to customize Cortex XDR agent settings for different platforms and groups of users. * [Prepare for Installation (Administrator Task)](https://cortex-docs.paloaltonetworks.com/cortex-xdr-agent-ios-guide/7.9/install-and-connect-cortex-xdr-agent-app-for-ios/prepare-for-installation-administrator-task.md): Learn about the Administrator’s tasks required prior to installation of the Cortex XDR Agent app for iOS. * [Install Cortex XDR Agent iOS App on the iOS Device](https://cortex-docs.paloaltonetworks.com/cortex-xdr-agent-ios-guide/7.9/install-and-connect-cortex-xdr-agent-app-for-ios/install-cortex-xdr-agent-ios-app-on-the-ios-device.md): Use this workflow to install Cortex XDR Agent for iOS on your device. * [Configuration for Installation by MDM (Administrator Task)](https://cortex-docs.paloaltonetworks.com/cortex-xdr-agent-ios-guide/7.9/configuration-for-installation-by-mdm-administrator-task.md): Instructions to configure the Cortex XDR iOS app by MDM. * [Configuration for Installation by JAMF (Administrator Task)](https://cortex-docs.paloaltonetworks.com/cortex-xdr-agent-ios-guide/7.9/configuration-for-installation-by-mdm-administrator-task/configuration-for-installation-by-jamf-administrator-task.md): Instructions to configure Cortex XDR iOS app by JAMF MDM. * [Configure Cortex XDR Agent App for iOS](https://cortex-docs.paloaltonetworks.com/cortex-xdr-agent-ios-guide/7.9/configure-cortex-xdr-agent-app-for-ios.md) * [Configure Phone Call Blocking](https://cortex-docs.paloaltonetworks.com/cortex-xdr-agent-ios-guide/7.9/configure-cortex-xdr-agent-app-for-ios/configure-phone-call-blocking.md): Learn how to configure phone call blocking on iPhones, using the Cortex XDR agent app for iOS. * [Configure Message and Call Reporting](https://cortex-docs.paloaltonetworks.com/cortex-xdr-agent-ios-guide/7.9/configure-cortex-xdr-agent-app-for-ios/configure-message-and-call-reporting.md): Learn how to enable your iPhone to report spam messages. * [Manage Security Events](https://cortex-docs.paloaltonetworks.com/cortex-xdr-agent-ios-guide/7.9/manage-security-events.md) * [Check Your Device](https://cortex-docs.paloaltonetworks.com/cortex-xdr-agent-ios-guide/7.9/manage-security-events/check-your-device.md): Learn about checking Cortex XDR agent app activity on your iOS device. * [View Security Events](https://cortex-docs.paloaltonetworks.com/cortex-xdr-agent-ios-guide/7.9/manage-security-events/view-security-events.md): Learn how to view the security events identified by the Cortex XDR Agent app installed on your iOS device. * [View Device and App Status and Information](https://cortex-docs.paloaltonetworks.com/cortex-xdr-agent-ios-guide/7.9/view-device-and-app-status-and-information.md) * [View Device Information](https://cortex-docs.paloaltonetworks.com/cortex-xdr-agent-ios-guide/7.9/view-device-and-app-status-and-information/view-device-information.md): Learn how to view Cortex XDR agent app for iOS device endpoint information. * [View Connection](https://cortex-docs.paloaltonetworks.com/cortex-xdr-agent-ios-guide/7.9/view-device-and-app-status-and-information/view-connection.md): View general and connection information for your Cortex XDR agent app for iOS. * [Troubleshooting](https://cortex-docs.paloaltonetworks.com/cortex-xdr-agent-ios-guide/7.9/troubleshooting.md): Learn about troubleshooting issues with the Cortex XDR Agent app for iOS. * [Send Logs](https://cortex-docs.paloaltonetworks.com/cortex-xdr-agent-ios-guide/7.9/troubleshooting/send-logs.md): Learn how to send logs from the Cortex XDR Agent app for iOS to Palo Alto Networks for analysis. ## Cortex XDR Agent Android Guides - [Cortex XDR Agent Android Guides](https://cortex-docs.paloaltonetworks.com/cortex-xdr-agent-android-guide/cortex-xdr-agent-android-guides.md) * [Cortex XDR Agent App for Android](https://cortex-docs.paloaltonetworks.com/cortex-xdr-agent-android-guide/9.3/cortex-xdr-agent-app-for-android.md) * [Release Notes for Cortex XDR App for Android](https://cortex-docs.paloaltonetworks.com/cortex-xdr-agent-android-guide/9.3/release-notes-for-cortex-xdr-app-for-android.md) * [Android Requirements](https://cortex-docs.paloaltonetworks.com/cortex-xdr-agent-android-guide/9.3/android-requirements.md) * [Install the Agent App for Android](https://cortex-docs.paloaltonetworks.com/cortex-xdr-agent-android-guide/9.3/install-the-agent-app-for-android.md) * [Deploy Cortex XDR Agent App for Android Using an MDM](https://cortex-docs.paloaltonetworks.com/cortex-xdr-agent-android-guide/9.3/deploy-cortex-xdr-agent-app-for-android-using-an-mdm.md) * [Deploy Cortex XDR Agent App for Android with zero-touch installation](https://cortex-docs.paloaltonetworks.com/cortex-xdr-agent-android-guide/9.3/deploy-cortex-xdr-agent-app-for-android-using-an-mdm/deploy-cortex-xdr-agent-app-for-android-with-zero-touch-installation.md) * [Use the Cortex XDR Agent App for Android](https://cortex-docs.paloaltonetworks.com/cortex-xdr-agent-android-guide/9.3/use-the-cortex-xdr-agent-app-for-android.md) * [Configure and View Settings for the Agent App for Android](https://cortex-docs.paloaltonetworks.com/cortex-xdr-agent-android-guide/9.3/configure-and-view-settings-for-the-agent-app-for-android.md) * [Troubleshooting](https://cortex-docs.paloaltonetworks.com/cortex-xdr-agent-android-guide/9.3/troubleshooting.md) * [Create a Cortex XDR agent tag](https://cortex-docs.paloaltonetworks.com/cortex-xdr-agent-android-guide/9.3/create-a-cortex-xdr-agent-tag.md): Create tags to identify and manage groups of Cortex XDR agents. - [Cortex XDR Agent App for Android](https://cortex-docs.paloaltonetworks.com/cortex-xdr-agent-android-guide/9.2/cortex-xdr-agent-app-for-android.md) - [Release Notes for Cortex XDR App for Android](https://cortex-docs.paloaltonetworks.com/cortex-xdr-agent-android-guide/9.2/release-notes-for-cortex-xdr-app-for-android.md) - [Android Requirements](https://cortex-docs.paloaltonetworks.com/cortex-xdr-agent-android-guide/9.2/android-requirements.md) - [Install the Agent App for Android](https://cortex-docs.paloaltonetworks.com/cortex-xdr-agent-android-guide/9.2/install-the-agent-app-for-android.md) - [Deploy Cortex XDR Agent App for Android Using an MDM](https://cortex-docs.paloaltonetworks.com/cortex-xdr-agent-android-guide/9.2/deploy-cortex-xdr-agent-app-for-android-using-an-mdm.md) - [Deploy Cortex XDR Agent App for Android with zero-touch installation](https://cortex-docs.paloaltonetworks.com/cortex-xdr-agent-android-guide/9.2/deploy-cortex-xdr-agent-app-for-android-using-an-mdm/deploy-cortex-xdr-agent-app-for-android-with-zero-touch-installation.md) - [Use the Cortex XDR Agent App for Android](https://cortex-docs.paloaltonetworks.com/cortex-xdr-agent-android-guide/9.2/use-the-cortex-xdr-agent-app-for-android.md) - [Configure and View Settings for the Agent App for Android](https://cortex-docs.paloaltonetworks.com/cortex-xdr-agent-android-guide/9.2/configure-and-view-settings-for-the-agent-app-for-android.md) - [Troubleshooting](https://cortex-docs.paloaltonetworks.com/cortex-xdr-agent-android-guide/9.2/troubleshooting.md) * [Cortex XDR Agent App for Android](https://cortex-docs.paloaltonetworks.com/cortex-xdr-agent-android-guide/9.1/cortex-xdr-agent-app-for-android.md): Learn about the Cortex XDR agent app for Android-based endpoints. * [Release Notes for Cortex XDR App for Android](https://cortex-docs.paloaltonetworks.com/cortex-xdr-agent-android-guide/9.1/release-notes-for-cortex-xdr-app-for-android.md): Release notes for Cortex XDR agent app for this Android release. * [Android Requirements](https://cortex-docs.paloaltonetworks.com/cortex-xdr-agent-android-guide/9.1/android-requirements.md): Learn about requirements for installing Cortex XDR agent app for Android. * [Install the Cortex XDR Agent App for Android](https://cortex-docs.paloaltonetworks.com/cortex-xdr-agent-android-guide/9.1/install-the-cortex-xdr-agent-app-for-android.md): Learn about the tasks required prior to and during installation of the Cortex XDR agent app for Android. * [Deploy Cortex XDR Agent App for Android Using an MDM](https://cortex-docs.paloaltonetworks.com/cortex-xdr-agent-android-guide/9.1/deploy-cortex-xdr-agent-app-for-android-using-an-mdm.md): For ease of deployment, you can use a mobile device management (MDM) system such as Workspace ONE, to deploy Cortex XDR agent on your managed Android devices. * [Use the Cortex XDR Agent App for Android](https://cortex-docs.paloaltonetworks.com/cortex-xdr-agent-android-guide/9.1/use-the-cortex-xdr-agent-app-for-android.md): Learn about using Cortex XDR agent app for Android after you have installed it. * [Configure and View Settings for the Cortex XDR Agent App for Android](https://cortex-docs.paloaltonetworks.com/cortex-xdr-agent-android-guide/9.1/configure-and-view-settings-for-the-cortex-xdr-agent-app-for-android.md): Learn how to configure and view device settings. * [Troubleshooting](https://cortex-docs.paloaltonetworks.com/cortex-xdr-agent-android-guide/9.1/troubleshooting.md): Learn how to troubleshoot Cortex XDR agent app for Android. - [Cortex XDR Agent App for Android](https://cortex-docs.paloaltonetworks.com/cortex-xdr-agent-android-guide/9.0/cortex-xdr-agent-app-for-android.md): Learn about the Cortex XDR agent app for Android-based endpoints. - [Release Notes for Cortex XDR App for Android](https://cortex-docs.paloaltonetworks.com/cortex-xdr-agent-android-guide/9.0/release-notes-for-cortex-xdr-app-for-android.md): Release notes for Cortex XDR agent app for this Android release. - [Android Requirements](https://cortex-docs.paloaltonetworks.com/cortex-xdr-agent-android-guide/9.0/android-requirements.md): Learn about requirements for installing Cortex XDR agent app for Android. - [Install the Cortex XDR Agent App for Android](https://cortex-docs.paloaltonetworks.com/cortex-xdr-agent-android-guide/9.0/install-the-cortex-xdr-agent-app-for-android.md): Learn about the tasks required prior to and during installation of the Cortex XDR agent app for Android. - [Deploy Cortex XDR Agent App for Android Using an MDM](https://cortex-docs.paloaltonetworks.com/cortex-xdr-agent-android-guide/9.0/deploy-cortex-xdr-agent-app-for-android-using-an-mdm.md): For ease of deployment, you can use a mobile device management (MDM) system such as Workspace ONE, to deploy Cortex XDR agent on your managed Android devices. - [Use the Cortex XDR Agent App for Android](https://cortex-docs.paloaltonetworks.com/cortex-xdr-agent-android-guide/9.0/use-the-cortex-xdr-agent-app-for-android.md): Learn about using Cortex XDR agent app for Android after you have installed it. - [Configure and View Settings for the Cortex XDR Agent App for Android](https://cortex-docs.paloaltonetworks.com/cortex-xdr-agent-android-guide/9.0/configure-and-view-settings-for-the-cortex-xdr-agent-app-for-android.md): Learn how to configure and view device settings. - [Troubleshooting](https://cortex-docs.paloaltonetworks.com/cortex-xdr-agent-android-guide/9.0/troubleshooting.md): Learn how to troubleshoot Cortex XDR agent app for Android. * [Cortex XDR Agent App for Android](https://cortex-docs.paloaltonetworks.com/cortex-xdr-agent-android-guide/8.9/cortex-xdr-agent-app-for-android.md): Learn about the Cortex XDR agent app for Android-based endpoints. * [Release Notes for Cortex XDR App for Android](https://cortex-docs.paloaltonetworks.com/cortex-xdr-agent-android-guide/8.9/release-notes-for-cortex-xdr-app-for-android.md): Release notes for Cortex XDR agent app for this Android release. * [Features Introduced in Cortex XDR App for Android](https://cortex-docs.paloaltonetworks.com/cortex-xdr-agent-android-guide/8.9/release-notes-for-cortex-xdr-app-for-android/features-introduced-in-cortex-xdr-app-for-android.md): Release notes for Cortex XDR agent app for this Android release. * [Android Requirements](https://cortex-docs.paloaltonetworks.com/cortex-xdr-agent-android-guide/8.9/android-requirements.md): Learn about requirements for installing Cortex XDR agent app for Android. * [Install the Cortex XDR Agent App for Android](https://cortex-docs.paloaltonetworks.com/cortex-xdr-agent-android-guide/8.9/install-the-cortex-xdr-agent-app-for-android.md): Learn about the tasks required prior to and during installation of the Cortex XDR agent app for Android. * [Deploy Cortex XDR Agent App for Android Using an MDM](https://cortex-docs.paloaltonetworks.com/cortex-xdr-agent-android-guide/8.9/deploy-cortex-xdr-agent-app-for-android-using-an-mdm.md): For ease of deployment, you can use a mobile device management (MDM) system such as Workspace ONE, to deploy Cortex XDR agent on your managed Android devices. * [Use the Cortex XDR Agent App for Android](https://cortex-docs.paloaltonetworks.com/cortex-xdr-agent-android-guide/8.9/use-the-cortex-xdr-agent-app-for-android.md): Learn about using Cortex XDR agent app for Android after you have installed it. * [Configure and View Settings for the Cortex XDR Agent App for Android](https://cortex-docs.paloaltonetworks.com/cortex-xdr-agent-android-guide/8.9/configure-and-view-settings-for-the-cortex-xdr-agent-app-for-android.md): Learn how to configure and view device settings. * [Troubleshooting](https://cortex-docs.paloaltonetworks.com/cortex-xdr-agent-android-guide/8.9/troubleshooting.md): Learn how to troubleshoot Cortex XDR agent app for Android. - [Cortex XDR Agent App for Android](https://cortex-docs.paloaltonetworks.com/cortex-xdr-agent-android-guide/8.8/cortex-xdr-agent-app-for-android.md): Learn about the Cortex XDR agent app for Android-based endpoints. - [Release Notes for Cortex XDR App for Android](https://cortex-docs.paloaltonetworks.com/cortex-xdr-agent-android-guide/8.8/release-notes-for-cortex-xdr-app-for-android.md): Release notes for Cortex XDR agent app for this Android release. - [Features Introduced in Cortex XDR App for Android](https://cortex-docs.paloaltonetworks.com/cortex-xdr-agent-android-guide/8.8/release-notes-for-cortex-xdr-app-for-android/features-introduced-in-cortex-xdr-app-for-android.md): Release notes for Cortex XDR agent app for this Android release. - [Android Requirements](https://cortex-docs.paloaltonetworks.com/cortex-xdr-agent-android-guide/8.8/android-requirements.md): Learn about requirements for installing Cortex XDR agent app for Android. - [Install the Cortex XDR Agent App for Android](https://cortex-docs.paloaltonetworks.com/cortex-xdr-agent-android-guide/8.8/install-the-cortex-xdr-agent-app-for-android.md): Learn about the tasks required prior to and during installation of the Cortex XDR agent app for Android. - [Deploy Cortex XDR Agent App for Android Using an MDM](https://cortex-docs.paloaltonetworks.com/cortex-xdr-agent-android-guide/8.8/deploy-cortex-xdr-agent-app-for-android-using-an-mdm.md): For ease of deployment, you can use a mobile device management (MDM) system such as Workspace ONE, to deploy Cortex XDR agent on your managed Android devices. - [Use the Cortex XDR Agent App for Android](https://cortex-docs.paloaltonetworks.com/cortex-xdr-agent-android-guide/8.8/use-the-cortex-xdr-agent-app-for-android.md): Learn about using Cortex XDR agent app for Android after you have installed it. - [Configure and View Settings for the Cortex XDR Agent App for Android](https://cortex-docs.paloaltonetworks.com/cortex-xdr-agent-android-guide/8.8/configure-and-view-settings-for-the-cortex-xdr-agent-app-for-android.md): Learn how to configure and view device settings. - [Troubleshooting](https://cortex-docs.paloaltonetworks.com/cortex-xdr-agent-android-guide/8.8/troubleshooting.md): Learn how to troubleshoot Cortex XDR agent app for Android. * [Cortex XDR Agent App for Android](https://cortex-docs.paloaltonetworks.com/cortex-xdr-agent-android-guide/8.7/cortex-xdr-agent-app-for-android.md): Learn about the Cortex XDR agent app for Android-based endpoints. * [Release Notes for Cortex XDR App for Android](https://cortex-docs.paloaltonetworks.com/cortex-xdr-agent-android-guide/8.7/release-notes-for-cortex-xdr-app-for-android.md): Release notes for Cortex XDR agent app for this Android release. * [Android Requirements](https://cortex-docs.paloaltonetworks.com/cortex-xdr-agent-android-guide/8.7/android-requirements.md): Learn about requirements for installing Cortex XDR agent app for Android. * [Install the Cortex XDR Agent App for Android](https://cortex-docs.paloaltonetworks.com/cortex-xdr-agent-android-guide/8.7/install-the-cortex-xdr-agent-app-for-android.md): Learn about the tasks required prior to and during installation of the Cortex XDR agent app for Android. * [Deploy Cortex XDR Agent App for Android Using an MDM](https://cortex-docs.paloaltonetworks.com/cortex-xdr-agent-android-guide/8.7/deploy-cortex-xdr-agent-app-for-android-using-an-mdm.md): For ease of deployment, you can use a mobile device management (MDM) system such as Workspace ONE, to deploy Cortex XDR agent on your managed Android devices. * [Use the Cortex XDR Agent App for Android](https://cortex-docs.paloaltonetworks.com/cortex-xdr-agent-android-guide/8.7/use-the-cortex-xdr-agent-app-for-android.md): Learn about using Cortex XDR agent app for Android after you have installed it. * [Configure and View Settings for the Cortex XDR Agent App for Android](https://cortex-docs.paloaltonetworks.com/cortex-xdr-agent-android-guide/8.7/configure-and-view-settings-for-the-cortex-xdr-agent-app-for-android.md): Learn how to configure and view device settings. * [Troubleshooting](https://cortex-docs.paloaltonetworks.com/cortex-xdr-agent-android-guide/8.7/troubleshooting.md): Learn how to troubleshoot Cortex XDR agent app for Android. - [Cortex XDR Agent App for Android](https://cortex-docs.paloaltonetworks.com/cortex-xdr-agent-android-guide/8.6/cortex-xdr-agent-app-for-android.md): Learn about the Cortex XDR agent app for Android-based endpoints. - [Release Notes for Cortex XDR App for Android](https://cortex-docs.paloaltonetworks.com/cortex-xdr-agent-android-guide/8.6/release-notes-for-cortex-xdr-app-for-android.md): Release notes for Cortex XDR agent app for this Android release. - [Android Requirements](https://cortex-docs.paloaltonetworks.com/cortex-xdr-agent-android-guide/8.6/android-requirements.md): Learn about requirements for installing Cortex XDR agent app for Android. - [Install the Cortex XDR Agent App for Android](https://cortex-docs.paloaltonetworks.com/cortex-xdr-agent-android-guide/8.6/install-the-cortex-xdr-agent-app-for-android.md): Learn about the tasks required prior to and during installation of the Cortex XDR agent app for Android. - [Deploy Cortex XDR Agent App for Android Using an MDM](https://cortex-docs.paloaltonetworks.com/cortex-xdr-agent-android-guide/8.6/deploy-cortex-xdr-agent-app-for-android-using-an-mdm.md): For ease of deployment, you can use a mobile device management (MDM) system such as Workspace ONE, to deploy Cortex XDR agent on your managed Android devices. - [Use the Cortex XDR Agent App for Android](https://cortex-docs.paloaltonetworks.com/cortex-xdr-agent-android-guide/8.6/use-the-cortex-xdr-agent-app-for-android.md): Learn about using Cortex XDR agent app for Android after you have installed it. - [Configure and View Settings for the Cortex XDR Agent App for Android](https://cortex-docs.paloaltonetworks.com/cortex-xdr-agent-android-guide/8.6/configure-and-view-settings-for-the-cortex-xdr-agent-app-for-android.md): Learn how to configure and view device settings. - [Troubleshooting](https://cortex-docs.paloaltonetworks.com/cortex-xdr-agent-android-guide/8.6/troubleshooting.md): Learn how to troubleshoot Cortex XDR agent app for Android. * [Cortex XDR Agent App for Android](https://cortex-docs.paloaltonetworks.com/cortex-xdr-agent-android-guide/8.5/cortex-xdr-agent-app-for-android.md): Learn about the Cortex XDR agent app for Android-based endpoints. * [Release Notes for Cortex XDR App for Android](https://cortex-docs.paloaltonetworks.com/cortex-xdr-agent-android-guide/8.5/release-notes-for-cortex-xdr-app-for-android.md): Release notes for Cortex XDR agent app for this Android release. * [Android Requirements](https://cortex-docs.paloaltonetworks.com/cortex-xdr-agent-android-guide/8.5/android-requirements.md): Learn about requirements for installing Cortex XDR agent app for Android. * [Install the Cortex XDR Agent App for Android](https://cortex-docs.paloaltonetworks.com/cortex-xdr-agent-android-guide/8.5/install-the-cortex-xdr-agent-app-for-android.md): Learn about the tasks required prior to and during installation of the Cortex XDR agent app for Android. * [Deploy Cortex XDR Agent App for Android Using an MDM](https://cortex-docs.paloaltonetworks.com/cortex-xdr-agent-android-guide/8.5/deploy-cortex-xdr-agent-app-for-android-using-an-mdm.md): For ease of deployment, you can use a mobile device management (MDM) system such as Workspace ONE, to deploy Cortex XDR agent on your managed Android devices. * [Use the Cortex XDR Agent App for Android](https://cortex-docs.paloaltonetworks.com/cortex-xdr-agent-android-guide/8.5/use-the-cortex-xdr-agent-app-for-android.md): Learn about using Cortex XDR agent app for Android after you have installed it. * [Configure and View Settings for the Cortex XDR Agent App for Android](https://cortex-docs.paloaltonetworks.com/cortex-xdr-agent-android-guide/8.5/configure-and-view-settings-for-the-cortex-xdr-agent-app-for-android.md): Learn how to configure and view device settings. * [Troubleshooting](https://cortex-docs.paloaltonetworks.com/cortex-xdr-agent-android-guide/8.5/troubleshooting.md): Learn how to troubleshoot Cortex XDR agent app for Android. - [Cortex XDR Agent App for Android](https://cortex-docs.paloaltonetworks.com/cortex-xdr-agent-android-guide/8.4/cortex-xdr-agent-app-for-android.md): Learn about the Cortex XDR agent app for Android-based endpoints. - [Release Notes for Cortex XDR App for Android](https://cortex-docs.paloaltonetworks.com/cortex-xdr-agent-android-guide/8.4/release-notes-for-cortex-xdr-app-for-android.md): Release notes for Cortex XDR agent app for this Android release. - [Features and Enhancements Introduced in Cortex XDR App for Android](https://cortex-docs.paloaltonetworks.com/cortex-xdr-agent-android-guide/8.4/release-notes-for-cortex-xdr-app-for-android/features-and-enhancements-introduced-in-cortex-xdr-app-for-android.md): Release notes for Cortex XDR agent app for this Android release. - [Android Requirements](https://cortex-docs.paloaltonetworks.com/cortex-xdr-agent-android-guide/8.4/android-requirements.md): Learn about requirements for installing Cortex XDR agent app for Android. - [Install the Cortex XDR Agent App for Android](https://cortex-docs.paloaltonetworks.com/cortex-xdr-agent-android-guide/8.4/install-the-cortex-xdr-agent-app-for-android.md): Learn about the tasks required prior to and during installation of the Cortex XDR agent app for Android. - [Deploy Cortex XDR Agent App for Android Using an MDM](https://cortex-docs.paloaltonetworks.com/cortex-xdr-agent-android-guide/8.4/deploy-cortex-xdr-agent-app-for-android-using-an-mdm.md): For ease of deployment, you can use a mobile device management (MDM) system such as Workspace ONE, to deploy Cortex XDR agent on your managed Android devices. - [Use the Cortex XDR Agent App for Android](https://cortex-docs.paloaltonetworks.com/cortex-xdr-agent-android-guide/8.4/use-the-cortex-xdr-agent-app-for-android.md): Learn about using Cortex XDR agent app for Android after you have installed it. - [Configure and View Settings for the Cortex XDR Agent App for Android](https://cortex-docs.paloaltonetworks.com/cortex-xdr-agent-android-guide/8.4/configure-and-view-settings-for-the-cortex-xdr-agent-app-for-android.md): Learn how to configure and view device settings. - [Troubleshooting](https://cortex-docs.paloaltonetworks.com/cortex-xdr-agent-android-guide/8.4/troubleshooting.md): Learn how to troubleshoot Cortex XDR agent app for Android. * [Cortex XDR Agent App for Android](https://cortex-docs.paloaltonetworks.com/cortex-xdr-agent-android-guide/8.3/cortex-xdr-agent-app-for-android.md): Learn about the Cortex XDR agent app for Android-based endpoints. * [Release Notes for Cortex XDR App for Android](https://cortex-docs.paloaltonetworks.com/cortex-xdr-agent-android-guide/8.3/release-notes-for-cortex-xdr-app-for-android.md): Release notes for Cortex XDR agent app for this Android release. * [Android Requirements](https://cortex-docs.paloaltonetworks.com/cortex-xdr-agent-android-guide/8.3/android-requirements.md): Learn about requirements for installing Cortex XDR agent app for Android. * [Install the Cortex XDR Agent App for Android](https://cortex-docs.paloaltonetworks.com/cortex-xdr-agent-android-guide/8.3/install-the-cortex-xdr-agent-app-for-android.md): Learn about the tasks required prior to and during installation of the Cortex XDR agent app for Android. * [Deploy Cortex XDR Agent App for Android Using an MDM](https://cortex-docs.paloaltonetworks.com/cortex-xdr-agent-android-guide/8.3/deploy-cortex-xdr-agent-app-for-android-using-an-mdm.md): For ease of deployment, you can use a mobile device management (MDM) system such as Workspace ONE, to deploy Cortex XDR agent on your managed Android devices. * [Use the Cortex XDR Agent App for Android](https://cortex-docs.paloaltonetworks.com/cortex-xdr-agent-android-guide/8.3/use-the-cortex-xdr-agent-app-for-android.md): Learn about using Cortex XDR agent app for Android after you have installed it. * [Configure and View Settings for the Cortex XDR Agent App for Android](https://cortex-docs.paloaltonetworks.com/cortex-xdr-agent-android-guide/8.3/configure-and-view-settings-for-the-cortex-xdr-agent-app-for-android.md): Learn how to configure and view device settings. * [Troubleshooting](https://cortex-docs.paloaltonetworks.com/cortex-xdr-agent-android-guide/8.3/troubleshooting.md): Learn how to troubleshoot Cortex XDR agent app for Android. - [Cortex XDR Agent App for Android](https://cortex-docs.paloaltonetworks.com/cortex-xdr-agent-android-guide/8.2/cortex-xdr-agent-app-for-android.md): Learn about the Cortex XDR agent app for Android-based endpoints. - [Release Notes for Cortex XDR App for Android](https://cortex-docs.paloaltonetworks.com/cortex-xdr-agent-android-guide/8.2/release-notes-for-cortex-xdr-app-for-android.md): Release notes for Cortex XDR agent app for this Android release. - [Features and Enhancements Introduced in Cortex XDR App for Android](https://cortex-docs.paloaltonetworks.com/cortex-xdr-agent-android-guide/8.2/release-notes-for-cortex-xdr-app-for-android/features-and-enhancements-introduced-in-cortex-xdr-app-for-android.md): Release notes for Cortex XDR agent app for this Android release. - [Android Requirements](https://cortex-docs.paloaltonetworks.com/cortex-xdr-agent-android-guide/8.2/android-requirements.md): Learn about requirements for installing Cortex XDR agent app for Android. - [Install the Cortex XDR Agent App for Android](https://cortex-docs.paloaltonetworks.com/cortex-xdr-agent-android-guide/8.2/install-the-cortex-xdr-agent-app-for-android.md): Learn about the tasks required prior to and during installation of the Cortex XDR agent app for Android. - [Deploy Cortex XDR Agent App for Android Using an MDM](https://cortex-docs.paloaltonetworks.com/cortex-xdr-agent-android-guide/8.2/deploy-cortex-xdr-agent-app-for-android-using-an-mdm.md): For ease of deployment, you can use a mobile device management (MDM) system such as Workspace ONE, to deploy Cortex XDR agent on your managed Android devices. - [Use the Cortex XDR Agent App for Android](https://cortex-docs.paloaltonetworks.com/cortex-xdr-agent-android-guide/8.2/use-the-cortex-xdr-agent-app-for-android.md): Learn about using Cortex XDR agent app for Android after you have installed it. - [Configure and View Settings for the Cortex XDR Agent App for Android](https://cortex-docs.paloaltonetworks.com/cortex-xdr-agent-android-guide/8.2/configure-and-view-settings-for-the-cortex-xdr-agent-app-for-android.md): Learn how to configure and view device settings. - [Troubleshooting](https://cortex-docs.paloaltonetworks.com/cortex-xdr-agent-android-guide/8.2/troubleshooting.md): Learn how to troubleshoot Cortex XDR agent app for Android. * [Cortex XDR Agent App for Android](https://cortex-docs.paloaltonetworks.com/cortex-xdr-agent-android-guide/8.1/cortex-xdr-agent-app-for-android.md): Learn about the Cortex XDR agent app for Android-based endpoints. * [Release Notes](https://cortex-docs.paloaltonetworks.com/cortex-xdr-agent-android-guide/8.1/release-notes.md): Release notes for Cortex XDR agent app for Android releases. * [Features Introduced in Cortex XDR App for Android](https://cortex-docs.paloaltonetworks.com/cortex-xdr-agent-android-guide/8.1/release-notes/features-introduced-in-cortex-xdr-app-for-android.md): Release notes for Cortex XDR agent app for Android releases. * [Android Requirements](https://cortex-docs.paloaltonetworks.com/cortex-xdr-agent-android-guide/8.1/android-requirements.md): Learn about requirements for installing Cortex XDR agent app for Android. * [Install the Cortex XDR Agent App for Android](https://cortex-docs.paloaltonetworks.com/cortex-xdr-agent-android-guide/8.1/install-the-cortex-xdr-agent-app-for-android.md): Learn about the tasks required prior to and during installation of the Cortex XDR agent app for Android. * [Deploy Cortex XDR Agent App for Android Using an MDM](https://cortex-docs.paloaltonetworks.com/cortex-xdr-agent-android-guide/8.1/deploy-cortex-xdr-agent-app-for-android-using-an-mdm.md): For ease of deployment, you can use a mobile device management (MDM) system such as Workspace ONE, to deploy Cortex XDR agent on your managed Android devices. * [Use the Cortex XDR Agent App for Android](https://cortex-docs.paloaltonetworks.com/cortex-xdr-agent-android-guide/8.1/use-the-cortex-xdr-agent-app-for-android.md): Learn about using Cortex XDR agent app for Android after you have installed it. * [Configure and View Settings for the Cortex XDR Agent App for Android](https://cortex-docs.paloaltonetworks.com/cortex-xdr-agent-android-guide/8.1/configure-and-view-settings-for-the-cortex-xdr-agent-app-for-android.md): Learn how to configure and view device settings. * [Troubleshooting](https://cortex-docs.paloaltonetworks.com/cortex-xdr-agent-android-guide/8.1/troubleshooting.md): Learn how to troubleshoot Cortex XDR agent app for Android. - [Cortex XDR Agent App for Android](https://cortex-docs.paloaltonetworks.com/cortex-xdr-agent-android-guide/8.0/cortex-xdr-agent-app-for-android.md): Learn about the Cortex XDR agent app for Android-based endpoints. - [Release Notes](https://cortex-docs.paloaltonetworks.com/cortex-xdr-agent-android-guide/8.0/release-notes.md): Release notes for Cortex XDR agent app for Android releases. - [Features Introduced in Cortex XDR App for Android](https://cortex-docs.paloaltonetworks.com/cortex-xdr-agent-android-guide/8.0/release-notes/features-introduced-in-cortex-xdr-app-for-android.md): Release notes for Cortex XDR agent app for Android releases. - [Android Requirements](https://cortex-docs.paloaltonetworks.com/cortex-xdr-agent-android-guide/8.0/android-requirements.md): Learn about requirements for installing Cortex XDR agent app for Android. - [Install the Cortex XDR Agent App for Android](https://cortex-docs.paloaltonetworks.com/cortex-xdr-agent-android-guide/8.0/install-the-cortex-xdr-agent-app-for-android.md): Learn about the tasks required prior to and during installation of the Cortex XDR agent app for Android. - [Deploy Cortex XDR Agent App for Android Using an MDM](https://cortex-docs.paloaltonetworks.com/cortex-xdr-agent-android-guide/8.0/deploy-cortex-xdr-agent-app-for-android-using-an-mdm.md): For ease of deployment, you can use a mobile device management (MDM) system such as Workspace ONE (formerly AirWatch), to deploy the Cortex XDR agent app to your managed Android devices. - [Use the Cortex XDR Agent App for Android](https://cortex-docs.paloaltonetworks.com/cortex-xdr-agent-android-guide/8.0/use-the-cortex-xdr-agent-app-for-android.md) - [Configure and View Settings for the Cortex XDR Agent App for Android](https://cortex-docs.paloaltonetworks.com/cortex-xdr-agent-android-guide/8.0/configure-and-view-settings-for-the-cortex-xdr-agent-app-for-android.md): Learn how to configure and view device settings. - [Troubleshooting](https://cortex-docs.paloaltonetworks.com/cortex-xdr-agent-android-guide/8.0/troubleshooting.md): Learn how to troubleshoot Cortex XDR agent app for Android. * [Cortex XDR Agent App 7.1.3 for Android](https://cortex-docs.paloaltonetworks.com/cortex-xdr-agent-android-guide/7.1.3/cortex-xdr-agent-app-7.1.3-for-android.md) * [Release Notes](https://cortex-docs.paloaltonetworks.com/cortex-xdr-agent-android-guide/7.1.3/release-notes.md): Release notes for Cortex XDR app 7.1 for Android releases. * [Android Requirements](https://cortex-docs.paloaltonetworks.com/cortex-xdr-agent-android-guide/7.1.3/android-requirements.md): Learn about requirements for installing Cortex XDR agent app for Android. * [Install Cortex XDR Agent App 7.1 for Android](https://cortex-docs.paloaltonetworks.com/cortex-xdr-agent-android-guide/7.1.3/install-cortex-xdr-agent-app-7.1-for-android.md): Use this workflow to install Cortex XDR 7.1 for Android. * [Deploy Cortex XDR Agent App 7.1 for Android Using an MDM](https://cortex-docs.paloaltonetworks.com/cortex-xdr-agent-android-guide/7.1.3/deploy-cortex-xdr-agent-app-7.1-for-android-using-an-mdm.md): For ease of deployment, you can use a mobile device management (MDM) system such as AirWatch, to deploy the Cortex XDR app to your managed Android devices. * [Use the Cortex XDR Agent App 7.1 for Android](https://cortex-docs.paloaltonetworks.com/cortex-xdr-agent-android-guide/7.1.3/use-the-cortex-xdr-agent-app-7.1-for-android.md) * [Troubleshooting](https://cortex-docs.paloaltonetworks.com/cortex-xdr-agent-android-guide/7.1.3/troubleshooting.md) ## Cortex XDR Agent OSS Listings - [Cortex XDR OSS Listings](https://cortex-docs.paloaltonetworks.com/cortex-xdr-agent-oss-listings/cortex-xdr-oss-listings.md): Open-Source Software (OSS) licensing for Cortex XDR. - [Cortex XDR Agent 9.3 OSS Listing](https://cortex-docs.paloaltonetworks.com/cortex-xdr-agent-oss-listings/cortex-xdr-agent-9.2-oss-listing.md) - [Cortex XDR Agent 9.2 OSS Listing](https://cortex-docs.paloaltonetworks.com/cortex-xdr-agent-oss-listings/cortex-xdr-agent-9.2-oss-listing-1.md) - [Cortex XDR Agent 9.1 OSS Listing](https://cortex-docs.paloaltonetworks.com/cortex-xdr-agent-oss-listings/cortex-xdr-agent-9.1-oss-listing.md) - [Cortex XDR Agent 9.0 OSS Listing](https://cortex-docs.paloaltonetworks.com/cortex-xdr-agent-oss-listings/cortex-xdr-agent-9.0-oss-listing.md) - [Cortex XDR Agent 8.9 OSS Listing](https://cortex-docs.paloaltonetworks.com/cortex-xdr-agent-oss-listings/cortex-xdr-agent-8.9-oss-listing.md): Open-Source Software (OSS) licensing for the Cortex XDR agent 8.9 release. - [Cortex XDR Agent 8.8 OSS Listing](https://cortex-docs.paloaltonetworks.com/cortex-xdr-agent-oss-listings/cortex-xdr-agent-8.8-oss-listing.md): Open-Source Software (OSS) licensing for the Cortex XDR agent 8.8 release. - [Cortex XDR Agent 8.7 OSS Listing](https://cortex-docs.paloaltonetworks.com/cortex-xdr-agent-oss-listings/cortex-xdr-agent-8.7-oss-listing.md): Open-Source Software (OSS) licensing for the Cortex XDR agent 8.7 release. - [Cortex XDR Agent 8.3 OSS Listing](https://cortex-docs.paloaltonetworks.com/cortex-xdr-agent-oss-listings/cortex-xdr-agent-8.3-oss-listing.md): Open-Source Software (OSS) licensing for the Cortex XDR agent 8.3 release. - [Cortex XDR Agent 7.9 OSS Listing](https://cortex-docs.paloaltonetworks.com/cortex-xdr-agent-oss-listings/cortex-xdr-agent-7.9-oss-listing.md): Open-Source Software (OSS) licensing for the Cortex XDR agent 7.9 release. ## Cortex XSOAR 8 SaaS Documentation - [Navigate the Cortex XSOAR 8 SaaS docs](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-saas/learn-about-cortex-xsoar/readme.md): Start here for a visual overview of the main Cortex XSOAR 8 SaaS documentation areas. - [Get Started with Cortex XSOAR](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-saas/learn-about-cortex-xsoar/learn-about-cortex-xsoar.md): View information about how to get started with Cortex XSOAR 8 SaaS, such as service limits, data retention policy, and licenses. - [What is Cortex XSOAR?](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-saas/learn-about-cortex-xsoar/what-is-cortex-xsoar.md): Learn about Cortex XSOAR 8 SaaS features. - [Cortex XSOAR architecture](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-saas/learn-about-cortex-xsoar/cortex-xsoar-architecture.md): Describes the Cortex XSOAR 8 SaaS architecture. - [Cortex XSOAR use cases](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-saas/learn-about-cortex-xsoar/cortex-xsoar-use-cases.md): Recommended ways to automate your SOC in Cortex XSOAR 8 SaaS. - [Understand Cortex XSOAR licenses](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-saas/learn-about-cortex-xsoar/understand-cortex-xsoar-licenses.md): The Cortex XSOAR 8 SaaS license is downloaded from Cortex Gateway and determines which components users can use and how many users can access the tenant. - [Roles and responsibilities](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-saas/learn-about-cortex-xsoar/roles-and-responsibilities.md): Learn about the typical core roles that make up a SOC team. - [Cortex XSOAR service limits](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-saas/learn-about-cortex-xsoar/cortex-xsoar-service-limits.md): Describes the service limits for Cortex XSOAR 8 SaaS. - [Data retention policy](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-saas/learn-about-cortex-xsoar/data-retention-policy.md): Cortex XSOAR 8 SaaS retention policy and enforcement - [Cortex service-level agreement](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-saas/learn-about-cortex-xsoar/cortex-service-level-agreement.md): Describes the SLA agreement for all Cortex products including Cortex XSOAR 8 SaaS. - [Supported ciphers](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-saas/learn-about-cortex-xsoar/supported-ciphers.md): Supported TLS 1.2 and TLS 1.3 cipher suites for Cortex XSOAR 8 SaaS. - [Supported web browsers](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-saas/learn-about-cortex-xsoar/supported-web-browsers.md): Supported browser versions for Cortex XSOAR 8 SaaS and HTTP/2 performance requirements. - [How to onboard XSOAR](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-saas/onboard-cortex-xsoar/onboard-and-configure-cortex-xsoar.md): Follow the steps to successfully onboard and configure Cortex XSOAR 8 SaaS. - [Plan and prepare your deployment](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-saas/onboard-cortex-xsoar/plan-and-prepare-your-deployment.md): Before deploying your tenant, consider your use case and what you need to optimize your tenant for Cortex XSOAR 8 SaaS. - [Deployment Steps](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-saas/onboard-cortex-xsoar/deployment-steps.md): Review the plan and prepare considerations, and then follow the steps in the onboarding checklist to successfully deploy and onboard Cortex XSOAR 8 SaaS. - [Onboarding checklist](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-saas/onboard-cortex-xsoar/deployment-steps/onboarding-checklist.md): Activate, provision, grant access, and configure Cortex XSOAR 8 SaaS. - [Step 1: Activate Cortex XSOAR](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-saas/onboard-cortex-xsoar/deployment-steps/step-1-activate-cortex-xsoar.md): Learn how to activate your Cortex XSOAR 8 SaaS tenant. - [Supported host regions](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-saas/onboard-cortex-xsoar/deployment-steps/step-1-activate-cortex-xsoar/supported-host-regions.md): View Cortex XSOAR 8 SaaS host regions and data residency locations for stored data. - [Enable access to Palo Alto Networks resources](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-saas/onboard-cortex-xsoar/deployment-steps/step-1-activate-cortex-xsoar/enable-access-to-palo-alto-networks-resources.md): Enable network access to Cortex XSOAR 8 SaaS resources for your environment. - [Step 2. Set up an engine](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-saas/onboard-cortex-xsoar/deployment-steps/step-2.-set-up-an-engine.md): Set up a Cortex XSOAR 8 SaaS engine on a remote machine. - [Step 3. Set up a remote repository](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-saas/onboard-cortex-xsoar/deployment-steps/step-3.-set-up-a-remote-repository.md): Set up Cortex XSOAR 8 SaaS content management for development and production environments. - [Step 4. Set up users and roles](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-saas/onboard-cortex-xsoar/deployment-steps/step-4.-set-up-users-and-roles.md): Set up Cortex XSOAR 8 SaaS roles, user groups, authentication, and users. - [Step 5. Install and configure content](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-saas/onboard-cortex-xsoar/deployment-steps/step-5.-install-and-configure-content.md): Learn what content includes in Cortex XSOAR 8 SaaS. - [Install content packs](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-saas/onboard-cortex-xsoar/deployment-steps/step-5.-install-and-configure-content/install-content-packs.md): Install a content pack in Cortex XSOAR 8 SaaS. - [Set up your use case with the Deployment Wizard](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-saas/onboard-cortex-xsoar/deployment-steps/step-5.-install-and-configure-content/set-up-your-use-case-with-the-deployment-wizard.md): Use the Cortex XSOAR 8 SaaS Deployment Wizard to adopt your use case. - [Post deployment](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-saas/onboard-cortex-xsoar/post-deployment.md): Configure optional Cortex XSOAR 8 SaaS communication and system settings after onboarding. - [User communication](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-saas/onboard-cortex-xsoar/post-deployment/user-communication.md): Configure Cortex XSOAR 8 SaaS notifications and system emails. - [Configure notifications in Cortex XSOAR](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-saas/onboard-cortex-xsoar/post-deployment/user-communication/configure-notifications-in-cortex-xsoar.md): Configure email and message notifications in Cortex XSOAR 8 SaaS. - [Customize system emails](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-saas/onboard-cortex-xsoar/post-deployment/user-communication/customize-system-emails.md): Customize system email subjects and content in Cortex XSOAR 8 SaaS. - [Configure system settings](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-saas/onboard-cortex-xsoar/post-deployment/configure-system-settings.md): Configure Cortex XSOAR 8 SaaS security and server settings. - [Configure security settings](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-saas/onboard-cortex-xsoar/post-deployment/configure-system-settings/configure-security-settings.md): Configure Cortex XSOAR 8 SaaS session, access, and user security settings. - [Configure server settings](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-saas/onboard-cortex-xsoar/post-deployment/configure-system-settings/configure-server-settings.md): Configure Cortex XSOAR 8 SaaS server settings and user preferences. - [Engines](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-saas/configure-cortex-xsoar/engines.md): Install, manage, configure, and troubleshoot Cortex XSOAR 8 SaaS engines. - [What is an engine?](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-saas/configure-cortex-xsoar/engines/what-is-an-engine.md): Learn how an engine connects Cortex XSOAR 8 SaaS to remote resources. - [Engine requirements](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-saas/configure-cortex-xsoar/engines/engine-requirements.md): Review hardware, operating system, and URL requirements for Cortex XSOAR 8 SaaS engines. - [Install an engine](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-saas/configure-cortex-xsoar/engines/install-an-engine.md): Install, deploy, and configure Cortex XSOAR 8 SaaS engines. - [Docker](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-saas/configure-cortex-xsoar/engines/install-an-engine/docker.md): Install, configure, secure, and troubleshoot Docker for Cortex XSOAR 8 SaaS engines. - [Install Docker](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-saas/configure-cortex-xsoar/engines/install-an-engine/docker/install-docker.md): Install Docker for a Cortex XSOAR 8 SaaS engine. - [Install Docker distribution for Red Hat on an engine server](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-saas/configure-cortex-xsoar/engines/install-an-engine/docker/install-docker-distribution-for-red-hat-on-an-engine-server.md): Install Docker on a Red Hat Cortex XSOAR 8 SaaS engine server. - [Docker image security](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-saas/configure-cortex-xsoar/engines/install-an-engine/docker/docker-image-security.md): Secure Docker images used by Cortex XSOAR 8 SaaS engines. - [Use the Cortex XSOAR Container Registry](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-saas/configure-cortex-xsoar/engines/install-an-engine/docker/use-the-cortex-xsoar-container-registry.md): Use the Cortex XSOAR 8 SaaS Container Registry for engine images. - [Docker FAQs](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-saas/configure-cortex-xsoar/engines/install-an-engine/docker/docker-faqs.md): Find Docker answers for Cortex XSOAR 8 SaaS engines. - [Troubleshoot Docker issues](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-saas/configure-cortex-xsoar/engines/install-an-engine/docker/troubleshoot-docker-issues.md): Troubleshoot Docker issues on Cortex XSOAR 8 SaaS engines. - [Configure Docker pull rate limit](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-saas/configure-cortex-xsoar/engines/install-an-engine/docker/configure-docker-pull-rate-limit.md): Configure Docker pull rate limits for Cortex XSOAR 8 SaaS engines. - [Change the Docker installation folder](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-saas/configure-cortex-xsoar/engines/install-an-engine/docker/change-the-docker-installation-folder.md): Change the Docker installation folder on a Cortex XSOAR 8 SaaS engine. - [Configure Docker integrations to trust custom certificates](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-saas/configure-cortex-xsoar/engines/install-an-engine/docker/configure-docker-integrations-to-trust-custom-certificates.md): Configure Docker integrations to trust custom certificates in Cortex XSOAR 8 SaaS. - [Docker hardening guide](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-saas/configure-cortex-xsoar/engines/install-an-engine/docker/docker-hardening-guide.md): Harden Docker for Cortex XSOAR 8 SaaS engines. - [Podman](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-saas/configure-cortex-xsoar/engines/install-an-engine/podman.md): Run Podman containers instead of Docker for Cortex XSOAR 8 SaaS engines on RHEL 8. - [Change container storage directory](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-saas/configure-cortex-xsoar/engines/install-an-engine/podman/change-container-storage-directory.md): Change the container storage directory for a Cortex XSOAR 8 SaaS engine. - [Install Podman](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-saas/configure-cortex-xsoar/engines/install-an-engine/podman/install-podman.md): Install Podman for a Cortex XSOAR 8 SaaS engine. - [Migrate From Docker to Podman](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-saas/configure-cortex-xsoar/engines/install-an-engine/podman/migrate-from-docker-to-podman.md): Migrate a Cortex XSOAR 8 SaaS engine from Docker to Podman. - [Troubleshoot Podman](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-saas/configure-cortex-xsoar/engines/install-an-engine/podman/troubleshoot-podman.md): Troubleshoot Podman on Cortex XSOAR 8 SaaS engines. - [Manage engines](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-saas/configure-cortex-xsoar/engines/manage-engines.md): Manage Cortex XSOAR 8 SaaS engines and load-balancing groups. - [Upgrade an engine](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-saas/configure-cortex-xsoar/engines/upgrade-an-engine.md): Upgrade a Cortex XSOAR 8 SaaS engine on a remote machine. - [Remove an engine](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-saas/configure-cortex-xsoar/engines/remove-an-engine.md): Remove a Cortex XSOAR 8 SaaS engine using the operating system command. - [Configure engines](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-saas/configure-cortex-xsoar/engines/configure-engines.md): Configure Cortex XSOAR 8 SaaS engines through d1.conf or the UI. - [Configure the engine to use a web proxy](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-saas/configure-cortex-xsoar/engines/configure-engines/configure-the-engine-to-use-a-web-proxy.md): Configure a Cortex XSOAR 8 SaaS engine to use a web proxy. - [Configure the engine to call the server without using a proxy](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-saas/configure-cortex-xsoar/engines/configure-engines/configure-the-engine-to-call-the-server-without-using-a-proxy.md): Configure a Cortex XSOAR 8 SaaS engine to call the server without a proxy. - [Use NGINX as a reverse proxy](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-saas/configure-cortex-xsoar/engines/configure-engines/configure-the-engine-to-call-the-server-without-using-a-proxy/use-nginx-as-a-reverse-proxy.md): Use NGINX as a reverse proxy for a Cortex XSOAR 8 SaaS engine. - [Configure an engine to use custom certificates](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-saas/configure-cortex-xsoar/engines/configure-engines/configure-an-engine-to-use-custom-certificates.md): Configure custom CA certificates for Cortex XSOAR 8 SaaS engine communication. - [Use an engine in an integration](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-saas/configure-cortex-xsoar/engines/use-an-engine-in-an-integration.md): Use Cortex XSOAR 8 SaaS engines to fetch alerts and run integration commands. - [Run a script using an engine](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-saas/configure-cortex-xsoar/engines/run-a-script-using-an-engine.md): Run scripts on Cortex XSOAR 8 SaaS engines or load-balancing groups. - [Troubleshoot engines](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-saas/configure-cortex-xsoar/engines/troubleshoot-engines.md): Troubleshoot Cortex XSOAR 8 SaaS engines through logs and errors. - [Troubleshoot integrations running on engines](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-saas/configure-cortex-xsoar/engines/troubleshoot-integrations-running-on-engines.md): Troubleshoot integrations running on Cortex XSOAR 8 SaaS engines. - [Remote Repository Management](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-saas/configure-cortex-xsoar/remote-repository-management.md): Configure and manage remote repositories for Cortex XSOAR 8 SaaS dev/prod tenants. - [Content management in Cortex XSOAR](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-saas/configure-cortex-xsoar/remote-repository-management/content-management-in-cortex-xsoar.md): Learn how remote repositories work in Cortex XSOAR 8 SaaS. - [Set up a remote repository](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-saas/configure-cortex-xsoar/remote-repository-management/set-up-a-remote-repository.md): Set up a remote repository for Cortex XSOAR 8 SaaS development and production tenants. - [Set up a built-in remote repository](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-saas/configure-cortex-xsoar/remote-repository-management/set-up-a-remote-repository/set-up-a-built-in-remote-repository.md): Set up the built-in repository for Cortex XSOAR 8 SaaS production and development tenants. - [Set up a private remote repository](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-saas/configure-cortex-xsoar/remote-repository-management/set-up-a-remote-repository/set-up-a-private-remote-repository.md): Set up a private remote repository for Cortex XSOAR 8 SaaS. - [Push content from a development tenant](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-saas/configure-cortex-xsoar/remote-repository-management/push-content-from-a-development-tenant.md): Push content from a Cortex XSOAR 8 SaaS development tenant to a remote repository. - [Install content on a production tenant](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-saas/configure-cortex-xsoar/remote-repository-management/install-content-on-a-production-tenant.md): Install remote repository content on a Cortex XSOAR 8 SaaS production tenant. - [Remote repository troubleshooting](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-saas/configure-cortex-xsoar/remote-repository-management/remote-repository-troubleshooting.md): Troubleshoot remote repository content management in Cortex XSOAR 8 SaaS. - [Users and Roles Management](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-saas/configure-cortex-xsoar/users-and-roles-management.md): Configure Cortex XSOAR 8 SaaS roles, users, groups, and authentication. - [Users and roles in Cortex XSOAR](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-saas/configure-cortex-xsoar/users-and-roles-management/users-and-roles-in-cortex-xsoar.md): Configure Cortex XSOAR 8 SaaS roles, user groups, authentication, and users. - [Roles management](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-saas/configure-cortex-xsoar/users-and-roles-management/roles-management.md): Configure roles in Cortex XSOAR 8 SaaS tenants and Cortex Gateway. - [Role-based permissions in Cortex XSOAR](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-saas/configure-cortex-xsoar/users-and-roles-management/roles-management/role-based-permissions-in-cortex-xsoar.md): Review role-based permissions available in Cortex XSOAR 8 SaaS. - [Manage roles in Cortex Gateway](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-saas/configure-cortex-xsoar/users-and-roles-management/roles-management/manage-roles-in-cortex-gateway.md): Manage Cortex Gateway roles for Cortex XSOAR 8 SaaS. - [Manage roles in the Cortex XSOAR tenant](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-saas/configure-cortex-xsoar/users-and-roles-management/roles-management/manage-roles-in-the-cortex-xsoar-tenant.md): Manage roles in a Cortex XSOAR 8 SaaS tenant. - [User group management](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-saas/configure-cortex-xsoar/users-and-roles-management/user-group-management.md): Create Cortex XSOAR 8 SaaS user groups and assign roles and users. - [Set up authentication](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-saas/configure-cortex-xsoar/users-and-roles-management/set-up-authentication.md): Authenticate Cortex XSOAR 8 SaaS users using SAML 2.0 or Cortex Gateway. - [Authenticate users through the Customer Support Portal](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-saas/configure-cortex-xsoar/users-and-roles-management/set-up-authentication/authenticate-users-through-the-customer-support-portal.md): Authenticate Cortex XSOAR 8 SaaS users through the Customer Support Portal. - [Authenticate users using SSO](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-saas/configure-cortex-xsoar/users-and-roles-management/set-up-authentication/authenticate-users-using-sso.md): Set up SSO authentication for a Cortex XSOAR 8 SaaS tenant. - [Set up Okta as the Identity Provider Using SAML 2.0](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-saas/configure-cortex-xsoar/users-and-roles-management/set-up-authentication/set-up-okta-as-the-identity-provider-using-saml-2.0.md): Set up Okta SAML 2.0 authentication for Cortex XSOAR 8 SaaS. - [Set up Microsoft Entra ID as the Identity Provider Using SAML 2.0](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-saas/configure-cortex-xsoar/users-and-roles-management/set-up-authentication/set-up-microsoft-entra-id-as-the-identity-provider-using-saml-2.0.md): Set up Microsoft Entra ID SAML 2.0 authentication for Cortex XSOAR 8 SaaS. - [User management](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-saas/configure-cortex-xsoar/users-and-roles-management/user-management.md): Manage Cortex XSOAR 8 SaaS users in Cortex Gateway or the tenant. - [Manage users in Cortex Gateway](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-saas/configure-cortex-xsoar/users-and-roles-management/user-management/manage-users-in-cortex-gateway.md): Manage Cortex Gateway users for Cortex XSOAR 8 SaaS. - [Manage users in the Cortex XSOAR tenant](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-saas/configure-cortex-xsoar/users-and-roles-management/user-management/manage-users-in-the-cortex-xsoar-tenant.md): View and edit users and roles in a Cortex XSOAR 8 SaaS tenant. - [Marketplace](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-saas/configure-cortex-xsoar/marketplace.md): Download content packs for your Cortex XSOAR 8 SaaS use case. - [Cortex Marketplace](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-saas/configure-cortex-xsoar/marketplace/cortex-marketplace.md): Search Cortex Marketplace content for Cortex XSOAR 8 SaaS use cases. - [Content packs](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-saas/configure-cortex-xsoar/marketplace/content-packs.md): Download Cortex XSOAR 8 SaaS content packs from Marketplace. - [Content Pack Support Types](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-saas/configure-cortex-xsoar/marketplace/content-pack-support-types.md): Review Cortex XSOAR 8 SaaS content pack support types. - [Manage content packs](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-saas/configure-cortex-xsoar/marketplace/manage-content-packs.md): Install, delete, update, and revert Cortex XSOAR 8 SaaS content packs. - [Set up your use case with the Deployment Wizard](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-saas/configure-cortex-xsoar/marketplace/set-up-your-use-case-with-the-deployment-wizard.md): Use the Deployment Wizard to adopt a Cortex XSOAR 8 SaaS use case. - [Marketplace FAQs](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-saas/configure-cortex-xsoar/marketplace/marketplace-faqs.md): Find answers about Cortex XSOAR 8 SaaS Marketplace content. - [Content pack update notifications](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-saas/configure-cortex-xsoar/marketplace/content-pack-update-notifications.md): Enable update notifications for Cortex XSOAR 8 SaaS content packs. - [Customize content pack notifications](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-saas/configure-cortex-xsoar/marketplace/content-pack-update-notifications/customize-content-pack-notifications.md): Customize Cortex XSOAR 8 SaaS content pack update notifications. - [Content changes when upgrading Cortex XSOAR versions](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-saas/configure-cortex-xsoar/marketplace/content-changes-when-upgrading-cortex-xsoar-versions.md): Review content changes when upgrading Cortex XSOAR 8 SaaS versions. - [Content pack contributions](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-saas/configure-cortex-xsoar/marketplace/content-pack-contributions.md): Create Cortex XSOAR 8 SaaS content packs for Marketplace submission. - [Create a content pack](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-saas/configure-cortex-xsoar/marketplace/content-pack-contributions/create-a-content-pack.md): Create and submit a Cortex XSOAR 8 SaaS content pack to Marketplace. - [Resubmit a content pack](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-saas/configure-cortex-xsoar/marketplace/content-pack-contributions/resubmit-a-content-pack.md): Resubmit an updated Cortex XSOAR 8 SaaS content pack from the UI. - [Integrations](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-saas/configure-cortex-xsoar/integrations.md): Configure and troubleshoot integrations in Cortex XSOAR 8 SaaS. - [Integration use cases](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-saas/configure-cortex-xsoar/integrations/integration-use-cases.md): Explore integration use cases for Cortex XSOAR 8 SaaS. - [Configure integrations](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-saas/configure-cortex-xsoar/integrations/configure-integrations.md): Configure or create an integration for Cortex XSOAR 8 SaaS. - [Change the Docker image in an integration or script](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-saas/configure-cortex-xsoar/integrations/change-the-docker-image-in-an-integration-or-script.md): Change Docker images for Cortex XSOAR 8 SaaS integrations and scripts. - [Connect an engine to an image registry](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-saas/configure-cortex-xsoar/integrations/change-the-docker-image-in-an-integration-or-script/connect-an-engine-to-an-image-registry.md): Connect a Cortex XSOAR 8 SaaS engine to an image registry. - [Pull images from a private image registry](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-saas/configure-cortex-xsoar/integrations/change-the-docker-image-in-an-integration-or-script/pull-images-from-a-private-image-registry.md): Pull private registry images for Cortex XSOAR 8 SaaS. - [Manage credentials](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-saas/configure-cortex-xsoar/integrations/manage-credentials.md): Manage credentials for Cortex XSOAR 8 SaaS integrations. - [Add an integration instance](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-saas/configure-cortex-xsoar/integrations/add-an-integration-instance.md): Set up a Cortex XSOAR 8 SaaS integration instance. - [Fetch incidents from an integration instance](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-saas/configure-cortex-xsoar/integrations/add-an-integration-instance/fetch-incidents-from-an-integration-instance.md): Fetch incidents into Cortex XSOAR 8 SaaS from an integration instance. - [Receive notifications on an incident fetch error](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-saas/configure-cortex-xsoar/integrations/add-an-integration-instance/receive-notifications-on-an-incident-fetch-error.md): Receive Cortex XSOAR 8 SaaS notifications for incident fetch errors. - [Configure integration permissions](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-saas/configure-cortex-xsoar/integrations/add-an-integration-instance/configure-integration-permissions.md): Configure permissions for Cortex XSOAR 8 SaaS integration commands. - [Troubleshoot Integrations](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-saas/configure-cortex-xsoar/integrations/add-an-integration-instance/troubleshoot-integrations.md): Troubleshoot integrations in Cortex XSOAR 8 SaaS. - [Integration commands in the CLI](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-saas/configure-cortex-xsoar/integrations/integration-commands-in-the-cli.md): Run Cortex XSOAR 8 SaaS integration commands in the CLI. - [Forward Requests to Long-Running Integrations](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-saas/configure-cortex-xsoar/integrations/forward-requests-to-long-running-integrations.md): Forward requests to long-running Cortex XSOAR 8 SaaS integrations. - [Incident configuration](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-saas/configure-cortex-xsoar/incident-configuration.md): Configure incidents, fields, and workflows in Cortex XSOAR 8 SaaS. - [Incident lifecycle](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-saas/configure-cortex-xsoar/incident-configuration/incident-lifecycle.md): Learn the incident lifecycle in Cortex XSOAR 8 SaaS. - [Incident Customization](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-saas/configure-cortex-xsoar/incident-configuration/incident-customization.md): Customize incident types, fields, and layouts in Cortex XSOAR 8 SaaS. - [Use incident context data](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-saas/configure-cortex-xsoar/incident-configuration/incident-customization/use-incident-context-data.md): Use context data to customize Cortex XSOAR 8 SaaS incident layouts. - [Create an incident type](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-saas/configure-cortex-xsoar/incident-configuration/incident-customization/create-an-incident-type.md): Create and edit incident types in Cortex XSOAR 8 SaaS. - [Create an incident field](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-saas/configure-cortex-xsoar/incident-configuration/incident-customization/create-an-incident-field.md): Create custom incident fields in Cortex XSOAR 8 SaaS. - [Incident field trigger scripts](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-saas/configure-cortex-xsoar/incident-configuration/incident-customization/create-an-incident-field/incident-field-trigger-scripts.md): Configure incident field trigger scripts in Cortex XSOAR 8 SaaS. - [Create dynamic fields](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-saas/configure-cortex-xsoar/incident-configuration/incident-customization/create-an-incident-field/create-dynamic-fields.md): Create dynamic incident fields in Cortex XSOAR 8 SaaS. - [Troubleshoot incident fields](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-saas/configure-cortex-xsoar/incident-configuration/incident-customization/create-an-incident-field/troubleshoot-incident-fields.md): Troubleshoot incident fields in Cortex XSOAR 8 SaaS. - [Incident layout customization](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-saas/configure-cortex-xsoar/incident-configuration/incident-customization/incident-layout-customization.md): Customize incident layouts in Cortex XSOAR 8 SaaS. - [Create an evidence field](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-saas/configure-cortex-xsoar/incident-configuration/create-an-evidence-field.md): Create custom evidence fields in Cortex XSOAR 8 SaaS. - [Classification and mapping](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-saas/configure-cortex-xsoar/incident-configuration/classification-and-mapping.md): Classify and map integration data in Cortex XSOAR 8 SaaS. - [Create an incident classifier](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-saas/configure-cortex-xsoar/incident-configuration/classification-and-mapping/create-an-incident-classifier.md): Create incident classifiers in Cortex XSOAR 8 SaaS. - [Create an incident mapper](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-saas/configure-cortex-xsoar/incident-configuration/classification-and-mapping/create-an-incident-mapper.md): Create incident mappers in Cortex XSOAR 8 SaaS. - [Set up incident mirroring](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-saas/configure-cortex-xsoar/incident-configuration/set-up-incident-mirroring.md): Set up incident mirroring in Cortex XSOAR 8 SaaS. - [Incident deduplication in Cortex XSOAR](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-saas/configure-cortex-xsoar/incident-configuration/incident-deduplication-in-cortex-xsoar.md): Deduplicate incidents in Cortex XSOAR 8 SaaS. - [Pre-process rules](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-saas/configure-cortex-xsoar/incident-configuration/pre-process-rules.md): Create incident pre-process rules in Cortex XSOAR 8 SaaS. - [Use post-processing scripts in an incident](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-saas/configure-cortex-xsoar/incident-configuration/use-post-processing-scripts-in-an-incident.md): Use incident post-processing scripts in Cortex XSOAR 8 SaaS. - [Customize incident close reasons](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-saas/configure-cortex-xsoar/incident-configuration/customize-incident-close-reasons.md): Customize incident close reasons in Cortex XSOAR 8 SaaS. - [Configure inline value fields](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-saas/configure-cortex-xsoar/incident-configuration/configure-inline-value-fields.md): Configure inline value fields in Cortex XSOAR 8 SaaS. - [Export an incident to CSV using the UTF8-BOM format](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-saas/configure-cortex-xsoar/incident-configuration/export-an-incident-to-csv-using-the-utf8-bom-format.md): Export Cortex XSOAR 8 SaaS incidents to UTF8-BOM CSV files. - [Export Cortex XSOAR incidents to cloud storage](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-saas/configure-cortex-xsoar/incident-configuration/export-cortex-xsoar-incidents-to-cloud-storage.md): Export Cortex XSOAR 8 SaaS incidents as JSON files to Amazon S3, S3-compatible storage, or Azure Blob Storage. - [Configure access to external storage](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-saas/configure-cortex-xsoar/incident-configuration/export-cortex-xsoar-incidents-to-cloud-storage/configure-access-to-external-storage.md): Configure Azure Blob, Amazon S3, or S3-compatible storage for Cortex XSOAR 8 SaaS incident exports. - [Schedule incident export](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-saas/configure-cortex-xsoar/incident-configuration/export-cortex-xsoar-incidents-to-cloud-storage/schedule-incident-export.md): Schedule automated incident exports to Amazon S3, Azure Blob Storage, or S3-compatible cloud storage in Cortex XSOAR 8 SaaS. - [Amazon S3 configuration example](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-saas/configure-cortex-xsoar/incident-configuration/export-cortex-xsoar-incidents-to-cloud-storage/amazon-s3-configuration-example.md): Configure an Amazon S3 bucket, IAM credentials, and permissions for Cortex XSOAR 8 SaaS incident exports. - [Lists](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-saas/configure-cortex-xsoar/lists.md): Create and manage lists in Cortex XSOAR 8 SaaS. - [What is a list?](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-saas/configure-cortex-xsoar/lists/what-is-a-list.md): Learn about lists in Cortex XSOAR 8 SaaS. - [Create a list](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-saas/configure-cortex-xsoar/lists/create-a-list.md): Create a list, set permissions, add content, and save versions in Cortex XSOAR 8 SaaS. - [List commands](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-saas/configure-cortex-xsoar/lists/list-commands.md): Use list commands in Cortex XSOAR 8 SaaS. - [Use cases: JSON lists](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-saas/configure-cortex-xsoar/lists/use-cases-json-lists.md): Manage JSON lists in Cortex XSOAR 8 SaaS. - [Transform a list into an array](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-saas/configure-cortex-xsoar/lists/transform-a-list-into-an-array.md): Transform lists into arrays in Cortex XSOAR 8 SaaS. - [Jobs](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-saas/configure-cortex-xsoar/jobs.md): Create time-triggered and event-triggered jobs in Cortex XSOAR 8 SaaS. - [Manage jobs](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-saas/configure-cortex-xsoar/jobs/manage-jobs.md): Manage time-triggered and event-triggered Cortex XSOAR 8 SaaS jobs. - [Create a time triggered job](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-saas/configure-cortex-xsoar/jobs/create-a-time-triggered-job.md): Create a time-triggered job in Cortex XSOAR 8 SaaS. - [Create a job triggered by a delta in a feed](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-saas/configure-cortex-xsoar/jobs/create-a-job-triggered-by-a-delta-in-a-feed.md): Create feed-delta jobs in Cortex XSOAR 8 SaaS. - [Create jobs to process indicators example](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-saas/configure-cortex-xsoar/jobs/create-jobs-to-process-indicators-example.md): Create Cortex XSOAR 8 SaaS jobs to process indicators. - [Playbooks](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-saas/configure-cortex-xsoar/playbooks.md): Build automated workflows with Cortex XSOAR 8 SaaS playbooks. - [What is a playbook?](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-saas/configure-cortex-xsoar/playbooks/what-is-a-playbook.md): Learn about playbooks in Cortex XSOAR 8 SaaS. - [Playbook development checklist](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-saas/configure-cortex-xsoar/playbooks/playbook-development-checklist.md): Follow the Cortex XSOAR 8 SaaS playbook development checklist. - [Plan your playbook](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-saas/configure-cortex-xsoar/playbooks/plan-your-playbook.md): Plan a Cortex XSOAR 8 SaaS playbook. - [Develop your playbook](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-saas/configure-cortex-xsoar/playbooks/develop-your-playbook.md): Develop and customize Cortex XSOAR 8 SaaS playbooks. - [Task 1. Choose from existing playbooks or create your own](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-saas/configure-cortex-xsoar/playbooks/develop-your-playbook/task-1.-choose-from-existing-playbooks-or-create-your-own.md): Choose or create a Cortex XSOAR 8 SaaS playbook. - [Task 2. Configure playbook settings](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-saas/configure-cortex-xsoar/playbooks/develop-your-playbook/task-2.-configure-playbook-settings.md): Configure Cortex XSOAR 8 SaaS playbook settings. - [Task 3. Add tasks](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-saas/configure-cortex-xsoar/playbooks/develop-your-playbook/task-3.-add-tasks.md): Add tasks to a Cortex XSOAR 8 SaaS playbook. - [Set playbook inputs and outputs](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-saas/configure-cortex-xsoar/playbooks/develop-your-playbook/task-3.-add-tasks/set-playbook-inputs-and-outputs.md): Set Cortex XSOAR 8 SaaS playbook inputs and outputs. - [Create a section header](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-saas/configure-cortex-xsoar/playbooks/develop-your-playbook/task-3.-add-tasks/create-a-section-header.md): Create Cortex XSOAR 8 SaaS playbook section headers. - [Create a standard task](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-saas/configure-cortex-xsoar/playbooks/develop-your-playbook/task-3.-add-tasks/create-a-standard-task.md): Create standard tasks in Cortex XSOAR 8 SaaS playbooks. - [Create a conditional task](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-saas/configure-cortex-xsoar/playbooks/develop-your-playbook/task-3.-add-tasks/create-a-conditional-task.md): Create conditional tasks in Cortex XSOAR 8 SaaS playbooks. - [Create a communication task](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-saas/configure-cortex-xsoar/playbooks/develop-your-playbook/task-3.-add-tasks/create-a-communication-task.md): Create communication tasks in Cortex XSOAR 8 SaaS playbooks. - [Configure script error handling in a playbook](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-saas/configure-cortex-xsoar/playbooks/develop-your-playbook/task-3.-add-tasks/configure-script-error-handling-in-a-playbook.md): Configure script error handling in Cortex XSOAR 8 SaaS playbooks. - [Task 4. Add inline documentation](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-saas/configure-cortex-xsoar/playbooks/develop-your-playbook/task-4.-add-inline-documentation.md): Add inline documentation to Cortex XSOAR 8 SaaS playbooks. - [Task 5. Add custom playbook features](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-saas/configure-cortex-xsoar/playbooks/develop-your-playbook/task-5.-add-custom-playbook-features.md): Add custom features to Cortex XSOAR 8 SaaS playbooks. - [Task 6. Test and debug the playbook](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-saas/configure-cortex-xsoar/playbooks/develop-your-playbook/task-6.-test-and-debug-the-playbook.md): Test and debug Cortex XSOAR 8 SaaS playbooks. - [Task 7. Manage playbook content](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-saas/configure-cortex-xsoar/playbooks/develop-your-playbook/task-7.-manage-playbook-content.md): Manage Cortex XSOAR 8 SaaS playbook content. - [Customize a playbook for a phishing use case example](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-saas/configure-cortex-xsoar/playbooks/develop-your-playbook/customize-a-playbook-for-a-phishing-use-case-example.md): Customize a phishing playbook in Cortex XSOAR 8 SaaS. - [Customize your playbook](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-saas/configure-cortex-xsoar/playbooks/customize-your-playbook.md): Customize Cortex XSOAR 8 SaaS playbooks. - [Customize the SOC Name](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-saas/configure-cortex-xsoar/playbooks/customize-your-playbook/customize-the-soc-name.md): Customize the SOC name in Cortex XSOAR 8 SaaS. - [Configure a sub-playbook](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-saas/configure-cortex-xsoar/playbooks/customize-your-playbook/configure-a-sub-playbook.md): Configure sub-playbooks in Cortex XSOAR 8 SaaS. - [Filter and transform data](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-saas/configure-cortex-xsoar/playbooks/customize-your-playbook/filter-and-transform-data.md): Filter and transform data in Cortex XSOAR 8 SaaS playbooks. - [Filter considerations, categories, and built-in filters](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-saas/configure-cortex-xsoar/playbooks/customize-your-playbook/filter-and-transform-data/filter-considerations-categories-and-built-in-filters.md): Use filters in Cortex XSOAR 8 SaaS playbooks. - [Transformer considerations, categories, and built-in transformers](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-saas/configure-cortex-xsoar/playbooks/customize-your-playbook/filter-and-transform-data/transformer-considerations-categories-and-built-in-transformers.md): Use transformers in Cortex XSOAR 8 SaaS playbooks. - [Extract indicators](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-saas/configure-cortex-xsoar/playbooks/customize-your-playbook/extract-indicators.md): Extract indicators in Cortex XSOAR 8 SaaS playbooks. - [Extend context](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-saas/configure-cortex-xsoar/playbooks/customize-your-playbook/extend-context.md): Extend context in Cortex XSOAR 8 SaaS playbooks. - [Set and update incident fields](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-saas/configure-cortex-xsoar/playbooks/customize-your-playbook/set-and-update-incident-fields.md): Set and update incident fields in Cortex XSOAR 8 SaaS playbooks. - [Playbook polling](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-saas/configure-cortex-xsoar/playbooks/customize-your-playbook/playbook-polling.md): Configure polling in Cortex XSOAR 8 SaaS playbooks. - [Scripts](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-saas/configure-cortex-xsoar/playbooks/scripts.md): Create and manage Cortex XSOAR 8 SaaS scripts. - [Use existing scripts](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-saas/configure-cortex-xsoar/playbooks/scripts/use-existing-scripts.md): Use existing scripts in Cortex XSOAR 8 SaaS. - [Create a script](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-saas/configure-cortex-xsoar/playbooks/scripts/create-a-script.md): Create scripts in Cortex XSOAR 8 SaaS. - [Debug your playbook](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-saas/configure-cortex-xsoar/playbooks/debug-your-playbook.md): Debug Cortex XSOAR 8 SaaS playbooks. - [Troubleshoot playbook performance](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-saas/configure-cortex-xsoar/playbooks/debug-your-playbook/troubleshoot-playbook-performance.md): Troubleshoot Cortex XSOAR 8 SaaS playbook performance. - [Manage playbook content](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-saas/configure-cortex-xsoar/playbooks/manage-playbook-content.md): Manage Cortex XSOAR 8 SaaS playbook content and versions. - [Playbook best practices](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-saas/configure-cortex-xsoar/playbooks/best-practices.md): Follow Cortex XSOAR 8 SaaS playbook best practices. - [SLAs](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-saas/configure-cortex-xsoar/slas.md): Configure service-level agreements in Cortex XSOAR 8 SaaS. - [SLAs in Cortex XSOAR](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-saas/configure-cortex-xsoar/slas/slas-in-cortex-xsoar.md): Learn about SLAs in Cortex XSOAR 8 SaaS. - [Configure an SLA in an incident type](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-saas/configure-cortex-xsoar/slas/configure-an-sla-in-an-incident-type.md): Configure SLAs for incident types in Cortex XSOAR 8 SaaS. - [Configure Timer/SLA fields](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-saas/configure-cortex-xsoar/slas/configure-timersla-fields.md): Configure timer and SLA fields in Cortex XSOAR 8 SaaS. - [Configure a playbook to run Timers/SLAs](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-saas/configure-cortex-xsoar/slas/configure-a-playbook-to-run-timersslas.md): Configure Cortex XSOAR 8 SaaS playbooks to run SLA timers. - [Automate changes to incident fields using SLA scripts](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-saas/configure-cortex-xsoar/slas/automate-changes-to-incident-fields-using-sla-scripts.md): Automate incident field changes using Cortex XSOAR 8 SaaS SLA scripts. - [Create SLA scripts](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-saas/configure-cortex-xsoar/slas/create-sla-scripts.md): Create SLA scripts in Cortex XSOAR 8 SaaS. - [Use SLA and Timer field commands manually in the CLI](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-saas/configure-cortex-xsoar/slas/use-sla-and-timer-field-commands-manually-in-the-cli.md): Use SLA and timer commands in the Cortex XSOAR 8 SaaS CLI. - [Configure the Global Risk Threshold](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-saas/configure-cortex-xsoar/slas/configure-the-global-risk-threshold.md): Configure the global SLA risk threshold in Cortex XSOAR 8 SaaS. - [Search incidents for Timer/SLAs](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-saas/configure-cortex-xsoar/slas/search-incidents-for-timerslas.md): Search Cortex XSOAR 8 SaaS incidents by SLA or timer status. - [Dashboards and Reports](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-saas/configure-cortex-xsoar/dashboards-and-reports.md): Create dashboards, reports, and widgets in Cortex XSOAR 8 SaaS. - [Dashboards](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-saas/configure-cortex-xsoar/dashboards-and-reports/dashboards.md): Create and manage dashboards in Cortex XSOAR 8 SaaS. - [Dashboard actions](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-saas/configure-cortex-xsoar/dashboards-and-reports/dashboards/dashboard-actions.md): Manage dashboard actions in Cortex XSOAR 8 SaaS. - [Manage dashboards](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-saas/configure-cortex-xsoar/dashboards-and-reports/dashboards/manage-dashboards.md): Create and customize dashboards in Cortex XSOAR 8 SaaS. - [Reports](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-saas/configure-cortex-xsoar/dashboards-and-reports/reports.md): Create and manage reports in Cortex XSOAR 8 SaaS. - [Manage reports](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-saas/configure-cortex-xsoar/dashboards-and-reports/reports/manage-reports.md): Create, customize, and schedule Cortex XSOAR 8 SaaS reports. - [Configure the timezone in a report](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-saas/configure-cortex-xsoar/dashboards-and-reports/reports/configure-the-timezone-in-a-report.md): Configure report timezones in Cortex XSOAR 8 SaaS. - [Troubleshoot script timeout for reports](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-saas/configure-cortex-xsoar/dashboards-and-reports/reports/troubleshoot-script-timeout-for-reports.md): Troubleshoot report script timeouts in Cortex XSOAR 8 SaaS. - [Troubleshoot Overlapping Text and Extra Pages](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-saas/configure-cortex-xsoar/dashboards-and-reports/reports/troubleshoot-overlapping-text-and-extra-pages.md): Troubleshoot PDF report layout issues in Cortex XSOAR 8 SaaS. - [Widgets](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-saas/configure-cortex-xsoar/dashboards-and-reports/widgets.md): Create and manage widgets in Cortex XSOAR 8 SaaS. - [Widget customization](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-saas/configure-cortex-xsoar/dashboards-and-reports/widgets/widget-customization.md): Customize widgets in Cortex XSOAR 8 SaaS. - [Create a widget using the widget builder](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-saas/configure-cortex-xsoar/dashboards-and-reports/widgets/create-a-widget-using-the-widget-builder.md): Create widgets with the Cortex XSOAR 8 SaaS widget builder. - [Create a custom widget using a JSON file](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-saas/configure-cortex-xsoar/dashboards-and-reports/widgets/create-a-custom-widget-using-a-json-file.md): Create JSON widgets in Cortex XSOAR 8 SaaS. - [Create a custom widget using a script](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-saas/configure-cortex-xsoar/dashboards-and-reports/widgets/create-a-custom-widget-using-a-script.md): Create script-based widgets in Cortex XSOAR 8 SaaS. - [Create a widget from an incident](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-saas/configure-cortex-xsoar/dashboards-and-reports/widgets/create-a-widget-from-an-incident.md): Create incident widgets in Cortex XSOAR 8 SaaS. - [Create a widget from an indicator](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-saas/configure-cortex-xsoar/dashboards-and-reports/widgets/create-a-widget-from-an-indicator.md): Create indicator widgets in Cortex XSOAR 8 SaaS. - [Edit a widget](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-saas/configure-cortex-xsoar/dashboards-and-reports/widgets/edit-a-widget.md): Edit widgets in Cortex XSOAR 8 SaaS. - [Add a widget in the War Room](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-saas/configure-cortex-xsoar/dashboards-and-reports/widgets/add-a-widget-in-the-war-room.md): Add War Room widgets in Cortex XSOAR 8 SaaS. - [Saved By Dbot (ROI) Widget](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-saas/configure-cortex-xsoar/dashboards-and-reports/widgets/saved-by-dbot-roi-widget.md): Customize the Saved By Dbot ROI widget in Cortex XSOAR 8 SaaS. - [Incidents and indicators investigation](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-saas/investigate-and-respond-to-threats/incidents-and-indicators-investigation.md): Investigate incidents and indicators in Cortex XSOAR 8 SaaS. - [Incidents](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-saas/investigate-and-respond-to-threats/incidents-and-indicators-investigation/incidents.md): Learn about incidents in Cortex XSOAR 8 SaaS. - [Incident management](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-saas/investigate-and-respond-to-threats/incidents-and-indicators-investigation/incident-management.md): View and manage incidents in Cortex XSOAR 8 SaaS. - [Search for incidents](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-saas/investigate-and-respond-to-threats/incidents-and-indicators-investigation/incident-management/search-for-incidents.md): Search for incidents in Cortex XSOAR 8 SaaS. - [Create an incident](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-saas/investigate-and-respond-to-threats/incidents-and-indicators-investigation/incident-management/create-an-incident.md): Create incidents in Cortex XSOAR 8 SaaS. - [Export incidents](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-saas/investigate-and-respond-to-threats/incidents-and-indicators-investigation/incident-management/export-incidents.md): Export Cortex XSOAR 8 SaaS incidents. - [Export incidents from the Incidents table](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-saas/investigate-and-respond-to-threats/incidents-and-indicators-investigation/incident-management/export-incidents/export-incidents-from-the-incidents-table.md): Export selected Cortex XSOAR 8 SaaS incidents to CSV or Excel files. - [Export incidents on demand](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-saas/investigate-and-respond-to-threats/incidents-and-indicators-investigation/incident-management/export-incidents/export-incidents-on-demand.md): Export Cortex XSOAR 8 SaaS incidents to cloud storage on demand. - [Investigate an incident](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-saas/investigate-and-respond-to-threats/incidents-and-indicators-investigation/investigate-an-incident.md): Investigate and remediate incidents in Cortex XSOAR 8 SaaS. - [Retain incidents](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-saas/investigate-and-respond-to-threats/incidents-and-indicators-investigation/investigate-an-incident/retain-incidents.md): Retain incidents in Cortex XSOAR 8 SaaS. - [Limit access to investigations using access control](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-saas/investigate-and-respond-to-threats/incidents-and-indicators-investigation/investigate-an-incident/limit-access-to-investigations-using-access-control.md): Limit investigation access in Cortex XSOAR 8 SaaS. - [Incident Tasks](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-saas/investigate-and-respond-to-threats/incidents-and-indicators-investigation/investigate-an-incident/incident-tasks.md): Manage incident tasks in Cortex XSOAR 8 SaaS investigations. - [Use the War Room in an investigation](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-saas/investigate-and-respond-to-threats/incidents-and-indicators-investigation/investigate-an-incident/use-the-war-room-in-an-investigation.md): Use the War Room for Cortex XSOAR 8 SaaS investigations. - [Run commands in the CLI](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-saas/investigate-and-respond-to-threats/incidents-and-indicators-investigation/investigate-an-incident/run-commands-in-the-cli.md): Run commands in the Cortex XSOAR 8 SaaS CLI. - [Schedule a command in the War Room](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-saas/investigate-and-respond-to-threats/incidents-and-indicators-investigation/investigate-an-incident/schedule-a-command-in-the-war-room.md): Schedule War Room commands in Cortex XSOAR 8 SaaS. - [Evidence Handling](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-saas/investigate-and-respond-to-threats/incidents-and-indicators-investigation/investigate-an-incident/appsec-policies-migrated-with-the-new-trigger-and-finding-type-format..md): Manage investigation evidence in Cortex XSOAR 8 SaaS. - [Use the Work Plan in an investigation](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-saas/investigate-and-respond-to-threats/incidents-and-indicators-investigation/investigate-an-incident/use-the-work-plan-in-an-investigation.md): Use Work Plans in Cortex XSOAR 8 SaaS investigations. - [Add ad-hoc tasks to a Work Plan as part of your investigation](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-saas/investigate-and-respond-to-threats/incidents-and-indicators-investigation/investigate-an-incident/use-the-work-plan-in-an-investigation/add-ad-hoc-tasks-to-a-work-plan-as-part-of-your-investigation.md): Add ad-hoc Work Plan tasks in Cortex XSOAR 8 SaaS. - [Investigate an incident using the canvas](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-saas/investigate-and-respond-to-threats/incidents-and-indicators-investigation/investigate-an-incident/investigate-an-incident-using-the-canvas.md): Investigate incidents with the Cortex XSOAR 8 SaaS canvas. - [Link incidents](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-saas/investigate-and-respond-to-threats/incidents-and-indicators-investigation/investigate-an-incident/link-incidents.md): Link incidents in Cortex XSOAR 8 SaaS. - [Create an incident summary report](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-saas/investigate-and-respond-to-threats/incidents-and-indicators-investigation/investigate-an-incident/create-an-incident-summary-report.md): Create incident summary reports in Cortex XSOAR 8 SaaS. - [Manage indicators](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-saas/investigate-and-respond-to-threats/incidents-and-indicators-investigation/manage-indicators.md): Manage indicators in Cortex XSOAR 8 SaaS. - [Query indicators](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-saas/investigate-and-respond-to-threats/incidents-and-indicators-investigation/manage-indicators/query-indicators.md): Query indicators in Cortex XSOAR 8 SaaS. - [View indicator relationships in an investigation](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-saas/investigate-and-respond-to-threats/incidents-and-indicators-investigation/manage-indicators/view-indicator-relationships-in-an-investigation.md): View indicator relationships in Cortex XSOAR 8 SaaS investigations. - [Threat Intel Management](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-saas/investigate-and-respond-to-threats/threat-intel-management.md): Manage threat intelligence in Cortex XSOAR 8 SaaS. - [Get started with Threat Intel Management](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-saas/investigate-and-respond-to-threats/threat-intel-management/get-started-with-threat-intel-management.md): Get started with Threat Intel Management in Cortex XSOAR 8 SaaS. - [What is Threat Intel Management?](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-saas/investigate-and-respond-to-threats/threat-intel-management/get-started-with-threat-intel-management/what-is-threat-intel-management.md): Learn about Threat Intel Management in Cortex XSOAR 8 SaaS. - [Threat Intel Management use cases](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-saas/investigate-and-respond-to-threats/threat-intel-management/get-started-with-threat-intel-management/threat-intel-management-use-cases.md): Explore Threat Intel Management use cases in Cortex XSOAR 8 SaaS. - [Roles and responsibilities in Threat Intel Management](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-saas/investigate-and-respond-to-threats/threat-intel-management/get-started-with-threat-intel-management/roles-and-responsibilities-in-threat-intel-management.md): Review Threat Intel Management roles in Cortex XSOAR 8 SaaS. - [Indicator concepts](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-saas/investigate-and-respond-to-threats/threat-intel-management/get-started-with-threat-intel-management/indicator-concepts.md): Learn about indicators in Cortex XSOAR 8 SaaS Threat Intel Management. - [Indicator lifecycle](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-saas/investigate-and-respond-to-threats/threat-intel-management/get-started-with-threat-intel-management/indicator-lifecycle.md): Learn about the indicator lifecycle in Cortex XSOAR 8 SaaS. - [Understand Cortex XSOAR licenses](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-saas/investigate-and-respond-to-threats/threat-intel-management/get-started-with-threat-intel-management/understand-cortex-xsoar-licenses.md): Understand licenses for Cortex XSOAR 8 SaaS. - [Indicator configuration](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-saas/investigate-and-respond-to-threats/threat-intel-management/indicator-configuration.md): Configure indicators in Cortex XSOAR 8 SaaS Threat Intel Management. - [Customize indicator types, fields, and layouts](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-saas/investigate-and-respond-to-threats/threat-intel-management/indicator-configuration/customize-indicator-types-fields-and-layouts.md): Customize indicators in Cortex XSOAR 8 SaaS. - [Create an indicator type](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-saas/investigate-and-respond-to-threats/threat-intel-management/indicator-configuration/customize-indicator-types-fields-and-layouts/create-an-indicator-type.md): Create indicator types in Cortex XSOAR 8 SaaS. - [Indicator type profile](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-saas/investigate-and-respond-to-threats/threat-intel-management/indicator-configuration/customize-indicator-types-fields-and-layouts/indicator-type-profile.md): Configure indicator type profiles in Cortex XSOAR 8 SaaS. - [File indicators](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-saas/investigate-and-respond-to-threats/threat-intel-management/indicator-configuration/customize-indicator-types-fields-and-layouts/file-indicators.md): Manage file indicators in Cortex XSOAR 8 SaaS. - [Formatting scripts](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-saas/investigate-and-respond-to-threats/threat-intel-management/indicator-configuration/customize-indicator-types-fields-and-layouts/formatting-scripts.md): Use indicator formatting scripts in Cortex XSOAR 8 SaaS. - [Enhancement scripts](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-saas/investigate-and-respond-to-threats/threat-intel-management/indicator-configuration/customize-indicator-types-fields-and-layouts/enhancement-scripts.md): Use indicator enhancement scripts in Cortex XSOAR 8 SaaS. - [Reputation scripts](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-saas/investigate-and-respond-to-threats/threat-intel-management/indicator-configuration/customize-indicator-types-fields-and-layouts/reputation-scripts.md): Use indicator reputation scripts in Cortex XSOAR 8 SaaS. - [Reputation commands](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-saas/investigate-and-respond-to-threats/threat-intel-management/indicator-configuration/customize-indicator-types-fields-and-layouts/reputation-commands.md): Run indicator reputation commands in Cortex XSOAR 8 SaaS. - [Map custom indicator fields](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-saas/investigate-and-respond-to-threats/threat-intel-management/indicator-configuration/customize-indicator-types-fields-and-layouts/map-custom-indicator-fields.md): Map custom indicator fields in Cortex XSOAR 8 SaaS. - [Create an indicator field](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-saas/investigate-and-respond-to-threats/threat-intel-management/indicator-configuration/customize-indicator-types-fields-and-layouts/create-an-indicator-field.md): Create indicator fields in Cortex XSOAR 8 SaaS. - [Indicator fields structure](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-saas/investigate-and-respond-to-threats/threat-intel-management/indicator-configuration/customize-indicator-types-fields-and-layouts/indicator-fields-structure.md): Understand indicator field structures in Cortex XSOAR 8 SaaS. - [Indicator field trigger scripts](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-saas/investigate-and-respond-to-threats/threat-intel-management/indicator-configuration/customize-indicator-types-fields-and-layouts/indicator-field-trigger-scripts.md): Configure indicator field trigger scripts in Cortex XSOAR 8 SaaS. - [Indicator layout customization](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-saas/investigate-and-respond-to-threats/threat-intel-management/indicator-configuration/customize-indicator-types-fields-and-layouts/indicator-layout-customization.md): Customize indicator layouts in Cortex XSOAR 8 SaaS. - [Indicator classification and mapping](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-saas/investigate-and-respond-to-threats/threat-intel-management/indicator-configuration/indicator-classification-and-mapping.md): Classify and map indicators in Cortex XSOAR 8 SaaS. - [Indicator extraction](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-saas/investigate-and-respond-to-threats/threat-intel-management/indicator-configuration/indicator-extraction.md): Extract and enrich indicators in Cortex XSOAR 8 SaaS. - [Indicator extraction modes](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-saas/investigate-and-respond-to-threats/threat-intel-management/indicator-configuration/indicator-extraction/indicator-extraction-modes.md): Configure indicator extraction modes in Cortex XSOAR 8 SaaS. - [Create indicator extraction rules for an incident type](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-saas/investigate-and-respond-to-threats/threat-intel-management/indicator-configuration/indicator-extraction/create-indicator-extraction-rules-for-an-incident-type.md): Create indicator extraction rules in Cortex XSOAR 8 SaaS. - [Set the indicator extraction mode for a playbook task](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-saas/investigate-and-respond-to-threats/threat-intel-management/indicator-configuration/indicator-extraction/set-the-indicator-extraction-mode-for-a-playbook-task.md): Set playbook indicator extraction modes in Cortex XSOAR 8 SaaS. - [Disable indicator extraction for scripts or integrations](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-saas/investigate-and-respond-to-threats/threat-intel-management/indicator-configuration/indicator-extraction/disable-indicator-extraction-for-scripts-or-integrations.md): Disable indicator extraction in Cortex XSOAR 8 SaaS. - [Troubleshoot indicator extraction](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-saas/investigate-and-respond-to-threats/threat-intel-management/indicator-configuration/indicator-extraction/troubleshoot-indicator-extraction.md): Troubleshoot indicator extraction in Cortex XSOAR 8 SaaS. - [Configure indicator expiration](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-saas/investigate-and-respond-to-threats/threat-intel-management/indicator-configuration/configure-indicator-expiration.md): Configure indicator expiration in Cortex XSOAR 8 SaaS. - [Configure the indicator timeline](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-saas/investigate-and-respond-to-threats/threat-intel-management/indicator-configuration/configure-the-indicator-timeline.md): Configure the indicator timeline in Cortex XSOAR 8 SaaS. - [Configure Threat Intel feed integrations](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-saas/investigate-and-respond-to-threats/threat-intel-management/indicator-configuration/configure-threat-intel-feed-integrations.md): Configure Threat Intel feeds in Cortex XSOAR 8 SaaS. - [Exclude indicators from enrichment](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-saas/investigate-and-respond-to-threats/threat-intel-management/indicator-configuration/exclude-indicators-from-enrichment.md): Exclude indicators from enrichment in Cortex XSOAR 8 SaaS. - [Configure Threat Intelligence Management playbooks to process indicators](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-saas/investigate-and-respond-to-threats/threat-intel-management/indicator-configuration/configure-threat-intelligence-management-playbooks-to-process-indicators.md): Configure indicator-processing playbooks in Cortex XSOAR 8 SaaS. - [Export indicators](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-saas/investigate-and-respond-to-threats/threat-intel-management/export-indicators.md): Export indicators from Cortex XSOAR 8 SaaS. - [Customize Threat Intel Reports](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-saas/investigate-and-respond-to-threats/threat-intel-management/customize-threat-intel-reports.md): Customize Threat Intel Reports in Cortex XSOAR 8 SaaS. - [Create a Threat Intel Report type](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-saas/investigate-and-respond-to-threats/threat-intel-management/customize-threat-intel-reports/create-a-threat-intel-report-type.md): Create Threat Intel Report types in Cortex XSOAR 8 SaaS. - [Create a Threat Intel Report field](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-saas/investigate-and-respond-to-threats/threat-intel-management/customize-threat-intel-reports/create-a-threat-intel-report-field.md): Create Threat Intel Report fields in Cortex XSOAR 8 SaaS. - [Create a Threat Intel Report layout](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-saas/investigate-and-respond-to-threats/threat-intel-management/customize-threat-intel-reports/create-a-threat-intel-report-layout.md): Create Threat Intel Report layouts in Cortex XSOAR 8 SaaS. - [Indicator management](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-saas/investigate-and-respond-to-threats/threat-intel-management/indicator-management.md): Manage indicators in Cortex XSOAR 8 SaaS Threat Intel Management. - [Query indicators](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-saas/investigate-and-respond-to-threats/threat-intel-management/indicator-management/query-indicators.md): Query indicators in Cortex XSOAR 8 SaaS. - [Indicator investigation](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-saas/investigate-and-respond-to-threats/threat-intel-management/indicator-investigation.md): Investigate indicators in Cortex XSOAR 8 SaaS. - [Indicator verdict](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-saas/investigate-and-respond-to-threats/threat-intel-management/indicator-investigation/indicator-verdict.md): Manage indicator verdicts in Cortex XSOAR 8 SaaS. - [Extract and enrich an indicator](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-saas/investigate-and-respond-to-threats/threat-intel-management/indicator-investigation/extract-and-enrich-an-indicator.md): Extract and enrich indicators in Cortex XSOAR 8 SaaS. - [Expire an indicator](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-saas/investigate-and-respond-to-threats/threat-intel-management/indicator-investigation/expire-an-indicator.md): Expire indicators in Cortex XSOAR 8 SaaS. - [Manage indicator relationships](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-saas/investigate-and-respond-to-threats/threat-intel-management/indicator-investigation/manage-indicator-relationships.md): Manage indicator relationships in Cortex XSOAR 8 SaaS. - [Delete and exclude indicators](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-saas/investigate-and-respond-to-threats/threat-intel-management/indicator-investigation/delete-and-exclude-indicators.md): Delete and exclude indicators in Cortex XSOAR 8 SaaS. - [Manage Threat Intel Reports](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-saas/investigate-and-respond-to-threats/threat-intel-management/manage-threat-intel-reports.md): Manage Threat Intel Reports in Cortex XSOAR 8 SaaS. - [Troubleshoot](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-saas/troubleshoot-and-reference/troubleshoot.md): Troubleshoot errors in Cortex XSOAR 8 SaaS. - [Logs](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-saas/troubleshoot-and-reference/troubleshoot/logs.md): View and troubleshoot logs in Cortex XSOAR 8 SaaS. - [Management audit logs](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-saas/troubleshoot-and-reference/troubleshoot/management-audit-logs.md): Manage audit logs in Cortex XSOAR 8 SaaS. - [Syslog server management](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-saas/troubleshoot-and-reference/troubleshoot/syslog-server-management.md): Configure syslog servers in Cortex XSOAR 8 SaaS. - [Configure log and notification forwarding](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-saas/troubleshoot-and-reference/troubleshoot/configure-log-and-notification-forwarding.md): Forward logs and notifications from Cortex XSOAR 8 SaaS. - [Integration logs](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-saas/troubleshoot-and-reference/troubleshoot/integration-logs.md): View and export integration logs in Cortex XSOAR 8 SaaS. - [View Guard Rails warnings and errors](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-saas/troubleshoot-and-reference/troubleshoot/view-guard-rails-warnings-and-errors.md): View Guard Rails warnings and errors in Cortex XSOAR 8 SaaS. - [Reference](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-saas/troubleshoot-and-reference/reference.md): Reference topics for Cortex XSOAR 8 SaaS. - [Product support lifecycle](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-saas/troubleshoot-and-reference/reference/product-support-lifecycle.md): Cortex XSOAR 8 SaaS product support lifecycle. - [Cortex XSOAR concepts](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-saas/troubleshoot-and-reference/reference/cortex-xsoar-concepts.md): Common Cortex XSOAR 8 SaaS concepts. - [How to search in Cortex XSOAR](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-saas/troubleshoot-and-reference/reference/how-to-search-in-cortex-xsoar.md): Search Cortex XSOAR 8 SaaS with Lucene syntax and search tools. - [How to use markdown in Cortex XSOAR](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-saas/troubleshoot-and-reference/reference/how-to-use-markdown-in-cortex-xsoar.md): Use markdown in Cortex XSOAR 8 SaaS. - [User preferences](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-saas/troubleshoot-and-reference/reference/user-preferences.md): Set user preferences in Cortex XSOAR 8 SaaS. - [Server configurations](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-saas/troubleshoot-and-reference/reference/server-configurations.md): Configure and troubleshoot Cortex XSOAR 8 SaaS server settings. - [Cortex XSOAR API](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-saas/troubleshoot-and-reference/reference/cortex-xsoar-api.md): Generate API keys and make API calls in Cortex XSOAR 8 SaaS. - [New user FAQ](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-saas/troubleshoot-and-reference/reference/new-user-faq.md): New user FAQ for Cortex XSOAR 8 SaaS. - [Telemetry in Cortex XSOAR](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-saas/troubleshoot-and-reference/reference/telemetry-in-cortex-xsoar.md): Telemetry collects usage data to improve Cortex XSOAR 8 SaaS. - [Cortex XSOAR navigation cheat sheet](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-saas/troubleshoot-and-reference/reference/cortex-xsoar-navigation-cheat-sheet.md): Common Cortex XSOAR 8 SaaS features and navigation. - [Keyboard shortcuts](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-saas/troubleshoot-and-reference/reference/keyboard-shortcuts.md): Keyboard shortcuts for Cortex XSOAR 8 SaaS. - [What is Cortex XSOAR multi-tenant?](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-saas/multi-tenant/what-is-cortex-xsoar-multi-tenant.md): Learn about Cortex XSOAR 8 SaaS multi-tenant deployments that provide data segregation and centralized tenant management. - [Onboard Cortex XSOAR multi-tenant](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-saas/multi-tenant/onboard-cortex-xsoar-multi-tenant.md): Onboard Cortex XSOAR 8 SaaS multi-tenant deployments by activating and managing main and child tenants, users, and single sign-on. - [Onboarding checklist for multi-tenant deployments](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-saas/multi-tenant/onboard-cortex-xsoar-multi-tenant/onboarding-checklist-for-multi-tenant-deployments.md): Use this checklist to deploy and onboard a Cortex XSOAR 8 SaaS multi-tenant or MSSP environment. - [Step 1. Activate Cortex XSOAR (Main Tenant)](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-saas/multi-tenant/onboard-cortex-xsoar-multi-tenant/step-1.-activate-cortex-xsoar-main-tenant.md): Activate the Cortex XSOAR 8 SaaS main tenant in Cortex Gateway for a multi-tenant deployment. - [Step 2. Create a child tenant](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-saas/multi-tenant/onboard-cortex-xsoar-multi-tenant/step-2.-create-a-child-tenant.md): Create and activate Cortex XSOAR 8 SaaS child tenants in Cortex Gateway for a multi-tenant deployment. - [Step 3. Allocate incident retention licenses](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-saas/multi-tenant/onboard-cortex-xsoar-multi-tenant/step-3.-allocate-incident-retention-licenses.md): Allocate incident retention licenses to Cortex XSOAR 8 SaaS child tenants in a multi-tenant deployment. - [Step 4. Set up an engine](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-saas/multi-tenant/onboard-cortex-xsoar-multi-tenant/step-4.-set-up-an-engine.md): Set up and propagate Cortex XSOAR 8 SaaS engines across tenants in a multi-tenant deployment. - [Step 5. Set up a remote repository](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-saas/multi-tenant/onboard-cortex-xsoar-multi-tenant/step-5.-set-up-a-remote-repository.md): Configure remote repositories for Cortex XSOAR 8 SaaS multi-tenant content development and deployment. - [Step 6. Set up users and roles](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-saas/multi-tenant/onboard-cortex-xsoar-multi-tenant/step-6.-set-up-users-and-roles.md): Configure Cortex XSOAR 8 SaaS multi-tenant users, roles, user groups, and SAML authentication. - [Step 7. Install and configure content](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-saas/multi-tenant/onboard-cortex-xsoar-multi-tenant/step-7.-install-and-configure-content.md): Install and configure Cortex XSOAR 8 SaaS content for multi-tenant and MSSP environments. - [Child tenant management](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-saas/multi-tenant/child-tenant-management.md): Manage Cortex XSOAR 8 SaaS multi-tenant child tenants, access, retention licenses, and content propagation. - [Content management in multi-tenant](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-saas/multi-tenant/child-tenant-management/content-management-in-multi-tenant.md): Manage Cortex XSOAR 8 SaaS multi-tenant content using propagation labels and dependency-aware synchronization. - [Add propagation labels to content](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-saas/multi-tenant/child-tenant-management/content-management-in-multi-tenant/add-propagation-labels-to-content.md): Add propagation labels to Cortex XSOAR 8 SaaS content for selective synchronization to child tenants. - [Add propagation labels to a child tenant](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-saas/multi-tenant/child-tenant-management/content-management-in-multi-tenant/add-propagation-labels-to-a-child-tenant.md): Add propagation labels to Cortex XSOAR 8 SaaS child tenants to control synchronized content. - [Sync content to child tenants](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-saas/multi-tenant/child-tenant-management/content-management-in-multi-tenant/sync-content-to-child-tenants.md): Synchronize Cortex XSOAR 8 SaaS content from the main tenant to child tenants in a multi-tenant deployment. - [Manage content using a remote repository](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-saas/multi-tenant/child-tenant-management/content-management-in-multi-tenant/manage-content-using-a-remote-repository.md): Use a remote repository to manage and propagate Cortex XSOAR 8 SaaS multi-tenant content. - [Incident management on the Main Tenant](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-saas/multi-tenant/incident-management-on-the-main-tenant.md): Manage Cortex XSOAR 8 SaaS incidents across child tenants from the main tenant in a multi-tenant deployment. - [Manage main tenant users in an investigation](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-saas/multi-tenant/incident-management-on-the-main-tenant/manage-main-tenant-users-in-an-investigation.md): Manage Cortex XSOAR 8 SaaS main and child tenant users during multi-tenant incident investigations. - [Run a command on multiple tenants](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-saas/multi-tenant/incident-management-on-the-main-tenant/run-a-command-on-multiple-tenants.md): Run Cortex XSOAR 8 SaaS commands across incidents in multiple child tenants from the main tenant. - [Indicator management on the Main Tenant](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-saas/multi-tenant/indicator-management-on-the-main-tenant.md): View and take action on indicators on the Main Tenant in Cortex XSOAR 8 SaaS. ## Cortex XSOAR 8 On-prem Documentation - [Cortex XSOAR 8 On-prem Documentation](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/cortex-xsoar-8-on-prem-documentation.md): Start here to choose the right Cortex XSOAR 8 on-prem version. * [Navigate the Cortex XSOAR 8 On-prem docs](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.14/learn-about-cortex-xsoar/navigate-the-cortex-xsoar-8-on-prem-docs.md): Explore the main Cortex XSOAR 8.14 On-prem documentation areas, including deployment, configuration, and threat response. * [Get Started with Cortex XSOAR](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.14/learn-about-cortex-xsoar/get-started-with-cortex-xsoar.md): Get started with Cortex XSOAR 8.14 On-prem. Review its architecture, roles, responsibilities, and licensing. * [What is Cortex XSOAR?](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.14/learn-about-cortex-xsoar/what-is-cortex-xsoar.md): Learn how Cortex XSOAR 8.14 On-prem unifies security orchestration, automation, case management, and threat intelligence. * [Cortex XSOAR architecture](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.14/learn-about-cortex-xsoar/cortex-xsoar-architecture.md): Understand the Cortex XSOAR 8.14 On-prem architecture, including its components, services, and deployment model. * [Cortex XSOAR use cases](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.14/learn-about-cortex-xsoar/cortex-xsoar-use-cases.md): Explore Cortex XSOAR 8.14 On-prem use cases for automating SOC investigations, incident response, and threat intelligence workflows. * [Understand Cortex XSOAR licenses](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.14/learn-about-cortex-xsoar/understand-cortex-xsoar-licenses.md): Understand Cortex XSOAR 8.14 On-prem licenses, available components, and tenant user access limits. * [Roles and responsibilities](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.14/learn-about-cortex-xsoar/roles-and-responsibilities.md): Learn about the core SOC roles and responsibilities for operating Cortex XSOAR 8.14 On-prem. * [Supported web browsers](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.14/learn-about-cortex-xsoar/supported-web-browsers.md): Review the supported web browsers for accessing Cortex XSOAR 8.14 On-prem. * [How to onboard Cortex XSOAR](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.14/onboard-cortex-xsoar/onboard-and-configure-cortex-xsoar.md): Learn how to onboard, deploy, and configure Cortex XSOAR 8.14 On-prem for your security operations environment. * [Plan your deployment](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.14/onboard-cortex-xsoar/plan-your-deployment.md): Plan your Cortex XSOAR 8.14 On-prem deployment. Review deployment considerations, requirements, and onboarding steps. * [Deployment steps](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.14/onboard-cortex-xsoar/deployment-steps.md): Follow the deployment steps and onboarding checklist for a successful Cortex XSOAR 8.14 On-prem deployment. * [Onboarding checklist](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.14/onboard-cortex-xsoar/deployment-steps/onboarding-checklist.md): Use the Cortex XSOAR 8.14 On-prem onboarding checklist to activate, provision, grant access, and configure your deployment. * [Step 1. Install Cortex XSOAR](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.14/onboard-cortex-xsoar/deployment-steps/step-1.-install-cortex-xsoar.md): Install Cortex XSOAR 8.14 On-prem. Review system requirements, installation steps, and license setup. * [Step 2. Set up an engine](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.14/onboard-cortex-xsoar/deployment-steps/step-2.-set-up-an-engine.md): Set up a Cortex XSOAR 8.14 On-prem engine on a remote machine for integrations and automation. * [Step 3. Set up a remote repository](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.14/onboard-cortex-xsoar/deployment-steps/step-3.-set-up-a-remote-repository.md): Set up a remote repository for Cortex XSOAR 8.14 On-prem content development, testing, and production deployment. * [Step 4. Set up users and roles](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.14/onboard-cortex-xsoar/deployment-steps/step-4.-set-up-users-and-roles.md): Set up users, permissions, and predefined roles in Cortex XSOAR 8.14 On-prem. * [Step 5. Install and configure content](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.14/onboard-cortex-xsoar/deployment-steps/step-5.-install-and-configure-content.md): Learn what Cortex XSOAR 8.14 On-prem content includes and how to install and configure it. * [Install content packs](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.14/onboard-cortex-xsoar/deployment-steps/step-5.-install-and-configure-content/install-content-packs.md): Install content packs in Cortex XSOAR 8.14 On-prem to add integrations, playbooks, and automation. * [Set up your use case with the Deployment Wizard](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.14/onboard-cortex-xsoar/deployment-steps/step-5.-install-and-configure-content/set-up-your-use-case-with-the-deployment-wizard.md): Use the Deployment Wizard in Cortex XSOAR 8.14 On-prem to configure and adopt a security use case. * [Post deployment](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.14/onboard-cortex-xsoar/post-deployment.md): Complete post-deployment configuration tasks for Cortex XSOAR 8.14 On-prem, including communications and system settings. * [User communication](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.14/onboard-cortex-xsoar/post-deployment/user-communication.md): Configure user communications, email messages, and notifications in Cortex XSOAR 8.14 On-prem. * [Configure user notifications in Cortex XSOAR](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.14/onboard-cortex-xsoar/post-deployment/user-communication/configure-user-notifications-in-cortex-xsoar.md): Configure user notifications in Cortex XSOAR 8.14 On-prem. * [Customize system emails](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.14/onboard-cortex-xsoar/post-deployment/user-communication/customize-system-emails.md): Customize system email messages in Cortex XSOAR 8.14 On-prem. * [Configure system settings](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.14/onboard-cortex-xsoar/post-deployment/configure-system-settings.md): Configure system settings for Cortex XSOAR 8.14 On-prem. * [How to install Cortex XSOAR](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.14/install-cortex-xsoar/installation-overview.md): Learn how to install Cortex XSOAR 8.14 On-prem, including system requirements, deployment options, and license setup. * [High Availability for Cortex XSOAR](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.14/install-cortex-xsoar/high-availability-for-cortex-xsoar.md): Configure High Availability for Cortex XSOAR 8.14 On-prem to support reliable, continuous operation. * [Load balancing for Cortex XSOAR](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.14/install-cortex-xsoar/load-balancing-for-cortex-xsoar.md): Configure load balancing for Cortex XSOAR 8.14 On-prem to support reliable, continuous operation. * [System Requirements](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.14/install-cortex-xsoar/system-requirements.md): Verify that your Cortex XSOAR 8.14 On-prem deployment meets the minimum hardware, network, and system requirements. * [Hardware requirements](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.14/install-cortex-xsoar/system-requirements/hardware-requirements.md): Review hardware requirements for installing and running Cortex XSOAR 8.14 On-prem. * [Port requirements for cluster communication](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.14/install-cortex-xsoar/system-requirements/port-requirements-for-cluster-communication.md): Review required ports for Cortex XSOAR 8.14 On-prem cluster communication and installation. * [URL requirements](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.14/install-cortex-xsoar/system-requirements/url-requirements.md): Review the required URLs and network access for Cortex XSOAR 8.14 On-prem. * [Bandwidth and NTP requirements](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.14/install-cortex-xsoar/system-requirements/bandwidth-and-ntp-requirements.md): Review bandwidth and NTP synchronization requirements for Cortex XSOAR 8.14 On-prem. * [Install Cortex XSOAR on a VM deployed on AWS](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.14/install-cortex-xsoar/install-cortex-xsoar-on-a-vm-deployed-on-aws.md): Install Cortex XSOAR 8.14 On-prem on a virtual machine deployed on AWS. * [Task 1. Download the OVA Image and license from Cortex Gateway](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.14/install-cortex-xsoar/install-cortex-xsoar-on-a-vm-deployed-on-aws/task-1.-download-the-ova-image-and-license-from-cortex-gateway.md): Download the OVA image and license for Cortex XSOAR 8.14 On-prem. * [Task 2. Deploy your virtual machine on AWS](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.14/install-cortex-xsoar/install-cortex-xsoar-on-a-vm-deployed-on-aws/task-2.-deploy-your-virtual-machine-on-aws.md): Deploy a virtual machine on AWS for Cortex XSOAR 8.14 On-prem. * [Task 3. Validate tenant network and IP settings](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.14/install-cortex-xsoar/install-cortex-xsoar-on-a-vm-deployed-on-aws/task-3.-validate-tenant-network-and-ip-settings.md): Validate tenant network and IP settings in Cortex XSOAR 8.14 On-prem. * [Task 4. Configure NTP servers](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.14/install-cortex-xsoar/install-cortex-xsoar-on-a-vm-deployed-on-aws/task-4.-configure-ntp-servers.md): Configure NTP servers for Cortex XSOAR 8.14 On-prem. * [Task 5. (Optional) Configure proxy settings](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.14/install-cortex-xsoar/install-cortex-xsoar-on-a-vm-deployed-on-aws/task-5.-optional-configure-proxy-settings.md): Configure optional proxy settings for Cortex XSOAR 8.14 On-prem. * [Task 6. Establish trust between all nodes in a cluster](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.14/install-cortex-xsoar/install-cortex-xsoar-on-a-vm-deployed-on-aws/task-6.-establish-trust-between-all-nodes-in-a-cluster.md): Establish trust between cluster nodes in Cortex XSOAR 8.14 On-prem. * [Task 7. Install Cortex XSOAR on your VM](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.14/install-cortex-xsoar/install-cortex-xsoar-on-a-vm-deployed-on-aws/task-7.-install-cortex-xsoar-on-your-vm.md): Install Cortex XSOAR 8.14 On-prem on your virtual machine. * [Task 8. Verify you can log into Cortex XSOAR](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.14/install-cortex-xsoar/install-cortex-xsoar-on-a-vm-deployed-on-aws/task-8.-verify-you-can-log-into-cortex-xsoar.md): Verify access to your Cortex XSOAR 8.14 On-prem deployment. * [Install Cortex XSOAR on a VM deployed on OCI](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.14/install-cortex-xsoar/install-cortex-xsoar-on-a-vm-deployed-on-oci.md): Install Cortex XSOAR 8.14 On-prem on a virtual machine deployed on OCI. * [Task 1. Download the OVA image and license from Cortex Gateway](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.14/install-cortex-xsoar/install-cortex-xsoar-on-a-vm-deployed-on-oci/task-1.-download-the-ova-image-and-license-from-cortex-gateway.md): Download the OVA image and license for Cortex XSOAR 8.14 On-prem. * [Task 2. Deploy your virtual machine on OCI](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.14/install-cortex-xsoar/install-cortex-xsoar-on-a-vm-deployed-on-oci/task-2.-deploy-your-virtual-machine-on-oci.md): Deploy a virtual machine on OCI for Cortex XSOAR 8.14 On-prem. * [Task 3. Validate tenant network and IP settings](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.14/install-cortex-xsoar/install-cortex-xsoar-on-a-vm-deployed-on-oci/task-3.-validate-tenant-network-and-ip-settings.md): Validate tenant network and IP settings in Cortex XSOAR 8.14 On-prem. * [Task 4. Configure NTP servers](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.14/install-cortex-xsoar/install-cortex-xsoar-on-a-vm-deployed-on-oci/task-4.-configure-ntp-servers.md): Configure NTP servers for Cortex XSOAR 8.14 On-prem. * [Task 5. (Optional) Configure proxy settings](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.14/install-cortex-xsoar/install-cortex-xsoar-on-a-vm-deployed-on-oci/task-5.-optional-configure-proxy-settings.md): Configure optional proxy settings for Cortex XSOAR 8.14 On-prem. * [Task 6. Establish trust between all nodes in a cluster](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.14/install-cortex-xsoar/install-cortex-xsoar-on-a-vm-deployed-on-oci/task-6.-establish-trust-between-all-nodes-in-a-cluster.md): Establish trust between cluster nodes in Cortex XSOAR 8.14 On-prem. * [Task 7. Install Cortex XSOAR on your VM](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.14/install-cortex-xsoar/install-cortex-xsoar-on-a-vm-deployed-on-oci/task-7.-install-cortex-xsoar-on-your-vm.md): Install Cortex XSOAR 8.14 On-prem on your virtual machine. * [Task 8. Verify you can log into Cortex XSOAR](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.14/install-cortex-xsoar/install-cortex-xsoar-on-a-vm-deployed-on-oci/task-8.-verify-you-can-log-into-cortex-xsoar.md): Verify access to your Cortex XSOAR 8.14 On-prem deployment. * [Install Cortex XSOAR on a VM deployed on Hyper-V](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.14/install-cortex-xsoar/install-cortex-xsoar-on-a-vm-deployed-on-hyper-v.md): Install Cortex XSOAR 8.14 On-prem on a virtual machine deployed on Hyper-V. * [Task 1. Download the VHD image and license from Cortex Gateway](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.14/install-cortex-xsoar/install-cortex-xsoar-on-a-vm-deployed-on-hyper-v/task-1.-download-the-vhd-image-and-license-from-cortex-gateway.md): Download the VHD image and license for Cortex XSOAR 8.14 On-prem. * [Task 2. Deploy your virtual machine on Hyper-V](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.14/install-cortex-xsoar/install-cortex-xsoar-on-a-vm-deployed-on-hyper-v/task-2.-deploy-your-virtual-machine-on-hyper-v.md): Deploy a virtual machine on Hyper-V for Cortex XSOAR 8.14 On-prem. * [Task 3. Configure tenant network and IP settings for each node](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.14/install-cortex-xsoar/install-cortex-xsoar-on-a-vm-deployed-on-hyper-v/task-3.-configure-tenant-network-and-ip-settings-for-each-node.md): Configure network and IP settings for each Cortex XSOAR 8.14 On-prem node. * [Task 4. Configure NTP servers](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.14/install-cortex-xsoar/install-cortex-xsoar-on-a-vm-deployed-on-hyper-v/task-4.-configure-ntp-servers.md): Configure NTP servers for Cortex XSOAR 8.14 On-prem. * [Task 5. (Optional) Configure proxy settings](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.14/install-cortex-xsoar/install-cortex-xsoar-on-a-vm-deployed-on-hyper-v/task-5.-optional-configure-proxy-settings.md): Configure optional proxy settings for Cortex XSOAR 8.14 On-prem. * [Task 6. Establish trust between all nodes in a cluster](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.14/install-cortex-xsoar/install-cortex-xsoar-on-a-vm-deployed-on-hyper-v/task-6.-establish-trust-between-all-nodes-in-a-cluster.md): Establish trust between cluster nodes in Cortex XSOAR 8.14 On-prem. * [Task 7. Install Cortex XSOAR on your VM](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.14/install-cortex-xsoar/install-cortex-xsoar-on-a-vm-deployed-on-hyper-v/task-7.-install-cortex-xsoar-on-your-vm.md): Install Cortex XSOAR 8.14 On-prem on your virtual machine. * [Task 8. Verify you can log in to Cortex XSOAR](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.14/install-cortex-xsoar/install-cortex-xsoar-on-a-vm-deployed-on-hyper-v/task-8.-verify-you-can-log-in-to-cortex-xsoar.md): Verify access to your Cortex XSOAR 8.14 On-prem deployment. * [Install Cortex XSOAR on a VM deployed on VSphere](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.14/install-cortex-xsoar/install-cortex-xsoar-on-a-vm-deployed-on-vsphere.md): Install Cortex XSOAR 8.14 On-prem on a virtual machine deployed on vSphere. * [Install Cortex XSOAR on a VM deployed on KVM](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.14/install-cortex-xsoar/install-cortex-xsoar-on-a-vm-deployed-on-kvm.md): Install Cortex XSOAR 8.14 On-prem on a virtual machine deployed on KVM. * [Task 1. Download the QCOW2 image and license from Cortex Gateway](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.14/install-cortex-xsoar/install-cortex-xsoar-on-a-vm-deployed-on-kvm/task-1.-download-the-qcow2-image-and-license-from-cortex-gateway.md): Download the QCOW2 image and license for Cortex XSOAR 8.14 On-prem. * [Task 2. Deploy your virtual machine on KVM](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.14/install-cortex-xsoar/install-cortex-xsoar-on-a-vm-deployed-on-kvm/task-2.-deploy-your-virtual-machine-on-kvm.md): Deploy a virtual machine on KVM for Cortex XSOAR 8.14 On-prem. * [Task 3. Configure tenant network and IP settings for each node](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.14/install-cortex-xsoar/install-cortex-xsoar-on-a-vm-deployed-on-kvm/task-3.-configure-tenant-network-and-ip-settings-for-each-node.md): Configure network and IP settings for each Cortex XSOAR 8.14 On-prem node. * [Task 4. Configure NTP servers](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.14/install-cortex-xsoar/install-cortex-xsoar-on-a-vm-deployed-on-kvm/task-4.-configure-ntp-servers.md): Configure NTP servers for Cortex XSOAR 8.14 On-prem. * [Task 5. (Optional) Configure proxy settings](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.14/install-cortex-xsoar/install-cortex-xsoar-on-a-vm-deployed-on-kvm/task-5.-optional-configure-proxy-settings.md): Configure optional proxy settings for Cortex XSOAR 8.14 On-prem. * [Task 6. Establish trust between all nodes in a cluster](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.14/install-cortex-xsoar/install-cortex-xsoar-on-a-vm-deployed-on-kvm/task-6.-establish-trust-between-all-nodes-in-a-cluster.md): Establish trust between cluster nodes in Cortex XSOAR 8.14 On-prem. * [Task 7. Install Cortex XSOAR on your VM](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.14/install-cortex-xsoar/install-cortex-xsoar-on-a-vm-deployed-on-kvm/task-7.-install-cortex-xsoar-on-your-vm.md): Install Cortex XSOAR 8.14 On-prem on your virtual machine. * [Task 8. Verify you can log into Cortex XSOAR](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.14/install-cortex-xsoar/install-cortex-xsoar-on-a-vm-deployed-on-kvm/task-8.-verify-you-can-log-into-cortex-xsoar.md): Verify access to your Cortex XSOAR 8.14 On-prem deployment. * [Post-installation](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.14/install-cortex-xsoar/post-installation.md): Complete Cortex XSOAR 8.14 On-prem post-installation tasks, including license setup, certificates, and VM maintenance. * [Add the Cortex XSOAR license](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.14/install-cortex-xsoar/post-installation/add-the-cortex-xsoar-license.md): Download and add a Cortex XSOAR 8.14 On-prem license from Cortex Gateway to enable tenant access and components. * [HTTPS with a signed certificate](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.14/install-cortex-xsoar/post-installation/https-with-a-signed-certificate.md): Configure HTTPS with a signed certificate in Cortex XSOAR 8.14 On-prem and concatenate the certificate chain. * [Manage your SSH admin password](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.14/install-cortex-xsoar/post-installation/manage-your-ssh-admin-password.md): Manage the SSH administrator password in Cortex XSOAR 8.14 On-prem. * [Use a signed certificate instead of SSL verification](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.14/install-cortex-xsoar/post-installation/use-a-signed-certificate-instead-of-ssl-verification.md): Use a signed HTTPS certificate instead of SSL verification in Cortex XSOAR 8.14 On-prem MSSP deployments. * [Manage custom certificates](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.14/install-cortex-xsoar/post-installation/manage-custom-certificates.md): Manage trusted certificates for Cortex XSOAR 8.14 On-prem outbound integrations and custom certificate authorities. * [Optimize performance and robustness from the textual UI](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.14/install-cortex-xsoar/post-installation/optimize-performance-and-robustness-from-the-textual-ui.md): Optimize Cortex XSOAR 8.14 On-prem performance and robustness from the VM textual UI or SSH. * [Manage nodes in a cluster](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.14/install-cortex-xsoar/post-installation/optimize-performance-and-robustness-from-the-textual-ui/manage-nodes-in-a-cluster.md): Manage cluster nodes in Cortex XSOAR 8.14 On-prem. * [Scale up hardware resources](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.14/install-cortex-xsoar/post-installation/optimize-performance-and-robustness-from-the-textual-ui/scale-up-hardware-resources.md): Scale hardware resources for Cortex XSOAR 8.14 On-prem. * [Auto expand PVC volumes](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.14/install-cortex-xsoar/post-installation/optimize-performance-and-robustness-from-the-textual-ui/auto-expand-pvc-volumes.md): Automatically expand PVC volumes in Cortex XSOAR 8.14 On-prem. * [Troubleshoot your installation](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.14/install-cortex-xsoar/troubleshoot-your-installation.md): Troubleshoot Cortex XSOAR 8.14 On-prem installation issues from the VM textual UI or SSH. * [Common installation limitations and fixes](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.14/install-cortex-xsoar/troubleshoot-your-installation/common-installation-limitations-and-fixes.md): Troubleshoot common Cortex XSOAR installation issues. * [Access logs and log bundles](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.14/install-cortex-xsoar/troubleshoot-your-installation/access-logs-and-log-bundles.md): View Cortex XSOAR 8.14 On-prem logs and download log bundles for system monitoring and troubleshooting. * [Open a support session](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.14/install-cortex-xsoar/troubleshoot-your-installation/open-a-support-session.md): Open a Cortex XSOAR 8.14 On-prem support session from the VM textual UI or SSH. * [Upload your license to the textual UI](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.14/install-cortex-xsoar/troubleshoot-your-installation/upload-your-license-to-the-textual-ui.md): Upload your Cortex XSOAR 8.14 On-prem license to the VM textual UI for a support session. * [Shut down Cortex XSOAR](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.14/install-cortex-xsoar/troubleshoot-your-installation/shut-down-cortex-xsoar.md): Shut down a Cortex XSOAR 8.14 On-prem session from the VM textual UI. * [Update Cortex XSOAR](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.14/install-cortex-xsoar/update-cortex-xsoar.md): Upgrade your Cortex XSOAR 8.14 On-prem tenant to the latest supported version. * [How to back up and restore Cortex XSOAR](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.14/back-up-and-restore-cortex-xsoar/back-up-and-restore-cortex-xsoar.md): Back up and restore Cortex XSOAR 8.14 On-prem clusters using on-demand or scheduled backups. * [Set up access to an external storage](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.14/back-up-and-restore-cortex-xsoar/set-up-access-to-an-external-storage.md): Configure Cortex XSOAR 8.14 On-prem access to external storage for backups and restores. * [Back up data](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.14/back-up-and-restore-cortex-xsoar/back-up-data.md): Create scheduled and on-demand backups of Cortex XSOAR 8.14 On-prem data. * [Backup guidelines and best practices](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.14/back-up-and-restore-cortex-xsoar/back-up-data/backup-guidelines-and-best-practices.md): Follow Cortex XSOAR 8.14 On-prem backup guidelines and best practices for reliable data protection. * [Restore data](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.14/back-up-and-restore-cortex-xsoar/restore-data.md): Restore Cortex XSOAR 8.14 On-prem data from an on-demand cluster backup. * [End-to-end example of Cortex XSOAR cluster backup and restore](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.14/back-up-and-restore-cortex-xsoar/end-to-end-example-of-cortex-xsoar-cluster-backup-and-restore.md): Follow an end-to-end Cortex XSOAR 8.14 On-prem cluster backup and restore workflow. * [Common backup and restore limitations and fixes](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.14/back-up-and-restore-cortex-xsoar/common-backup-and-restore-limitations-and-fixes.md): Troubleshoot common Cortex XSOAR 8.14 On-prem backup and restore issues. * [Engines](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.14/configure-cortex-xsoar/engines.md): Install, manage, configure, and troubleshoot engines in Cortex XSOAR 8.14 On-prem. * [What is an engine?](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.14/configure-cortex-xsoar/engines/what-is-an-engine.md): Learn how engines in Cortex XSOAR 8.14 On-prem connect integrations and services to your tenant. * [Engine requirements](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.14/configure-cortex-xsoar/engines/engine-requirements.md): Review hardware, operating system, and network URL requirements for engines in Cortex XSOAR 8.14 On-prem. * [Install an engine](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.14/configure-cortex-xsoar/engines/install-an-engine.md): Install, deploy, and configure engines in Cortex XSOAR 8.14 On-prem. * [Engine air gap installation](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.14/configure-cortex-xsoar/engines/install-an-engine/engine-air-gap-installation.md): Install an engine offline without internet access on RHEL 8 on Cortex XSOAR 8.14 On-prem. * [Docker](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.14/configure-cortex-xsoar/engines/install-an-engine/docker.md): Install, configure, secure, and troubleshoot Docker on engines for Cortex XSOAR 8.14 On-prem. * [Install Docker](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.14/configure-cortex-xsoar/engines/install-an-engine/docker/install-docker.md): Install Docker on a engine in Cortex XSOAR 8.14 On-prem. * [Install Docker distribution for Red Hat on an engine server](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.14/configure-cortex-xsoar/engines/install-an-engine/docker/install-docker-distribution-for-red-hat-on-an-engine-server.md): Install Docker for Red Hat on a engine server for Cortex XSOAR 8.14 On-prem. * [Docker image security](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.14/configure-cortex-xsoar/engines/install-an-engine/docker/docker-image-security.md): Secure Docker images used by engines in Cortex XSOAR 8.14 On-prem. * [Use the Cortex XSOAR Container Registry](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.14/configure-cortex-xsoar/engines/install-an-engine/docker/use-the-cortex-xsoar-container-registry.md): Use the Container Registry with your engines in Cortex XSOAR 8.14 On-prem. * [Docker FAQs](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.14/configure-cortex-xsoar/engines/install-an-engine/docker/docker-faqs.md): Find answers to common Docker questions for engines in Cortex XSOAR 8.14 On-prem. * [Troubleshoot Docker issues](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.14/configure-cortex-xsoar/engines/install-an-engine/docker/troubleshoot-docker-issues.md): Troubleshoot Docker issues on engines in Cortex XSOAR 8.14 On-prem. * [Configure Docker pull rate limit](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.14/configure-cortex-xsoar/engines/install-an-engine/docker/configure-docker-pull-rate-limit.md): Configure Docker image pull rate limits for engines in Cortex XSOAR 8.14 On-prem. * [Change the Docker installation folder](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.14/configure-cortex-xsoar/engines/install-an-engine/docker/change-the-docker-installation-folder.md): Change the Docker installation folder for engines in Cortex XSOAR 8.14 On-prem. * [Configure Docker integrations to trust custom certificates](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.14/configure-cortex-xsoar/engines/install-an-engine/docker/configure-docker-integrations-to-trust-custom-certificates.md): Configure Docker integrations for engines in Cortex XSOAR 8.14 On-prem to trust custom certificates. * [Configure Python Docker integrations to trust custom certificates](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.14/configure-cortex-xsoar/engines/install-an-engine/docker/configure-python-docker-integrations-to-trust-custom-certificates.md): Configure custom certificate trust for Python Docker integrations on engines in Cortex XSOAR 8.14 On-prem. * [Docker hardening guide](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.14/configure-cortex-xsoar/engines/install-an-engine/docker/docker-hardening-guide.md): Harden Docker deployments for engines in Cortex XSOAR 8.14 On-prem. * [Podman](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.14/configure-cortex-xsoar/engines/install-an-engine/podman.md): Run Podman containers instead of Docker on RHEL 8 engines in Cortex XSOAR 8.14 On-prem. * [Change container storage directory](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.14/configure-cortex-xsoar/engines/install-an-engine/podman/change-container-storage-directory.md): Change Podman container storage for engines in Cortex XSOAR 8.14 On-prem. * [Install Podman](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.14/configure-cortex-xsoar/engines/install-an-engine/podman/install-podman.md): Install Podman on engines in Cortex XSOAR 8.14 On-prem. * [Migrate From Docker to Podman](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.14/configure-cortex-xsoar/engines/install-an-engine/podman/migrate-from-docker-to-podman.md): Migrate containers on engines in Cortex XSOAR 8.14 On-prem from Docker to Podman. * [Troubleshoot Podman](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.14/configure-cortex-xsoar/engines/install-an-engine/podman/troubleshoot-podman.md): Troubleshoot Podman on engines in Cortex XSOAR 8.14 On-prem. * [Manage engines](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.14/configure-cortex-xsoar/engines/manage-engines.md): Manage engines and engine load-balancing groups in Cortex XSOAR 8.14 On-prem. * [Upgrade an engine](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.14/configure-cortex-xsoar/engines/upgrade-an-engine.md): Upgrade an engine in Cortex XSOAR 8.14 On-prem from the tenant or remote machine. * [Remove an engine](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.14/configure-cortex-xsoar/engines/remove-an-engine.md): Remove an engine in Cortex XSOAR 8.14 On-prem using your operating system command. * [Configure engines](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.14/configure-cortex-xsoar/engines/configure-engines.md): Configure engines in Cortex XSOAR 8.14 On-prem using d1.conf or the shell UI. * [Configure the engine to use a web proxy](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.14/configure-cortex-xsoar/engines/configure-engines/configure-the-engine-to-use-a-web-proxy.md): Configure an engine in Cortex XSOAR 8.14 On-prem to use a web proxy with d1.conf. * [Configure the engine to call the server without using a proxy](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.14/configure-cortex-xsoar/engines/configure-engines/configure-the-engine-to-call-the-server-without-using-a-proxy.md): Configure an engine in Cortex XSOAR 8.14 On-prem to call the server without a proxy. * [Use NGINX as a reverse proxy](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.14/configure-cortex-xsoar/engines/configure-engines/configure-the-engine-to-call-the-server-without-using-a-proxy/use-nginx-as-a-reverse-proxy.md): Use NGINX as a reverse proxy for engines in Cortex XSOAR 8.14 On-prem. * [Configure an engine to use custom certificates](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.14/configure-cortex-xsoar/engines/configure-an-engine-to-use-custom-certificates.md): Configure custom certificate trust for engines in Cortex XSOAR 8.14 On-prem. * [Use an engine in an integration](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.14/configure-cortex-xsoar/engines/use-an-engine-in-an-integration.md): Use engines in Cortex XSOAR 8.14 On-prem to fetch alerts and run integration commands. * [Run a script using an engine](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.14/configure-cortex-xsoar/engines/run-a-script-using-an-engine.md): Run scripts on engines in Cortex XSOAR 8.14 On-prem to distribute workload and improve performance. * [Troubleshoot engines](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.14/configure-cortex-xsoar/engines/troubleshoot-engines.md): Troubleshoot engines in Cortex XSOAR 8.14 On-prem by accessing logs and errors. * [Troubleshoot integrations running on engines](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.14/configure-cortex-xsoar/engines/troubleshoot-integrations-running-on-engines.md): Troubleshoot integrations running on engines in Cortex XSOAR 8.14 On-prem. * [Remote Repository Management](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.14/configure-cortex-xsoar/remote-repository-management.md): Manage remote repositories for content development and production deployment in Cortex XSOAR 8.14 On-prem. * [Content management in Cortex XSOAR](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.14/configure-cortex-xsoar/remote-repository-management/content-management-in-cortex-xsoar.md): Manage content with remote repositories, local versions, or CI/CD in Cortex XSOAR 8.14 On-prem. * [Set up a private remote repository](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.14/configure-cortex-xsoar/remote-repository-management/set-up-a-private-remote-repository.md): Set up a private Git remote repository for content synchronization in Cortex XSOAR 8.14 On-prem. * [Push content from a development tenant](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.14/configure-cortex-xsoar/remote-repository-management/push-content-from-a-development-tenant.md): Push content from a development tenant to a remote repository in Cortex XSOAR 8.14 On-prem. * [Install content on a production tenant](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.14/configure-cortex-xsoar/remote-repository-management/install-content-on-a-production-tenant.md): Install content from a remote repository on a production tenant in Cortex XSOAR 8.14 On-prem. * [Remote repository troubleshooting](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.14/configure-cortex-xsoar/remote-repository-management/remote-repository-troubleshooting.md): Troubleshoot remote repository configuration and content synchronization in Cortex XSOAR 8.14 On-prem. * [Users and Roles Management](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.14/configure-cortex-xsoar/users-and-roles-management.md): Manage users, roles, groups, and authentication in Cortex XSOAR 8.14 On-prem. * [Users and roles in Cortex XSOAR](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.14/configure-cortex-xsoar/users-and-roles-management/users-and-roles-in-cortex-xsoar.md): Configure users, roles, user groups, and authentication in Cortex XSOAR 8.14 On-prem. * [Roles management](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.14/configure-cortex-xsoar/users-and-roles-management/roles-management.md): Configure predefined and custom roles in Cortex XSOAR 8.14 On-prem. * [Role-based permissions](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.14/configure-cortex-xsoar/users-and-roles-management/roles-management/role-based-permissions.md): Review role-based permissions in Cortex XSOAR 8.14 On-prem. * [Manage roles in the Cortex XSOAR tenant](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.14/configure-cortex-xsoar/users-and-roles-management/roles-management/manage-roles-in-the-cortex-xsoar-tenant.md): Create and manage custom roles in Cortex XSOAR 8.14 On-prem. * [User group management](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.14/configure-cortex-xsoar/users-and-roles-management/user-group-management.md): Create user groups and assign users and roles in Cortex XSOAR 8.14 On-prem. * [Set up authentication](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.14/configure-cortex-xsoar/users-and-roles-management/set-up-authentication.md): Configure local, SAML SSO, or LDAP authentication in Cortex XSOAR 8.14 On-prem. * [Create users in Cortex XSOAR](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.14/configure-cortex-xsoar/users-and-roles-management/set-up-authentication/create-users-in-cortex-xsoar.md): Create local users with username and password access in Cortex XSOAR 8.14 On-prem. * [Authenticate users using SSO](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.14/configure-cortex-xsoar/users-and-roles-management/set-up-authentication/authenticate-users-using-sso.md): Configure SSO authentication for users in Cortex XSOAR 8.14 On-prem. * [Authenticate users using Active Directory or OpenLDAP](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.14/configure-cortex-xsoar/users-and-roles-management/set-up-authentication/authenticate-users-using-active-directory-or-openldap.md): Configure Active Directory or OpenLDAP authentication in Cortex XSOAR 8.14 On-prem. * [Set up Okta as the Identity Provider Using SAML 2.0](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.14/configure-cortex-xsoar/users-and-roles-management/set-up-authentication/set-up-okta-as-the-identity-provider-using-saml-2.0.md): Configure Okta as a SAML 2.0 identity provider for Cortex XSOAR 8.14 On-prem. * [Set up Microsoft Entra ID as the Identity Provider Using SAML 2.0](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.14/configure-cortex-xsoar/users-and-roles-management/set-up-authentication/set-up-microsoft-entra-id-as-the-identity-provider-using-saml-2.0.md): Configure Microsoft Entra ID as a SAML 2.0 identity provider for Cortex XSOAR 8.14 On-prem. * [User management](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.14/configure-cortex-xsoar/users-and-roles-management/user-management.md): Invite users and assign roles and groups in Cortex XSOAR 8.14 On-prem. * [Configure a password policy](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.14/configure-cortex-xsoar/users-and-roles-management/configure-a-password-policy.md): Configure password policies in Cortex XSOAR 8.14 On-prem. * [Marketplace](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.14/configure-cortex-xsoar/marketplace.md): Download content packs for your use case in Cortex XSOAR 8.14 On-prem Marketplace. * [Cortex Marketplace](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.14/configure-cortex-xsoar/marketplace/cortex-marketplace.md): Find content packs by use case, integration, and category in Cortex XSOAR 8.14 On-prem Marketplace. * [Content packs](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.14/configure-cortex-xsoar/marketplace/content-packs.md): Browse and download content packs for your use case in Cortex XSOAR 8.14 On-prem Marketplace. * [Content Pack Support Types](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.14/configure-cortex-xsoar/marketplace/content-pack-support-types.md): Understand content pack support types in Cortex XSOAR 8.14 On-prem Marketplace. * [Manage content packs](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.14/configure-cortex-xsoar/marketplace/manage-content-packs.md): Install, update, revert, and delete content packs in Cortex XSOAR 8.14 On-prem Marketplace. * [Set up your use case with the Deployment Wizard](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.14/configure-cortex-xsoar/marketplace/set-up-your-use-case-with-the-deployment-wizard.md): Use the Deployment Wizard to configure your use case in Cortex XSOAR 8.14 On-prem. * [Marketplace FAQs](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.14/configure-cortex-xsoar/marketplace/marketplace-faqs.md): Find answers to common content pack questions in Cortex XSOAR 8.14 On-prem Marketplace. * [Content pack update notifications](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.14/configure-cortex-xsoar/marketplace/content-pack-update-notifications.md): Enable update notifications for content packs in Cortex XSOAR 8.14 On-prem Marketplace. * [Customize content pack notifications](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.14/configure-cortex-xsoar/marketplace/content-pack-update-notifications/customize-content-pack-notifications.md): Customize content pack update notification schedules in Cortex XSOAR 8.14 On-prem Marketplace. * [Content pack contributions](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.14/configure-cortex-xsoar/marketplace/content-pack-contributions.md): Create and submit content packs to Cortex XSOAR 8.14 On-prem Marketplace. * [Create a content pack](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.14/configure-cortex-xsoar/marketplace/content-pack-contributions/create-a-content-pack.md): Create and submit a content pack to Cortex XSOAR 8.14 On-prem Marketplace. * [Resubmit a content pack](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.14/configure-cortex-xsoar/marketplace/content-pack-contributions/resubmit-a-content-pack.md): Resubmit an updated content pack from Cortex XSOAR 8.14 On-prem Marketplace. * [Integrations](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.14/configure-cortex-xsoar/integrations.md): Configure, manage, and troubleshoot integrations in Cortex XSOAR 8.14 On-prem. * [Integration use cases](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.14/configure-cortex-xsoar/integrations/integration-use-cases.md): Explore integration use cases for security operations in Cortex XSOAR 8.14 On-prem. * [Configure integrations](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.14/configure-cortex-xsoar/integrations/configure-integrations.md): Configure integrations and create custom integrations in Cortex XSOAR 8.14 On-prem. * [Change the Docker image in an integration or script](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.14/configure-cortex-xsoar/integrations/change-the-docker-image-in-an-integration-or-script.md): Change Docker images for integrations and scripts in Cortex XSOAR 8.14 On-prem. * [Connect your engine to an image registry](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.14/configure-cortex-xsoar/integrations/change-the-docker-image-in-an-integration-or-script/connect-your-engine-to-an-image-registry.md): Connect an engine to an authenticated image registry in Cortex XSOAR 8.14 On-prem. * [Pull images from a private image registry](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.14/configure-cortex-xsoar/integrations/change-the-docker-image-in-an-integration-or-script/pull-images-from-a-private-image-registry.md): Pull images from a private registry for Cortex XSOAR 8.14 On-prem integrations. * [Manage credentials](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.14/configure-cortex-xsoar/integrations/manage-credentials.md): Manage credentials for integrations in Cortex XSOAR 8.14 On-prem. * [Add an integration instance](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.14/configure-cortex-xsoar/integrations/add-an-integration-instance.md): Set up an integration instance to ingest incidents and indicators in Cortex XSOAR 8.14 On-prem. * [Fetch incidents from an integration instance](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.14/configure-cortex-xsoar/integrations/add-an-integration-instance/fetch-incidents-from-an-integration-instance.md): Configure an integration instance to fetch incidents in Cortex XSOAR 8.14 On-prem. * [Receive notifications on an incident fetch error](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.14/configure-cortex-xsoar/integrations/add-an-integration-instance/receive-notifications-on-an-incident-fetch-error.md): Receive incident fetch error notifications from integrations in Cortex XSOAR 8.14 On-prem. * [Configure integration permissions](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.14/configure-cortex-xsoar/integrations/add-an-integration-instance/configure-integration-permissions.md): Restrict integration commands to specific roles in Cortex XSOAR 8.14 On-prem. * [Troubleshoot integrations](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.14/configure-cortex-xsoar/integrations/add-an-integration-instance/troubleshoot-integrations.md): Troubleshoot integration issues in Cortex XSOAR 8.14 On-prem. * [Integration commands in the CLI](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.14/configure-cortex-xsoar/integrations/integration-commands-in-the-cli.md): Run integration commands from the CLI in Cortex XSOAR 8.14 On-prem. * [Forward requests to long-running integrations](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.14/configure-cortex-xsoar/integrations/forward-requests-to-long-running-integrations.md): Configure long-running integrations in Cortex XSOAR 8.14 On-prem. * [Incident configuration](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.14/configure-cortex-xsoar/incident-configuration.md): Configure incident types, fields, layouts, and workflows in Cortex XSOAR 8.14 On-prem. * [Incident lifecycle](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.14/configure-cortex-xsoar/incident-configuration/incident-lifecycle.md): Understand the incident lifecycle in Cortex XSOAR 8.14 On-prem. * [Incident Customization](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.14/configure-cortex-xsoar/incident-configuration/incident-customization.md): Create and edit incident types, fields, and layouts in Cortex XSOAR 8.14 On-prem. * [Use incident context data](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.14/configure-cortex-xsoar/incident-configuration/incident-customization/use-incident-context-data.md): Use context data to customize incident layouts in Cortex XSOAR 8.14 On-prem. * [Create an incident type](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.14/configure-cortex-xsoar/incident-configuration/incident-customization/create-an-incident-type.md): Create and edit incident types in Cortex XSOAR 8.14 On-prem. * [Create an incident field](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.14/configure-cortex-xsoar/incident-configuration/incident-customization/create-an-incident-field.md): Create custom incident fields in Cortex XSOAR 8.14 On-prem. * [Incident field trigger scripts](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.14/configure-cortex-xsoar/incident-configuration/incident-customization/create-an-incident-field/incident-field-trigger-scripts.md): Configure incident field trigger scripts in Cortex XSOAR 8.14 On-prem. * [Create dynamic fields](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.14/configure-cortex-xsoar/incident-configuration/incident-customization/create-an-incident-field/create-dynamic-fields.md): Create dynamic incident fields in Cortex XSOAR 8.14 On-prem. * [Troubleshoot incident fields](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.14/configure-cortex-xsoar/incident-configuration/incident-customization/create-an-incident-field/troubleshoot-incident-fields.md): Troubleshoot incident fields in Cortex XSOAR 8.14 On-prem. * [Incident layout customization](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.14/configure-cortex-xsoar/incident-configuration/incident-customization/incident-layout-customization.md): Customize incident layouts to display relevant data in Cortex XSOAR 8.14 On-prem. * [Examples of using scripts in incident layouts](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.14/configure-cortex-xsoar/incident-configuration/incident-customization/incident-layout-customization/examples-of-using-scripts-in-incident-layouts.md): Use scripts in incident layouts in Cortex XSOAR 8.14 On-prem. * [Create an evidence field](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.14/configure-cortex-xsoar/incident-configuration/create-an-evidence-field.md): Create custom evidence fields in Cortex XSOAR 8.14 On-prem. * [Classification and mapping](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.14/configure-cortex-xsoar/incident-configuration/classification-and-mapping.md): Classify and map integration data in Cortex XSOAR 8.14 On-prem. * [Create an incident classifier](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.14/configure-cortex-xsoar/incident-configuration/classification-and-mapping/create-an-incident-classifier.md): Create incident classifiers for integration events in Cortex XSOAR 8.14 On-prem. * [Create an incident mapper](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.14/configure-cortex-xsoar/incident-configuration/classification-and-mapping/create-an-incident-mapper.md): Create and apply incident mappers to integrations in Cortex XSOAR 8.14 On-prem. * [Set up incident mirroring](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.14/configure-cortex-xsoar/incident-configuration/set-up-incident-mirroring.md): Set up integrations to mirror incidents in Cortex XSOAR 8.14 On-prem. * [Incident deduplication in Cortex XSOAR](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.14/configure-cortex-xsoar/incident-configuration/incident-deduplication-in-cortex-xsoar.md): Deduplicate incidents with rules and playbooks in Cortex XSOAR 8.14 On-prem. * [Pre-process rules](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.14/configure-cortex-xsoar/incident-configuration/pre-process-rules.md): Create pre-process rules for incoming incidents in Cortex XSOAR 8.14 On-prem. * [Use post-processing scripts in an incident](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.14/configure-cortex-xsoar/incident-configuration/use-post-processing-scripts-in-an-incident.md): Use post-processing scripts before closing incidents in Cortex XSOAR 8.14 On-prem. * [Customize incident close reasons](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.14/configure-cortex-xsoar/incident-configuration/customize-incident-close-reasons.md): Customize incident close reasons in Cortex XSOAR 8.14 On-prem. * [Configure inline value fields](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.14/configure-cortex-xsoar/incident-configuration/configure-inline-value-fields.md): Configure inline value fields in incident layouts in Cortex XSOAR 8.14 On-prem. * [Configure incident export and delete](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.14/configure-cortex-xsoar/incident-configuration/configure-incident-export-and-delete.md): Export and delete incidents using external storage in Cortex XSOAR 8.14 On-prem. * [Configure access to external storage](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.14/configure-cortex-xsoar/incident-configuration/configure-incident-export-and-delete/configure-access-to-external-storage.md): Configure external storage for incident exports in Cortex XSOAR 8.14 On-prem. * [Schedule incident export and delete](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.14/configure-cortex-xsoar/incident-configuration/configure-incident-export-and-delete/schedule-incident-export-and-delete.md): Schedule incident exports and deletions to external storage in Cortex XSOAR 8.14 On-prem. * [Export an incident to CSV using the UTF8-BOM format](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.14/configure-cortex-xsoar/incident-configuration/export-an-incident-to-csv-using-the-utf8-bom-format.md): Export incidents to UTF8-BOM CSV files in Cortex XSOAR 8.14 On-prem. * [Amazon S3 configuration example](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.14/configure-cortex-xsoar/incident-configuration/amazon-s3-configuration-example.md): Configure Amazon S3 storage for incident exports in Cortex XSOAR 8.14 On-prem. * [Playbooks](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.14/configure-cortex-xsoar/playbooks.md): Build automated security workflows with playbooks in Cortex XSOAR 8.14 On-prem. * [What is a playbook?](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.14/configure-cortex-xsoar/playbooks/what-is-a-playbook.md): Learn how playbooks automate security processes in Cortex XSOAR 8.14 On-prem. * [Playbook development checklist](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.14/configure-cortex-xsoar/playbooks/playbook-development-checklist.md): Follow the playbook development checklist in Cortex XSOAR 8.14 On-prem. * [Plan your playbook](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.14/configure-cortex-xsoar/playbooks/plan-your-playbook.md): Plan effective security automation workflows in Cortex XSOAR 8.14 On-prem. * [Develop your playbook](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.14/configure-cortex-xsoar/playbooks/develop-your-playbook.md): Create and customize playbooks for your workflows in Cortex XSOAR 8.14 On-prem. * [Task 1. Choose from existing playbooks or create your own](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.14/configure-cortex-xsoar/playbooks/develop-your-playbook/task-1.-choose-from-existing-playbooks-or-create-your-own.md): Choose, customize, or create playbooks in Cortex XSOAR 8.14 On-prem. * [Task 2. Configure playbook settings](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.14/configure-cortex-xsoar/playbooks/develop-your-playbook/task-2.-configure-playbook-settings.md): Configure playbook settings for automated workflows in Cortex XSOAR 8.14 On-prem. * [Task 3. Add tasks](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.14/configure-cortex-xsoar/playbooks/develop-your-playbook/task-3.-add-tasks.md): Add tasks to playbook workflows in Cortex XSOAR 8.14 On-prem. * [Set playbook inputs and outputs](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.14/configure-cortex-xsoar/playbooks/develop-your-playbook/task-3.-add-tasks/set-playbook-inputs-and-outputs.md): Define task inputs and outputs for playbooks in Cortex XSOAR 8.14 On-prem. * [Create a section header](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.14/configure-cortex-xsoar/playbooks/develop-your-playbook/task-3.-add-tasks/create-a-section-header.md): Organize playbook tasks with section headers in Cortex XSOAR 8.14 On-prem. * [Create a standard task](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.14/configure-cortex-xsoar/playbooks/develop-your-playbook/task-3.-add-tasks/create-a-standard-task.md): Create standard automated tasks in Cortex XSOAR 8.14 On-prem playbooks. * [Create a conditional task](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.14/configure-cortex-xsoar/playbooks/develop-your-playbook/task-3.-add-tasks/create-a-conditional-task.md): Create conditional tasks for playbook logic in Cortex XSOAR 8.14 On-prem. * [Create a communication task](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.14/configure-cortex-xsoar/playbooks/develop-your-playbook/task-3.-add-tasks/create-a-communication-task.md): Create communication tasks for playbooks in Cortex XSOAR 8.14 On-prem. * [Configure script error handling in a playbook](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.14/configure-cortex-xsoar/playbooks/develop-your-playbook/task-3.-add-tasks/configure-script-error-handling-in-a-playbook.md): Configure script error handling for playbooks in Cortex XSOAR 8.14 On-prem. * [Task 4. Add inline documentation](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.14/configure-cortex-xsoar/playbooks/develop-your-playbook/task-4.-add-inline-documentation.md): Add inline documentation to playbook workflows in Cortex XSOAR 8.14 On-prem. * [Task 5. Add custom playbook features](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.14/configure-cortex-xsoar/playbooks/develop-your-playbook/task-5.-add-custom-playbook-features.md): Add custom features to playbook workflows in Cortex XSOAR 8.14 On-prem. * [Task 6. Test and debug the playbook](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.14/configure-cortex-xsoar/playbooks/develop-your-playbook/task-6.-test-and-debug-the-playbook.md): Test and debug playbook workflows in Cortex XSOAR 8.14 On-prem. * [Task 7. Manage playbook content](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.14/configure-cortex-xsoar/playbooks/develop-your-playbook/task-7.-manage-playbook-content.md): Manage playbook content and versions in Cortex XSOAR 8.14 On-prem. * [Customize a playbook for a phishing use case example](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.14/configure-cortex-xsoar/playbooks/develop-your-playbook/customize-a-playbook-for-a-phishing-use-case-example.md): Customize a phishing response playbook in Cortex XSOAR 8.14 On-prem. * [Customize your playbook](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.14/configure-cortex-xsoar/playbooks/customize-your-playbook.md): Customize playbooks with scripts, data, and automation in Cortex XSOAR 8.14 On-prem. * [Customize the SOC name](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.14/configure-cortex-xsoar/playbooks/customize-your-playbook/customize-the-soc-name.md): Customize the SOC name for communication tasks in Cortex XSOAR 8.14 On-prem. * [Configure a sub-playbook](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.14/configure-cortex-xsoar/playbooks/customize-your-playbook/configure-a-sub-playbook.md): Configure sub-playbooks and loops in Cortex XSOAR 8.14 On-prem. * [Filter and transform data](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.14/configure-cortex-xsoar/playbooks/customize-your-playbook/filter-and-transform-data.md): Filter and transform workflow data in Cortex XSOAR 8.14 On-prem. * [Extract indicators](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.14/configure-cortex-xsoar/playbooks/customize-your-playbook/extract-indicators.md): Extract and enrich indicators in playbooks in Cortex XSOAR 8.14 On-prem. * [Extend context](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.14/configure-cortex-xsoar/playbooks/customize-your-playbook/extend-context.md): Extend playbook context with integration data in Cortex XSOAR 8.14 On-prem. * [Set and update incident fields](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.14/configure-cortex-xsoar/playbooks/customize-your-playbook/set-and-update-incident-fields.md): Set and update incident fields with playbooks in Cortex XSOAR 8.14 On-prem. * [Playbook polling](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.14/configure-cortex-xsoar/playbooks/customize-your-playbook/playbook-polling.md): Configure playbook polling for external processes in Cortex XSOAR 8.14 On-prem. * [Scripts](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.14/configure-cortex-xsoar/playbooks/scripts.md): Create, edit, and manage automation scripts in Cortex XSOAR 8.14 On-prem. * [Use existing scripts](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.14/configure-cortex-xsoar/playbooks/scripts/use-existing-scripts.md): Use and edit scripts in playbooks and the War Room in Cortex XSOAR 8.14 On-prem. * [Create a script](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.14/configure-cortex-xsoar/playbooks/scripts/create-a-script.md): Create and edit automation scripts in Cortex XSOAR 8.14 On-prem. * [Debug your playbook](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.14/configure-cortex-xsoar/playbooks/debug-your-playbook.md): Debug playbooks with breakpoints and overrides in Cortex XSOAR 8.14 On-prem. * [Troubleshoot playbook performance](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.14/configure-cortex-xsoar/playbooks/debug-your-playbook/troubleshoot-playbook-performance.md): Troubleshoot playbook performance in Cortex XSOAR 8.14 On-prem. * [Manage playbook content](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.14/configure-cortex-xsoar/playbooks/manage-playbook-content.md): Manage playbook content with versions and remote repositories in Cortex XSOAR 8.14 On-prem. * [Playbook best practices](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.14/configure-cortex-xsoar/playbooks/best-practices.md): Follow playbook development best practices in Cortex XSOAR 8.14 On-prem. * [Lists](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.14/configure-cortex-xsoar/lists.md): Create and manage lists for playbooks and scripts in Cortex XSOAR 8.14 On-prem. * [What is a list?](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.14/configure-cortex-xsoar/lists/what-is-a-list.md): Learn how lists store reusable data in Cortex XSOAR 8.14 On-prem. * [Create a list](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.14/configure-cortex-xsoar/lists/create-a-list.md): Create reusable lists for playbooks, scripts, and the CLI in Cortex XSOAR 8.14 On-prem. * [List commands](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.14/configure-cortex-xsoar/lists/list-commands.md): Use list commands in the CLI, playbooks, and scripts in Cortex XSOAR 8.14 On-prem. * [Use cases: JSON lists](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.14/configure-cortex-xsoar/lists/use-cases-json-lists.md): Manage JSON lists for automations and playbooks in Cortex XSOAR 8.14 On-prem. * [Transform a list into an array](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.14/configure-cortex-xsoar/lists/transform-a-list-into-an-array.md): Transform list values into arrays for tasks and mappings in Cortex XSOAR 8.14 On-prem. * [Jobs](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.14/configure-cortex-xsoar/jobs.md): Create scheduled and event-triggered jobs for playbooks in Cortex XSOAR 8.14 On-prem. * [Manage jobs](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.14/configure-cortex-xsoar/jobs/manage-jobs.md): Manage scheduled and feed-triggered playbook jobs in Cortex XSOAR 8.14 On-prem. * [Create a time triggered job](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.14/configure-cortex-xsoar/jobs/create-a-time-triggered-job.md): Create time-triggered and feed-triggered jobs in Cortex XSOAR 8.14 On-prem. * [Create a job triggered by a delta in a feed](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.14/configure-cortex-xsoar/jobs/create-a-job-triggered-by-a-delta-in-a-feed.md): Create jobs triggered by feed changes in Cortex XSOAR 8.14 On-prem. * [Create jobs to process indicators example](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.14/configure-cortex-xsoar/jobs/create-jobs-to-process-indicators-example.md): Create jobs that process indicators and send them to a SIEM in Cortex XSOAR 8.14 On-prem. * [SLAs](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.14/configure-cortex-xsoar/slas.md): Configure service-level agreements for investigations in Cortex XSOAR 8.14 On-prem. * [SLAs in Cortex XSOAR](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.14/configure-cortex-xsoar/slas/slas-in-cortex-xsoar.md): Learn how SLA fields track investigation deadlines in Cortex XSOAR 8.14 On-prem. * [Configure an SLA in an incident type](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.14/configure-cortex-xsoar/slas/configure-an-sla-in-an-incident-type.md): Configure SLA deadlines for incident types in Cortex XSOAR 8.14 On-prem. * [Configure Timer/SLA fields](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.14/configure-cortex-xsoar/slas/configure-timersla-fields.md): Create timer and SLA fields with triggered scripts in Cortex XSOAR 8.14 On-prem. * [Configure a playbook to run Timers/SLAs](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.14/configure-cortex-xsoar/slas/configure-a-playbook-to-run-timersslas.md): Configure playbooks to manage SLA timers in Cortex XSOAR 8.14 On-prem. * [Automate changes to incident fields using SLA scripts](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.14/configure-cortex-xsoar/slas/automate-changes-to-incident-fields-using-sla-scripts.md): Automate incident field updates after SLA breaches in Cortex XSOAR 8.14 On-prem. * [Create SLA scripts](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.14/configure-cortex-xsoar/slas/create-sla-scripts.md): Create scripts that respond to SLA breaches in Cortex XSOAR 8.14 On-prem. * [Use SLA and Timer field commands manually in the CLI](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.14/configure-cortex-xsoar/slas/use-sla-and-timer-field-commands-manually-in-the-cli.md): Use SLA and timer field commands in the CLI in Cortex XSOAR 8.14 On-prem. * [Configure the Global Risk Threshold](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.14/configure-cortex-xsoar/slas/configure-the-global-risk-threshold.md): Configure the global SLA risk threshold in Cortex XSOAR 8.14 On-prem. * [Search incidents for Timer/SLAs](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.14/configure-cortex-xsoar/slas/search-incidents-for-timerslas.md): Search incidents by SLA status and timer fields in Cortex XSOAR 8.14 On-prem. * [Dashboards and Reports](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.14/configure-cortex-xsoar/dashboards-and-reports.md): Create dashboards, reports, and widgets in Cortex XSOAR 8.14 On-prem. * [Dashboards](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.14/configure-cortex-xsoar/dashboards-and-reports/dashboards.md): Create, customize, and share dashboards in Cortex XSOAR 8.14 On-prem. * [Dashboard actions](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.14/configure-cortex-xsoar/dashboards-and-reports/dashboards/dashboard-actions.md): Create, import, share, and manage dashboards in Cortex XSOAR 8.14 On-prem. * [Manage dashboards](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.14/configure-cortex-xsoar/dashboards-and-reports/dashboards/manage-dashboards.md): Manage dashboard layouts, widgets, and sharing in Cortex XSOAR 8.14 On-prem. * [Reports](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.14/configure-cortex-xsoar/dashboards-and-reports/reports.md): Create, customize, and schedule reports in Cortex XSOAR 8.14 On-prem. * [Manage reports](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.14/configure-cortex-xsoar/dashboards-and-reports/reports/manage-reports.md): Manage report widgets, schedules, timezones, and formats in Cortex XSOAR 8.14 On-prem. * [Configure the timezone in a report](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.14/configure-cortex-xsoar/dashboards-and-reports/reports/configure-the-timezone-in-a-report.md): Configure report timezones and time formats in Cortex XSOAR 8.14 On-prem. * [Troubleshoot script timeout for reports](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.14/configure-cortex-xsoar/dashboards-and-reports/reports/troubleshoot-script-timeout-for-reports.md): Configure report script timeouts in Cortex XSOAR 8.14 On-prem. * [Troubleshoot overlapping text and extra pages](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.14/configure-cortex-xsoar/dashboards-and-reports/reports/troubleshoot-overlapping-text-and-extra-pages.md): Fix overlapping text and extra pages in Cortex XSOAR 8.14 On-prem PDF reports. * [Widgets](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.14/configure-cortex-xsoar/dashboards-and-reports/widgets.md): Create and edit widgets for dashboards and reports in Cortex XSOAR 8.14 On-prem. * [Widget customization](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.14/configure-cortex-xsoar/dashboards-and-reports/widgets/widget-customization.md): Customize widgets to analyze and display data in Cortex XSOAR 8.14 On-prem. * [Create a widget using the widget builder](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.14/configure-cortex-xsoar/dashboards-and-reports/widgets/create-a-widget-using-the-widget-builder.md): Create widgets with the Widget Builder in Cortex XSOAR 8.14 On-prem. * [Create a custom widget using a JSON file](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.14/configure-cortex-xsoar/dashboards-and-reports/widgets/create-a-custom-widget-using-a-json-file.md): Create custom JSON widgets for dashboards and reports in Cortex XSOAR 8.14 On-prem. * [Create a custom widget using a script](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.14/configure-cortex-xsoar/dashboards-and-reports/widgets/create-a-custom-widget-using-a-script.md): Create custom script-based widgets in Cortex XSOAR 8.14 On-prem. * [Create a widget from an incident](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.14/configure-cortex-xsoar/dashboards-and-reports/widgets/create-a-widget-from-an-incident.md): Create widgets from incident searches in Cortex XSOAR 8.14 On-prem. * [Create a widget from an indicator](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.14/configure-cortex-xsoar/dashboards-and-reports/widgets/create-a-widget-from-an-indicator.md): Create widgets from indicator searches in Cortex XSOAR 8.14 On-prem. * [Edit a widget](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.14/configure-cortex-xsoar/dashboards-and-reports/widgets/edit-a-widget.md): Edit widgets in the library, dashboards, and reports in Cortex XSOAR 8.14 On-prem. * [Add a widget in the War Room](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.14/configure-cortex-xsoar/dashboards-and-reports/widgets/add-a-widget-in-the-war-room.md): Add script-based widgets in the War Room in Cortex XSOAR 8.14 On-prem. * [Saved By Dbot (ROI) Widget](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.14/configure-cortex-xsoar/dashboards-and-reports/widgets/saved-by-dbot-roi-widget.md): Customize the Saved by Dbot ROI widget in Cortex XSOAR 8.14 On-prem. * [Incidents and indicators investigation](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.14/investigate-and-respond-to-threats/incidents-and-indicators-investigation.md): Investigate incidents and indicators in Cortex XSOAR 8.14 On-prem. * [Incidents](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.14/investigate-and-respond-to-threats/incidents-and-indicators-investigation/incidents.md): Understand incidents for investigation and remediation in Cortex XSOAR 8.14 On-prem. * [Incident management](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.14/investigate-and-respond-to-threats/incidents-and-indicators-investigation/incident-management.md): View and manage incidents in Cortex XSOAR 8.14 On-prem. * [Search for incidents](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.14/investigate-and-respond-to-threats/incidents-and-indicators-investigation/incident-management/search-for-incidents.md): Search for incidents and save search queries in Cortex XSOAR 8.14 On-prem. * [Create an incident](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.14/investigate-and-respond-to-threats/incidents-and-indicators-investigation/incident-management/create-an-incident.md): Create and ingest incidents in Cortex XSOAR 8.14 On-prem. * [Export incidents](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.14/investigate-and-respond-to-threats/incidents-and-indicators-investigation/incident-management/export-incidents.md): Export incidents in Cortex XSOAR 8.14 On-prem. * [Export incidents from the Incidents table](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.14/investigate-and-respond-to-threats/incidents-and-indicators-investigation/incident-management/export-incidents/export-incidents-from-the-incidents-table.md): Export incidents from the Incidents table as Excel, CSV, or JSON files in Cortex XSOAR 8.14 On-prem. * [Export incidents on demand](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.14/investigate-and-respond-to-threats/incidents-and-indicators-investigation/incident-management/export-incidents/export-incidents-on-demand.md): Export incidents on demand to external storage in Cortex XSOAR 8.14 On-prem. * [Investigate an incident](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.14/investigate-and-respond-to-threats/incidents-and-indicators-investigation/investigate-an-incident.md): Investigate incidents and take remediation steps in Cortex XSOAR 8.14 On-prem. * [Retain incidents](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.14/investigate-and-respond-to-threats/incidents-and-indicators-investigation/investigate-an-incident/retain-incidents.md): Retain incidents for investigation in Cortex XSOAR 8.14 On-prem. * [Limit access to investigations using access control](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.14/investigate-and-respond-to-threats/incidents-and-indicators-investigation/investigate-an-incident/limit-access-to-investigations-using-access-control.md): Limit access to incidents and investigations in Cortex XSOAR 8.14 On-prem. * [Incident Tasks](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.14/investigate-and-respond-to-threats/incidents-and-indicators-investigation/investigate-an-incident/incident-tasks.md): Manage playbook and to-do tasks in Cortex XSOAR 8.14 On-prem investigations. * [Use the War Room in an investigation](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.14/investigate-and-respond-to-threats/incidents-and-indicators-investigation/investigate-an-incident/use-the-war-room-in-an-investigation.md): Use the War Room during investigations in Cortex XSOAR 8.14 On-prem. * [Schedule a command in the War Room](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.14/investigate-and-respond-to-threats/incidents-and-indicators-investigation/investigate-an-incident/schedule-a-command-in-the-war-room.md): Schedule War Room commands in Cortex XSOAR 8.14 On-prem. * [Run commands in the CLI](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.14/investigate-and-respond-to-threats/incidents-and-indicators-investigation/investigate-an-incident/run-commands-in-the-cli.md): Run system, integration, and script commands from the Cortex XSOAR 8.14 On-prem CLI. * [Evidence Handling](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.14/investigate-and-respond-to-threats/incidents-and-indicators-investigation/investigate-an-incident/evidence-handling.md): Add and manage investigation evidence in Cortex XSOAR 8.14 On-prem. * [Use the Work Plan in an investigation](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.14/investigate-and-respond-to-threats/incidents-and-indicators-investigation/investigate-an-incident/use-the-work-plan-in-an-investigation.md): Monitor and manage playbook workflows in Cortex XSOAR 8.14 On-prem Work Plans. * [Investigate an incident using the canvas](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.14/investigate-and-respond-to-threats/incidents-and-indicators-investigation/investigate-an-incident/investigate-an-incident-using-the-canvas.md): Visually map incidents with the investigation canvas in Cortex XSOAR 8.14 On-prem. * [Link incidents](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.14/investigate-and-respond-to-threats/incidents-and-indicators-investigation/investigate-an-incident/link-incidents.md): Link related incidents in Cortex XSOAR 8.14 On-prem. * [Create an incident summary report](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.14/investigate-and-respond-to-threats/incidents-and-indicators-investigation/investigate-an-incident/create-an-incident-summary-report.md): Create and save incident summary reports in Cortex XSOAR 8.14 On-prem. * [Manage indicators](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.14/investigate-and-respond-to-threats/incidents-and-indicators-investigation/manage-indicators.md): Create, manage, and search indicators in Cortex XSOAR 8.14 On-prem. * [Query indicators](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.14/investigate-and-respond-to-threats/incidents-and-indicators-investigation/manage-indicators/query-indicators.md): Query indicators in the Cortex XSOAR 8.14 On-prem threat intel library. * [View indicator relationships in an investigation](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.14/investigate-and-respond-to-threats/incidents-and-indicators-investigation/manage-indicators/view-indicator-relationships-in-an-investigation.md): View and create indicator relationships in Cortex XSOAR 8.14 On-prem. * [Threat Intel Management](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.14/investigate-and-respond-to-threats/threat-intel-management.md): Manage threat intelligence, indicators, and reports in Cortex XSOAR 8.14 On-prem. * [Get started with Threat Intel Management](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.14/investigate-and-respond-to-threats/threat-intel-management/get-started-with-threat-intel-management.md): Get started with Threat Intel Management in Cortex XSOAR 8.14 On-prem. * [What is Threat Intel Management?](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.14/investigate-and-respond-to-threats/threat-intel-management/get-started-with-threat-intel-management/what-is-threat-intel-management.md): Learn Threat Intel Management concepts and use cases in Cortex XSOAR 8.14 On-prem. * [Threat Intel Management use cases](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.14/investigate-and-respond-to-threats/threat-intel-management/get-started-with-threat-intel-management/threat-intel-management-use-cases.md): Explore Threat Intel Management use cases in Cortex XSOAR 8.14 On-prem. * [Indicator concepts](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.14/investigate-and-respond-to-threats/threat-intel-management/get-started-with-threat-intel-management/indicator-concepts.md): Learn core indicator concepts in Cortex XSOAR 8.14 On-prem. * [Indicator lifecycle](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.14/investigate-and-respond-to-threats/threat-intel-management/get-started-with-threat-intel-management/indicator-lifecycle.md): Understand the indicator lifecycle in Cortex XSOAR 8.14 On-prem. * [Roles and responsibilities in Threat Intel Management](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.14/investigate-and-respond-to-threats/threat-intel-management/get-started-with-threat-intel-management/roles-and-responsibilities-in-threat-intel-management.md): Understand Threat Intel Management roles in Cortex XSOAR 8.14 On-prem. * [Indicator configuration](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.14/investigate-and-respond-to-threats/threat-intel-management/indicator-configuration.md): Configure indicator types, fields, layouts, and extraction in Cortex XSOAR 8.14 On-prem. * [Customize indicator types, fields, and layouts](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.14/investigate-and-respond-to-threats/threat-intel-management/indicator-configuration/customize-indicator-types-fields-and-layouts.md): Customize indicator types, fields, and layouts in Cortex XSOAR 8.14 On-prem. * [Create an indicator type](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.14/investigate-and-respond-to-threats/threat-intel-management/indicator-configuration/customize-indicator-types-fields-and-layouts/create-an-indicator-type.md): Create custom indicator types in Cortex XSOAR 8.14 On-prem. * [Indicator type profile](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.14/investigate-and-respond-to-threats/threat-intel-management/indicator-configuration/customize-indicator-types-fields-and-layouts/indicator-type-profile.md): Configure indicator type profiles in Cortex XSOAR 8.14 On-prem. * [File indicators](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.14/investigate-and-respond-to-threats/threat-intel-management/indicator-configuration/customize-indicator-types-fields-and-layouts/file-indicators.md): Work with file indicators in Cortex XSOAR 8.14 On-prem. * [Formatting scripts](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.14/investigate-and-respond-to-threats/threat-intel-management/indicator-configuration/customize-indicator-types-fields-and-layouts/formatting-scripts.md): Use indicator formatting scripts in Cortex XSOAR 8.14 On-prem. * [Enhancement scripts](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.14/investigate-and-respond-to-threats/threat-intel-management/indicator-configuration/customize-indicator-types-fields-and-layouts/enhancement-scripts.md): Use indicator enhancement scripts in Cortex XSOAR 8.14 On-prem. * [Reputation scripts](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.14/investigate-and-respond-to-threats/threat-intel-management/indicator-configuration/customize-indicator-types-fields-and-layouts/reputation-scripts.md): Use indicator reputation scripts in Cortex XSOAR 8.14 On-prem. * [Reputation commands](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.14/investigate-and-respond-to-threats/threat-intel-management/indicator-configuration/customize-indicator-types-fields-and-layouts/reputation-commands.md): Use indicator reputation commands in Cortex XSOAR 8.14 On-prem. * [Map custom indicator fields](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.14/investigate-and-respond-to-threats/threat-intel-management/indicator-configuration/customize-indicator-types-fields-and-layouts/map-custom-indicator-fields.md): Map custom indicator fields in Cortex XSOAR 8.14 On-prem. * [Create an indicator field](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.14/investigate-and-respond-to-threats/threat-intel-management/indicator-configuration/customize-indicator-types-fields-and-layouts/create-an-indicator-field.md): Create custom indicator fields in Cortex XSOAR 8.14 On-prem. * [Indicator fields structure](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.14/investigate-and-respond-to-threats/threat-intel-management/indicator-configuration/customize-indicator-types-fields-and-layouts/indicator-fields-structure.md): Understand indicator field structure in Cortex XSOAR 8.14 On-prem. * [Indicator field trigger scripts](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.14/investigate-and-respond-to-threats/threat-intel-management/indicator-configuration/customize-indicator-types-fields-and-layouts/indicator-field-trigger-scripts.md): Configure indicator field trigger scripts in Cortex XSOAR 8.14 On-prem. * [Indicator layout customization](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.14/investigate-and-respond-to-threats/threat-intel-management/indicator-configuration/customize-indicator-types-fields-and-layouts/indicator-layout-customization.md): Customize indicator layouts in Cortex XSOAR 8.14 On-prem. * [Indicator classification and mapping](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.14/investigate-and-respond-to-threats/threat-intel-management/indicator-configuration/indicator-classification-and-mapping.md): Classify and map indicators in Cortex XSOAR 8.14 On-prem. * [Indicator extraction](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.14/investigate-and-respond-to-threats/threat-intel-management/indicator-configuration/indicator-extraction.md): Extract and enrich indicators in Cortex XSOAR 8.14 On-prem. * [Indicator extraction modes](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.14/investigate-and-respond-to-threats/threat-intel-management/indicator-configuration/indicator-extraction/indicator-extraction-modes.md): Choose indicator extraction modes in Cortex XSOAR 8.14 On-prem. * [Create indicator extraction rules for an incident type](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.14/investigate-and-respond-to-threats/threat-intel-management/indicator-configuration/indicator-extraction/create-indicator-extraction-rules-for-an-incident-type.md): Create indicator extraction rules in Cortex XSOAR 8.14 On-prem. * [Set the indicator extraction mode for a playbook task](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.14/investigate-and-respond-to-threats/threat-intel-management/indicator-configuration/indicator-extraction/set-the-indicator-extraction-mode-for-a-playbook-task.md): Set extraction modes for playbook tasks in Cortex XSOAR 8.14 On-prem. * [Disable indicator extraction for scripts or integrations](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.14/investigate-and-respond-to-threats/threat-intel-management/indicator-configuration/indicator-extraction/disable-indicator-extraction-for-scripts-or-integrations.md): Disable indicator extraction in Cortex XSOAR 8.14 On-prem. * [Troubleshoot indicator extraction](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.14/investigate-and-respond-to-threats/threat-intel-management/indicator-configuration/indicator-extraction/troubleshoot-indicator-extraction.md): Troubleshoot indicator extraction in Cortex XSOAR 8.14 On-prem. * [Configure the indicator timeline](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.14/investigate-and-respond-to-threats/threat-intel-management/indicator-configuration/configure-the-indicator-timeline.md): Configure the indicator timeline in Cortex XSOAR 8.14 On-prem. * [Configure indicator expiration](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.14/investigate-and-respond-to-threats/threat-intel-management/indicator-configuration/configure-indicator-expiration.md): Configure indicator expiration in Cortex XSOAR 8.14 On-prem. * [Configure Threat Intel feed integrations](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.14/investigate-and-respond-to-threats/threat-intel-management/indicator-configuration/configure-threat-intel-feed-integrations.md): Configure threat intelligence feed integrations in Cortex XSOAR 8.14 On-prem. * [Exclude indicators from enrichment](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.14/investigate-and-respond-to-threats/threat-intel-management/indicator-configuration/exclude-indicators-from-enrichment.md): Exclude indicators from enrichment in Cortex XSOAR 8.14 On-prem. * [Configure Threat Intelligence Management playbooks to process indicators](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.14/investigate-and-respond-to-threats/threat-intel-management/indicator-configuration/configure-threat-intelligence-management-playbooks-to-process-indicators.md): Configure TIM playbooks to process indicators in Cortex XSOAR 8.14 On-prem. * [Export indicators](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.14/investigate-and-respond-to-threats/threat-intel-management/export-indicators.md): Export indicators and configure external dynamic lists in Cortex XSOAR 8.14 On-prem. * [Customize Threat Intel Reports](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.14/investigate-and-respond-to-threats/threat-intel-management/customize-threat-intel-reports.md): Customize threat intel reports in Cortex XSOAR 8.14 On-prem. * [Create a Threat Intel Report type](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.14/investigate-and-respond-to-threats/threat-intel-management/customize-threat-intel-reports/create-a-threat-intel-report-type.md): Create and manage threat intel report types in Cortex XSOAR 8.14 On-prem. * [Create a Threat Intel Report field](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.14/investigate-and-respond-to-threats/threat-intel-management/customize-threat-intel-reports/create-a-threat-intel-report-field.md): Create threat intel report fields in Cortex XSOAR 8.14 On-prem. * [Create a Threat Intel Report layout](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.14/investigate-and-respond-to-threats/threat-intel-management/customize-threat-intel-reports/create-a-threat-intel-report-layout.md): Configure threat intel report layouts in Cortex XSOAR 8.14 On-prem. * [Indicator management](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.14/investigate-and-respond-to-threats/threat-intel-management/indicator-management.md): Create, manage, and search threat intel indicators in Cortex XSOAR 8.14 On-prem. * [Query indicators](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.14/investigate-and-respond-to-threats/threat-intel-management/indicator-management/query-indicators.md): Query indicators in the Cortex XSOAR 8.14 On-prem threat intel library. * [Indicator investigation](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.14/investigate-and-respond-to-threats/threat-intel-management/indicator-investigation.md): Investigate indicators and relationships in Cortex XSOAR 8.14 On-prem. * [Indicator verdict](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.14/investigate-and-respond-to-threats/threat-intel-management/indicator-investigation/indicator-verdict.md): Determine indicator verdicts in Cortex XSOAR 8.14 On-prem. * [Extract and enrich an indicator](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.14/investigate-and-respond-to-threats/threat-intel-management/indicator-investigation/extract-and-enrich-an-indicator.md): Extract and enrich indicators in Cortex XSOAR 8.14 On-prem. * [Expire an indicator](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.14/investigate-and-respond-to-threats/threat-intel-management/indicator-investigation/expire-an-indicator.md): Expire indicators in the Cortex XSOAR 8.14 On-prem CLI or UI. * [Manage indicator relationships](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.14/investigate-and-respond-to-threats/threat-intel-management/indicator-investigation/manage-indicator-relationships.md): Manage indicator relationships in Cortex XSOAR 8.14 On-prem. * [Delete and exclude indicators](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.14/investigate-and-respond-to-threats/threat-intel-management/indicator-investigation/delete-and-exclude-indicators.md): Delete and exclude indicators in Cortex XSOAR 8.14 On-prem. * [Manage Threat Intel Reports](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.14/investigate-and-respond-to-threats/threat-intel-management/manage-threat-intel-reports.md): Manage threat intel reports in Cortex XSOAR 8.14 On-prem. * [Troubleshoot](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.14/troubleshoot-and-reference/troubleshoot.md): Troubleshoot system errors, diagnostics, and logs in Cortex XSOAR 8.14 On-prem. * [View system status in the System Diagnostics page](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.14/troubleshoot-and-reference/troubleshoot/view-system-status-in-the-system-diagnostics-page.md): Monitor system status, errors, and resource usage in Cortex XSOAR 8.14 On-prem. * [View Guard Rails warnings and errors](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.14/troubleshoot-and-reference/troubleshoot/view-guard-rails-warnings-and-errors.md): Review Guard Rails warnings and errors that affect Cortex XSOAR 8.14 On-prem performance. * [Access logs and log bundles](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.14/troubleshoot-and-reference/troubleshoot/access-logs-and-log-bundles.md): View logs and download log bundles for Cortex XSOAR 8.14 On-prem troubleshooting. * [Management audit logs](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.14/troubleshoot-and-reference/troubleshoot/management-audit-logs.md): View, export, and manage administrative audit logs in Cortex XSOAR 8.14 On-prem. * [Manage syslog servers](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.14/troubleshoot-and-reference/troubleshoot/manage-syslog-servers.md): Configure and manage syslog servers for Cortex XSOAR 8.14 On-prem logging. * [Configure log and notification forwarding](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.14/troubleshoot-and-reference/troubleshoot/configure-log-and-notification-forwarding.md): Forward audit, integration, and Guard Rails logs from Cortex XSOAR 8.14 On-prem. * [Integration logs](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.14/troubleshoot-and-reference/troubleshoot/integration-logs.md): View, filter, and export integration logs for Cortex XSOAR 8.14 On-prem troubleshooting. * [Reference](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.14/troubleshoot-and-reference/reference.md): Find product concepts, configuration references, and user guidance in Cortex XSOAR 8.14 On-prem. * [Cortex XSOAR concepts](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.14/troubleshoot-and-reference/reference/cortex-xsoar-concepts.md): Learn essential product concepts and terminology in Cortex XSOAR 8.14 On-prem. * [How to search in Cortex XSOAR](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.14/troubleshoot-and-reference/reference/how-to-search-in-cortex-xsoar.md): Search Cortex XSOAR 8.14 On-prem using Lucene queries and built-in search tools. * [How to use markdown in Cortex XSOAR](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.14/troubleshoot-and-reference/reference/how-to-use-markdown-in-cortex-xsoar.md): Use Markdown to format text throughout Cortex XSOAR 8.14 On-prem. * [User details and preferences](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.14/troubleshoot-and-reference/reference/user-details-and-preferences.md): Manage user details, preferences, and notifications in Cortex XSOAR 8.14 On-prem. * [Server configurations](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.14/troubleshoot-and-reference/reference/server-configurations.md): Configure and troubleshoot server settings in Cortex XSOAR 8.14 On-prem. * [New user FAQ](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.14/troubleshoot-and-reference/reference/new-user-faq.md): Find answers to common new-user questions for Cortex XSOAR 8.14 On-prem. * [Cortex XSOAR API](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.14/troubleshoot-and-reference/reference/cortex-xsoar-api.md): Generate API keys and make API calls in Cortex XSOAR 8.14 On-prem. * [Telemetry in Cortex XSOAR](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.14/troubleshoot-and-reference/reference/telemetry-in-cortex-xsoar.md): Understand telemetry collection and usage data in Cortex XSOAR 8.14 On-prem. * [Keyboard shortcuts](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.14/troubleshoot-and-reference/reference/keyboard-shortcuts.md): Use keyboard shortcuts to work efficiently in Cortex XSOAR 8.14 On-prem. * [Product support lifecycle](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.14/troubleshoot-and-reference/reference/product-support-lifecycle.md): Review the product support lifecycle for Cortex XSOAR 8.14 On-prem. * [Cortex XSOAR navigation cheat sheet](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.14/troubleshoot-and-reference/reference/cortex-xsoar-navigation-cheat-sheet.md): Navigate commonly used features and workflows in Cortex XSOAR 8.14 On-prem. * [What is Cortex XSOAR multi-tenant?](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.14/multi-tenant/what-is-cortex-xsoar-multi-tenant.md): Learn about Cortex XSOAR 8.14 On-prem multi-tenant deployments that provide data segregation while enabling you to manage multiple tenants from a main tenant. * [Onboard Cortex XSOAR multi-tenant](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.14/multi-tenant/onboard-cortex-xsoar-multi-tenant.md): Onboard and manage main and child tenants in Cortex XSOAR 8.14 On-prem. * [Onboarding checklist for multi-tenant deployments](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.14/multi-tenant/onboard-cortex-xsoar-multi-tenant/onboarding-checklist-for-multi-tenant-deployments.md): Follow the onboarding checklist for Cortex XSOAR 8.14 On-prem multi-tenant deployments. * [Step 1. Install Cortex XSOAR for multi-tenant](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.14/multi-tenant/onboard-cortex-xsoar-multi-tenant/step-1.-install-cortex-xsoar-for-multi-tenant.md): Install Cortex XSOAR 8.14 On-prem for a multi-tenant deployment. * [Step 2. Pair child tenant to main tenant](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.14/multi-tenant/onboard-cortex-xsoar-multi-tenant/step-2.-pair-child-tenant-to-main-tenant.md): Pair a child tenant with its main tenant in Cortex XSOAR 8.14 On-prem. * [Step 3. Set up an engine](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.14/multi-tenant/onboard-cortex-xsoar-multi-tenant/step-3.-set-up-an-engine.md): Set up engines for tenants in Cortex XSOAR 8.14 On-prem multi-tenant deployments. * [Step 4. Set up users and roles](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.14/multi-tenant/onboard-cortex-xsoar-multi-tenant/step-4.-set-up-users-and-roles.md): Set up users, roles, and authentication in Cortex XSOAR 8.14 On-prem multi-tenant deployments. * [Step 5. Install and configure content](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.14/multi-tenant/onboard-cortex-xsoar-multi-tenant/step-5.-install-and-configure-content.md): Install and configure content in Cortex XSOAR 8.14 On-prem multi-tenant deployments. * [Child tenant management](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.14/multi-tenant/child-tenant-management.md): Manage child tenants and their content from the main tenant in Cortex XSOAR 8.14 On-prem. * [Content management in multi-tenant](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.14/multi-tenant/child-tenant-management/content-management-in-multi-tenant.md): Manage and synchronize content between main and child tenants in Cortex XSOAR 8.14 On-prem. * [Add propagation labels to content](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.14/multi-tenant/child-tenant-management/content-management-in-multi-tenant/add-propagation-labels-to-content.md): Add content propagation labels in Cortex XSOAR 8.14 On-prem. * [Add propagation labels to a child tenant](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.14/multi-tenant/child-tenant-management/content-management-in-multi-tenant/add-propagation-labels-to-a-child-tenant.md): Add child tenant propagation labels in Cortex XSOAR 8.14 On-prem. * [Sync content to child tenants](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.14/multi-tenant/child-tenant-management/content-management-in-multi-tenant/sync-content-to-child-tenants.md): Sync content to child tenants in Cortex XSOAR 8.14 On-prem. * [Manage content using a remote repository](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.14/multi-tenant/child-tenant-management/content-management-in-multi-tenant/manage-content-using-a-remote-repository.md): Manage multi-tenant content with a remote repository in Cortex XSOAR 8.14 On-prem. * [Incident management on the main tenant](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.14/multi-tenant/incident-management-on-the-main-tenant.md): Manage incidents and take action across child tenants in Cortex XSOAR 8.14 On-prem. * [Manage main tenant users in an investigation](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.14/multi-tenant/incident-management-on-the-main-tenant/manage-main-tenant-users-in-an-investigation.md): Manage main-tenant users during multi-tenant investigations in Cortex XSOAR 8.14 On-prem. * [Run a command on multiple tenants](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.14/multi-tenant/incident-management-on-the-main-tenant/run-a-command-on-multiple-tenants.md): Run commands across tenants from main-tenant incidents in Cortex XSOAR 8.14 On-prem. * [Indicator management on the main tenant](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.14/multi-tenant/indicator-management-on-the-main-tenant.md): View and take action on indicators on the main tenant in Cortex XSOAR 8.14 On-prem. - [Navigate the Cortex XSOAR 8 On-prem docs](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.13/learn-about-cortex-xsoar/readme.md): Navigate the Cortex XSOAR 8.13 On-prem documentation. - [Get Started with Cortex XSOAR](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.13/learn-about-cortex-xsoar/readme-1.md): Get started with Cortex XSOAR 8.13 On-prem, including architecture, roles, and licenses. - [What is Cortex XSOAR?](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.13/learn-about-cortex-xsoar/what-is-cortex-xsoar.md): Learn about Cortex XSOAR 8.13 On-prem features and capabilities. - [Cortex XSOAR architecture](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.13/learn-about-cortex-xsoar/cortex-xsoar-architecture.md): Explore the architecture of Cortex XSOAR 8.13 On-prem. - [Cortex XSOAR use cases](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.13/learn-about-cortex-xsoar/cortex-xsoar-use-cases.md): Explore security automation use cases with Cortex XSOAR 8.13 On-prem. - [Understand Cortex XSOAR licenses](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.13/learn-about-cortex-xsoar/understand-cortex-xsoar-licenses.md): Understand licensing for Cortex XSOAR 8.13 On-prem. - [Roles and responsibilities](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.13/learn-about-cortex-xsoar/roles-and-responsibilities.md): Learn about core security operations roles in Cortex XSOAR 8.13 On-prem. - [Supported web browsers](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.13/learn-about-cortex-xsoar/supported-web-browsers.md): Review supported web browsers for Cortex XSOAR 8.13 On-prem. - [Onboard and configure Cortex XSOAR](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.13/onboard-cortex-xsoar/onboard-and-configure-cortex-xsoar.md): Onboard and configure Cortex XSOAR 8.13 On-prem. - [Plan your deployment](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.13/onboard-cortex-xsoar/plan-your-deployment.md): Plan your Cortex XSOAR 8.13 On-prem deployment. - [Deployment steps](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.13/onboard-cortex-xsoar/deployment-steps.md): Follow the Cortex XSOAR 8.13 On-prem deployment steps. - [Onboarding checklist](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.13/onboard-cortex-xsoar/deployment-steps/onboarding-checklist.md): Complete the Cortex XSOAR 8.13 On-prem onboarding checklist. - [Step 1. Install Cortex XSOAR](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.13/onboard-cortex-xsoar/deployment-steps/step-1.-install-cortex-xsoar.md): Install Cortex XSOAR 8.13 On-prem. - [Step 2. Set up an engine](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.13/onboard-cortex-xsoar/deployment-steps/step-2.-set-up-an-engine.md): Set up an engine in Cortex XSOAR 8.13 On-prem. - [Step 3. Set up a remote repository](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.13/onboard-cortex-xsoar/deployment-steps/step-3.-set-up-a-remote-repository.md): Set up a remote repository in Cortex XSOAR 8.13 On-prem. - [Step 4. Set up users and roles](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.13/onboard-cortex-xsoar/deployment-steps/step-4.-set-up-users-and-roles.md): Set up users and roles in Cortex XSOAR 8.13 On-prem. - [Step 5. Install and configure content](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.13/onboard-cortex-xsoar/deployment-steps/step-5.-install-and-configure-content.md): Install and configure content in Cortex XSOAR 8.13 On-prem. - [Install content packs](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.13/onboard-cortex-xsoar/deployment-steps/step-5.-install-and-configure-content/install-content-packs.md): Install content packs in Cortex XSOAR 8.13 On-prem. - [Set up your use case with the Deployment Wizard](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.13/onboard-cortex-xsoar/deployment-steps/step-5.-install-and-configure-content/set-up-your-use-case-with-the-deployment-wizard.md): Set up a use case in Cortex XSOAR 8.13 On-prem. - [Post deployment](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.13/onboard-cortex-xsoar/post-deployment.md): Complete post-deployment tasks in Cortex XSOAR 8.13 On-prem. - [User communication](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.13/onboard-cortex-xsoar/post-deployment/user-communication.md): Configure user communication in Cortex XSOAR 8.13 On-prem. - [Configure user notifications in Cortex XSOAR](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.13/onboard-cortex-xsoar/post-deployment/user-communication/configure-user-notifications-in-cortex-xsoar.md): Configure user notifications in Cortex XSOAR 8.13 On-prem. - [Customize system emails](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.13/onboard-cortex-xsoar/post-deployment/user-communication/customize-system-emails.md): Customize system emails in Cortex XSOAR 8.13 On-prem. - [Configure system settings](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.13/onboard-cortex-xsoar/post-deployment/configure-system-settings.md): Configure system settings in Cortex XSOAR 8.13 On-prem. - [How to install Cortex XSOAR](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.13/install-cortex-xsoar/installation-overview.md): Install Cortex XSOAR 8.13 On-prem and configure your deployment. - [High Availability for Cortex XSOAR](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.13/install-cortex-xsoar/high-availability-for-cortex-xsoar.md): Configure high availability in Cortex XSOAR 8.13 On-prem. - [Load balancing for Cortex XSOAR](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.13/install-cortex-xsoar/load-balancing-for-cortex-xsoar.md): Configure load balancing in Cortex XSOAR 8.13 On-prem. - [System Requirements](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.13/install-cortex-xsoar/system-requirements.md): Review system requirements for Cortex XSOAR 8.13 On-prem. - [Hardware requirements](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.13/install-cortex-xsoar/system-requirements/hardware-requirements.md): Review hardware requirements for Cortex XSOAR 8.13 On-prem. - [Port requirements for cluster communication](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.13/install-cortex-xsoar/system-requirements/port-requirements-for-cluster-communication.md): Review port requirements for Cortex XSOAR 8.13 On-prem. - [URL requirements](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.13/install-cortex-xsoar/system-requirements/url-requirements.md): Review URL requirements for Cortex XSOAR 8.13 On-prem. - [Bandwidth and NTP requirements](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.13/install-cortex-xsoar/system-requirements/bandwidth-and-ntp-requirements.md): Review bandwidth and NTP requirements for Cortex XSOAR 8.13 On-prem. - [Install Cortex XSOAR on a VM deployed on AWS](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.13/install-cortex-xsoar/install-cortex-xsoar-on-a-vm-deployed-on-aws.md): Install Cortex XSOAR 8.13 On-prem on AWS. - [Task 1. Download the OVA Image and license from Cortex Gateway](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.13/install-cortex-xsoar/install-cortex-xsoar-on-a-vm-deployed-on-aws/task-1.-download-the-ova-image-and-license-from-cortex-gateway.md): Download the OVA image and license for Cortex XSOAR 8.13 On-prem. - [Task 2. Deploy your virtual machine on AWS](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.13/install-cortex-xsoar/install-cortex-xsoar-on-a-vm-deployed-on-aws/task-2.-deploy-your-virtual-machine-on-aws.md): Deploy a virtual machine for Cortex XSOAR 8.13 On-prem on AWS. - [Task 3. Validate tenant network and IP settings](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.13/install-cortex-xsoar/install-cortex-xsoar-on-a-vm-deployed-on-aws/task-3.-validate-tenant-nework-and-ip-settings.md): Validate network and IP settings for Cortex XSOAR 8.13 On-prem. - [Task 4. Configure NTP servers](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.13/install-cortex-xsoar/install-cortex-xsoar-on-a-vm-deployed-on-aws/task-4.-configure-ntp-servers.md): Configure NTP servers for Cortex XSOAR 8.13 On-prem. - [Task 5. (Optional) Configure proxy settings](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.13/install-cortex-xsoar/install-cortex-xsoar-on-a-vm-deployed-on-aws/task-5.-optional-configure-proxy-settings.md): Configure proxy settings for Cortex XSOAR 8.13 On-prem. - [Task 6. Establish trust between all nodes in a cluster](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.13/install-cortex-xsoar/install-cortex-xsoar-on-a-vm-deployed-on-aws/task-6.-establish-trust-between-all-nodes-in-a-cluster.md): Establish node trust in Cortex XSOAR 8.13 On-prem. - [Task 7. Install Cortex XSOAR on your VM](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.13/install-cortex-xsoar/install-cortex-xsoar-on-a-vm-deployed-on-aws/task-7.-install-cortex-xsoar-on-your-vm.md): Install Cortex XSOAR 8.13 On-prem on your virtual machine. - [Task 8. Verify you can log into Cortex XSOAR](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.13/install-cortex-xsoar/install-cortex-xsoar-on-a-vm-deployed-on-aws/task-8.-verify-you-can-log-into-cortex-xsoar.md): Verify access to Cortex XSOAR 8.13 On-prem. - [Install Cortex XSOAR on a VM deployed on OCI](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.13/install-cortex-xsoar/install-cortex-xsoar-on-a-vm-deployed-on-oci.md): Install Cortex XSOAR 8.13 On-prem on OCI. - [Task 1. Download the OVA image and license from Cortex Gateway](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.13/install-cortex-xsoar/install-cortex-xsoar-on-a-vm-deployed-on-oci/task-1.-download-the-ova-image-and-license-from-cortex-gateway.md): Download the OVA image and license for Cortex XSOAR 8.13 On-prem. - [Task 2. Deploy your virtual machine on OCI](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.13/install-cortex-xsoar/install-cortex-xsoar-on-a-vm-deployed-on-oci/task-2.-deploy-your-virtual-machine-on-oci.md): Deploy a virtual machine for Cortex XSOAR 8.13 On-prem on OCI. - [Task 3. Validate tenant network and IP settings](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.13/install-cortex-xsoar/install-cortex-xsoar-on-a-vm-deployed-on-oci/task-3.-validate-tenant-network-and-ip-settings.md): Validate network and IP settings for Cortex XSOAR 8.13 On-prem. - [Task 4. Configure NTP servers](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.13/install-cortex-xsoar/install-cortex-xsoar-on-a-vm-deployed-on-oci/task-4.-configure-ntp-servers.md): Configure NTP servers for Cortex XSOAR 8.13 On-prem. - [Task 5. (Optional) Configure proxy settings](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.13/install-cortex-xsoar/install-cortex-xsoar-on-a-vm-deployed-on-oci/task-5.-optional-configure-proxy-settings.md): Configure proxy settings for Cortex XSOAR 8.13 On-prem. - [Task 6. Establish trust between all nodes in a cluster](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.13/install-cortex-xsoar/install-cortex-xsoar-on-a-vm-deployed-on-oci/task-6.-establish-trust-between-all-nodes-in-a-cluster.md): Establish node trust in Cortex XSOAR 8.13 On-prem. - [Task 7. Install Cortex XSOAR on your VM](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.13/install-cortex-xsoar/install-cortex-xsoar-on-a-vm-deployed-on-oci/task-7.-install-cortex-xsoar-on-your-vm.md): Install Cortex XSOAR 8.13 On-prem on your virtual machine. - [Task 8. Verify you can log into Cortex XSOAR](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.13/install-cortex-xsoar/install-cortex-xsoar-on-a-vm-deployed-on-oci/task-8.-verify-you-can-log-into-cortex-xsoar.md): Verify access to Cortex XSOAR 8.13 On-prem. - [Install Cortex XSOAR on a VM deployed on Hyper-V](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.13/install-cortex-xsoar/install-cortex-xsoar-on-a-vm-deployed-on-hyper-v.md): Install Cortex XSOAR 8.13 On-prem on Hyper-V. - [Task 1. Download the VHD image and license from Cortex Gateway](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.13/install-cortex-xsoar/install-cortex-xsoar-on-a-vm-deployed-on-hyper-v/task-1.-download-the-vhd-image-and-license-from-cortex-gateway.md): Download the VHD image and license for Cortex XSOAR 8.13 On-prem. - [Task 2. Deploy your virtual machine on Hyper-V](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.13/install-cortex-xsoar/install-cortex-xsoar-on-a-vm-deployed-on-hyper-v/task-2.-deploy-your-virtual-machine-on-hyper-v.md): Deploy a virtual machine for Cortex XSOAR 8.13 On-prem on Hyper-V. - [Task 3. Configure tenant network and IP settings for each node](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.13/install-cortex-xsoar/install-cortex-xsoar-on-a-vm-deployed-on-hyper-v/task-3.-configure-tenant-network-and-ip-settings-for-each-node.md): Configure network and IP settings for Cortex XSOAR 8.13 On-prem. - [Task 4. Configure NTP servers](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.13/install-cortex-xsoar/install-cortex-xsoar-on-a-vm-deployed-on-hyper-v/task-4.-configure-ntp-servers.md): Configure NTP servers for Cortex XSOAR 8.13 On-prem. - [Task 5. (Optional) Configure proxy settings](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.13/install-cortex-xsoar/install-cortex-xsoar-on-a-vm-deployed-on-hyper-v/task-5.-optional-configure-proxy-settings.md): Configure proxy settings for Cortex XSOAR 8.13 On-prem. - [Task 6. Establish trust between all nodes in a cluster](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.13/install-cortex-xsoar/install-cortex-xsoar-on-a-vm-deployed-on-hyper-v/task-6.-establish-trust-between-all-nodes-in-a-cluster.md): Establish node trust in Cortex XSOAR 8.13 On-prem. - [Task 7. Install Cortex XSOAR on your VM](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.13/install-cortex-xsoar/install-cortex-xsoar-on-a-vm-deployed-on-hyper-v/task-7.-install-cortex-xsoar-on-your-vm.md): Install Cortex XSOAR 8.13 On-prem on your virtual machine. - [Task 8. Verify you can log in to Cortex XSOAR](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.13/install-cortex-xsoar/install-cortex-xsoar-on-a-vm-deployed-on-hyper-v/task-8.-verify-you-can-log-in-to-cortex-xsoar.md): Verify access to Cortex XSOAR 8.13 On-prem. - [Install Cortex XSOAR on a VM deployed on VSphere](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.13/install-cortex-xsoar/install-cortex-xsoar-on-a-vm-deployed-on-vsphere.md): Install Cortex XSOAR 8.13 On-prem on vSphere. - [Install Cortex XSOAR on a VM deployed on KVM](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.13/install-cortex-xsoar/install-cortex-xsoar-on-a-vm-deployed-on-kvm.md): Install Cortex XSOAR 8.13 On-prem on KVM. - [Task 1. Download the QCOW2 image and license from Cortex Gateway](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.13/install-cortex-xsoar/install-cortex-xsoar-on-a-vm-deployed-on-kvm/task-1.-download-the-qcow2-image-and-license-from-cortex-gateway.md): Download the QCOW2 image and license for Cortex XSOAR 8.13 On-prem. - [Task 2. Deploy your virtual machine on KVM](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.13/install-cortex-xsoar/install-cortex-xsoar-on-a-vm-deployed-on-kvm/task-2.-deploy-your-virtual-machine-on-kvm.md): Deploy a virtual machine for Cortex XSOAR 8.13 On-prem on KVM. - [Task 3. Configure tenant network and IP settings for each node](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.13/install-cortex-xsoar/install-cortex-xsoar-on-a-vm-deployed-on-kvm/task-3.-configure-tenant-network-and-ip-settings-for-each-node.md): Configure network and IP settings for Cortex XSOAR 8.13 On-prem. - [Task 4. Configure NTP servers](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.13/install-cortex-xsoar/install-cortex-xsoar-on-a-vm-deployed-on-kvm/task-4.-configure-ntp-servers.md): Configure NTP servers for Cortex XSOAR 8.13 On-prem. - [Task 5. (Optional) Configure proxy settings](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.13/install-cortex-xsoar/install-cortex-xsoar-on-a-vm-deployed-on-kvm/task-5.-optional-configure-proxy-settings.md): Configure proxy settings for Cortex XSOAR 8.13 On-prem. - [Task 6. Establish trust between all nodes in a cluster](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.13/install-cortex-xsoar/install-cortex-xsoar-on-a-vm-deployed-on-kvm/task-6.-establish-trust-between-all-nodes-in-a-cluster.md): Establish node trust in Cortex XSOAR 8.13 On-prem. - [Task 7. Install Cortex XSOAR on your VM](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.13/install-cortex-xsoar/install-cortex-xsoar-on-a-vm-deployed-on-kvm/task-7.-install-cortex-xsoar-on-your-vm.md): Install Cortex XSOAR 8.13 On-prem on your virtual machine. - [Task 8. Verify you can log into Cortex XSOAR](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.13/install-cortex-xsoar/install-cortex-xsoar-on-a-vm-deployed-on-kvm/task-8.-verify-you-can-log-into-cortex-xsoar.md): Verify access to Cortex XSOAR 8.13 On-prem. - [Post-installation](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.13/install-cortex-xsoar/post-installation.md): Complete post-installation tasks in Cortex XSOAR 8.13 On-prem. - [Add the Cortex XSOAR license](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.13/install-cortex-xsoar/post-installation/add-the-cortex-xsoar-license.md): Add a license to Cortex XSOAR 8.13 On-prem. - [HTTPS with a signed certificate](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.13/install-cortex-xsoar/post-installation/https-with-a-signed-certificate.md): Configure HTTPS in Cortex XSOAR 8.13 On-prem with a signed certificate. - [Manage your SSH admin password](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.13/install-cortex-xsoar/post-installation/manage-your-ssh-admin-password.md): Manage the SSH admin password for Cortex XSOAR 8.13 On-prem. - [Use a signed certificate instead of SSL verification](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.13/install-cortex-xsoar/post-installation/use-a-signed-certificate-instead-of-ssl-verification.md): Configure certificate verification in Cortex XSOAR 8.13 On-prem. - [Manage custom certificates](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.13/install-cortex-xsoar/post-installation/manage-custom-certificates.md): Manage trusted certificates in Cortex XSOAR 8.13 On-prem. - [Optimize performance and robustness from the textual UI](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.13/install-cortex-xsoar/post-installation/optimize-performance-and-robustness-from-the-textual-ui.md): Optimize Cortex XSOAR 8.13 On-prem from the textual UI. - [Manage nodes in a cluster](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.13/install-cortex-xsoar/post-installation/optimize-performance-and-robustness-from-the-textual-ui/manage-nodes-in-a-cluster.md): Manage cluster nodes in Cortex XSOAR 8.13 On-prem. - [Scale up hardware resources](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.13/install-cortex-xsoar/post-installation/optimize-performance-and-robustness-from-the-textual-ui/scale-up-hardware-resources.md): Scale hardware resources in Cortex XSOAR 8.13 On-prem. - [Auto expand PVC volumes](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.13/install-cortex-xsoar/post-installation/optimize-performance-and-robustness-from-the-textual-ui/auto-expand-pvc-volumes.md): Expand PVC volumes in Cortex XSOAR 8.13 On-prem. - [Troubleshoot your installation](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.13/install-cortex-xsoar/troubleshoot-your-installation.md): Troubleshoot installation issues in Cortex XSOAR 8.13 On-prem. - [Common installation limitations and fixes](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.13/install-cortex-xsoar/troubleshoot-your-installation/common-installation-limitations-and-fixes.md): Resolve installation limitations in Cortex XSOAR 8.13 On-prem. - [Access logs and log bundles](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.13/install-cortex-xsoar/troubleshoot-your-installation/access-logs-and-log-bundles.md): Access logs and bundles in Cortex XSOAR 8.13 On-prem. - [Open a support session](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.13/install-cortex-xsoar/troubleshoot-your-installation/open-a-support-session.md): Open a support session for Cortex XSOAR 8.13 On-prem. - [Upload your license to the textual UI](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.13/install-cortex-xsoar/troubleshoot-your-installation/upload-your-license-to-the-textual-ui.md): Upload a license from the Cortex XSOAR 8.13 On-prem textual UI. - [Shut down Cortex XSOAR](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.13/install-cortex-xsoar/troubleshoot-your-installation/shut-down-cortex-xsoar.md): Shut down Cortex XSOAR 8.13 On-prem from the textual UI. - [Update Cortex XSOAR](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.13/install-cortex-xsoar/update-cortex-xsoar.md): Update your Cortex XSOAR 8.13 On-prem tenant. - [How to back up and restore Cortex XSOAR](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.13/back-up-and-restore-cortex-xsoar/back-up-and-restore-cortex-xsoar.md): Back up and restore Cortex XSOAR 8.13 On-prem data. - [Set up access to an external storage](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.13/back-up-and-restore-cortex-xsoar/set-up-access-to-an-external-storage.md): Set up external storage in Cortex XSOAR 8.13 On-prem. - [Back up data](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.13/back-up-and-restore-cortex-xsoar/back-up-data.md): Back up data in Cortex XSOAR 8.13 On-prem. - [Backup guidelines and best practices](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.13/back-up-and-restore-cortex-xsoar/back-up-data/backup-guidelines-and-best-practices.md): Review backup guidance for Cortex XSOAR 8.13 On-prem. - [Restore data](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.13/back-up-and-restore-cortex-xsoar/restore-data.md): Restore data in Cortex XSOAR 8.13 On-prem. - [End-to-end example of Cortex XSOAR cluster backup and restore](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.13/back-up-and-restore-cortex-xsoar/end-to-end-example-of-cortex-xsoar-cluster-backup-and-restore.md): Follow a backup and restore example in Cortex XSOAR 8.13 On-prem. - [Common backup and restore limitations and fixes](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.13/back-up-and-restore-cortex-xsoar/common-backup-and-restore-limitations-and-fixes.md): Resolve backup and restore issues in Cortex XSOAR 8.13 On-prem. - [Engines](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.13/configure-cortex-xsoar/engines.md): Manage engines in Cortex XSOAR 8.13 On-prem. - [What is an engine?](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.13/configure-cortex-xsoar/engines/what-is-an-engine.md): Learn about engines in Cortex XSOAR 8.13 On-prem. - [Engine requirements](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.13/configure-cortex-xsoar/engines/engine-requirements.md): Review engine requirements in Cortex XSOAR 8.13 On-prem. - [Install an engine](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.13/configure-cortex-xsoar/engines/install-an-engine.md): Install an engine in Cortex XSOAR 8.13 On-prem. - [Engine air gap installation](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.13/configure-cortex-xsoar/engines/install-an-engine/engine-air-gap-installation.md): Install an engine offline in Cortex XSOAR 8.13 On-prem. - [Docker](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.13/configure-cortex-xsoar/engines/install-an-engine/docker.md): Manage Docker for engines in Cortex XSOAR 8.13 On-prem. - [Install Docker](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.13/configure-cortex-xsoar/engines/install-an-engine/docker/install-docker.md): Install Docker for Cortex XSOAR 8.13 On-prem engines. - [Install Docker distribution for Red Hat on an engine server](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.13/configure-cortex-xsoar/engines/install-an-engine/docker/install-docker-distribution-for-red-hat-on-an-engine-server.md): Install Docker on a Cortex XSOAR 8.13 On-prem engine server. - [Docker image security](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.13/configure-cortex-xsoar/engines/install-an-engine/docker/docker-image-security.md): Secure Docker images in Cortex XSOAR 8.13 On-prem. - [Use the Cortex XSOAR Container Registry](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.13/configure-cortex-xsoar/engines/install-an-engine/docker/use-the-cortex-xsoar-container-registry.md): Use the container registry in Cortex XSOAR 8.13 On-prem. - [Docker FAQs](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.13/configure-cortex-xsoar/engines/install-an-engine/docker/docker-faqs.md): Review Docker FAQs for Cortex XSOAR 8.13 On-prem. - [Troubleshoot Docker issues](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.13/configure-cortex-xsoar/engines/install-an-engine/docker/troubleshoot-docker-issues.md): Troubleshoot Docker issues in Cortex XSOAR 8.13 On-prem. - [Configure Docker pull rate limit](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.13/configure-cortex-xsoar/engines/install-an-engine/docker/configure-docker-pull-rate-limit.md): Configure Docker pull limits in Cortex XSOAR 8.13 On-prem. - [Change the Docker installation folder](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.13/configure-cortex-xsoar/engines/install-an-engine/docker/change-the-docker-installation-folder.md): Change the Docker folder in Cortex XSOAR 8.13 On-prem. - [Configure Docker integrations to trust custom certificates](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.13/configure-cortex-xsoar/engines/install-an-engine/docker/configure-docker-integrations-to-trust-custom-certificates.md): Configure Docker certificates in Cortex XSOAR 8.13 On-prem. - [Configure Python Docker integrations to trust custom certificates](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.13/configure-cortex-xsoar/engines/install-an-engine/docker/configure-python-docker-integrations-to-trust-custom-certificates.md): Configure Python Docker certificates in Cortex XSOAR 8.13 On-prem. - [Docker hardening guide](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.13/configure-cortex-xsoar/engines/install-an-engine/docker/docker-hardening-guide.md): Harden Docker in Cortex XSOAR 8.13 On-prem. - [Podman](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.13/configure-cortex-xsoar/engines/install-an-engine/podman.md): Use Podman for engines in Cortex XSOAR 8.13 On-prem. - [Change container storage directory](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.13/configure-cortex-xsoar/engines/install-an-engine/podman/change-container-storage-directory.md): Change container storage in Cortex XSOAR 8.13 On-prem. - [Install Podman](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.13/configure-cortex-xsoar/engines/install-an-engine/podman/install-podman.md): Install Podman for Cortex XSOAR 8.13 On-prem engines. - [Migrate From Docker to Podman](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.13/configure-cortex-xsoar/engines/install-an-engine/podman/migrate-from-docker-to-podman.md): Migrate engines to Podman in Cortex XSOAR 8.13 On-prem. - [Troubleshoot Podman](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.13/configure-cortex-xsoar/engines/install-an-engine/podman/troubleshoot-podman.md): Troubleshoot Podman in Cortex XSOAR 8.13 On-prem. - [Manage engines](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.13/configure-cortex-xsoar/engines/manage-engines.md): Manage engines in Cortex XSOAR 8.13 On-prem. - [Upgrade an engine](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.13/configure-cortex-xsoar/engines/upgrade-an-engine.md): Upgrade an engine in Cortex XSOAR 8.13 On-prem. - [Remove an engine](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.13/configure-cortex-xsoar/engines/remove-an-engine.md): Remove an engine in Cortex XSOAR 8.13 On-prem. - [Configure engines](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.13/configure-cortex-xsoar/engines/configure-engines.md): Configure engines in Cortex XSOAR 8.13 On-prem. - [Configure the engine to use a web proxy](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.13/configure-cortex-xsoar/engines/configure-engines/configure-the-engine-to-use-a-web-proxy.md): Configure an engine proxy in Cortex XSOAR 8.13 On-prem. - [Configure the engine to call the server without using a proxy](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.13/configure-cortex-xsoar/engines/configure-engines/configure-the-engine-to-call-the-server-without-using-a-proxy.md): Configure direct engine calls in Cortex XSOAR 8.13 On-prem. - [Use NGINX as a reverse proxy](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.13/configure-cortex-xsoar/engines/configure-engines/configure-the-engine-to-call-the-server-without-using-a-proxy/use-nginx-as-a-reverse-proxy.md): Use NGINX with Cortex XSOAR 8.13 On-prem engines. - [Configure an engine to use custom certificates](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.13/configure-cortex-xsoar/engines/configure-an-engine-to-use-custom-certificates.md): Configure engine certificates in Cortex XSOAR 8.13 On-prem. - [Use an engine in an integration](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.13/configure-cortex-xsoar/engines/use-an-engine-in-an-integration.md): Use an engine with integrations in Cortex XSOAR 8.13 On-prem. - [Run a script using an engine](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.13/configure-cortex-xsoar/engines/run-a-script-using-an-engine.md): Run scripts using engines in Cortex XSOAR 8.13 On-prem. - [Troubleshoot engines](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.13/configure-cortex-xsoar/engines/troubleshoot-engines.md): Troubleshoot engines in Cortex XSOAR 8.13 On-prem. - [Troubleshoot integrations running on engines](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.13/configure-cortex-xsoar/engines/troubleshoot-integrations-running-on-engines.md): Troubleshoot engine integrations in Cortex XSOAR 8.13 On-prem. - [Remote Repository Management](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.13/configure-cortex-xsoar/remote-repository-management.md): Manage remote repositories in Cortex XSOAR 8.13 On-prem. - [Content management in Cortex XSOAR](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.13/configure-cortex-xsoar/remote-repository-management/content-management-in-cortex-xsoar.md): Manage remote repository content in Cortex XSOAR 8.13 On-prem. - [Set up a private remote repository](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.13/configure-cortex-xsoar/remote-repository-management/set-up-a-private-remote-repository.md): Set up a private repository in Cortex XSOAR 8.13 On-prem. - [Push content from a development tenant](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.13/configure-cortex-xsoar/remote-repository-management/push-content-from-a-development-tenant.md): Push content from development in Cortex XSOAR 8.13 On-prem. - [Install content on a production tenant](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.13/configure-cortex-xsoar/remote-repository-management/install-content-on-a-production-tenant.md): Install production content in Cortex XSOAR 8.13 On-prem. - [Remote repository troubleshooting](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.13/configure-cortex-xsoar/remote-repository-management/remote-repository-troubleshooting.md): Troubleshoot remote repositories in Cortex XSOAR 8.13 On-prem. - [Users and Roles Management](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.13/configure-cortex-xsoar/users-and-roles-management.md): Manage users and roles in Cortex XSOAR 8.13 On-prem. - [Users and roles in Cortex XSOAR](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.13/configure-cortex-xsoar/users-and-roles-management/users-and-roles-in-cortex-xsoar.md): Configure users and roles in Cortex XSOAR 8.13 On-prem. - [Roles management](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.13/configure-cortex-xsoar/users-and-roles-management/roles-management.md): Manage roles in Cortex XSOAR 8.13 On-prem. - [Role-based permissions](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.13/configure-cortex-xsoar/users-and-roles-management/roles-management/role-based-permissions.md): Configure role permissions in Cortex XSOAR 8.13 On-prem. - [Manage roles in the Cortex XSOAR tenant](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.13/configure-cortex-xsoar/users-and-roles-management/roles-management/manage-roles-in-the-cortex-xsoar-tenant.md): Manage tenant roles in Cortex XSOAR 8.13 On-prem. - [User group management](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.13/configure-cortex-xsoar/users-and-roles-management/user-group-management.md): Manage user groups in Cortex XSOAR 8.13 On-prem. - [Set up authentication](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.13/configure-cortex-xsoar/users-and-roles-management/set-up-authentication.md): Set up authentication in Cortex XSOAR 8.13 On-prem. - [Create users in Cortex XSOAR](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.13/configure-cortex-xsoar/users-and-roles-management/set-up-authentication/create-users-in-cortex-xsoar.md): Create users in Cortex XSOAR 8.13 On-prem. - [Authenticate users using SSO](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.13/configure-cortex-xsoar/users-and-roles-management/set-up-authentication/authenticate-users-using-sso.md): Set up SSO in Cortex XSOAR 8.13 On-prem. - [Authenticate users using Active Directory or OpenLDAP](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.13/configure-cortex-xsoar/users-and-roles-management/set-up-authentication/authenticate-users-using-active-directory-or-openldap.md): Use directory authentication in Cortex XSOAR 8.13 On-prem. - [Set up Okta as the Identity Provider Using SAML 2.0](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.13/configure-cortex-xsoar/users-and-roles-management/set-up-authentication/set-up-okta-as-the-identity-provider-using-saml-2.0.md): Set up Okta SAML in Cortex XSOAR 8.13 On-prem. - [Set up Microsoft Entra ID as the Identity Provider Using SAML 2.0](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.13/configure-cortex-xsoar/users-and-roles-management/set-up-authentication/set-up-microsoft-entra-id-as-the-identity-provider-using-saml-2.0.md): Set up Microsoft Entra ID in Cortex XSOAR 8.13 On-prem. - [User management](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.13/configure-cortex-xsoar/users-and-roles-management/user-management.md): Manage users in Cortex XSOAR 8.13 On-prem. - [Configure a password policy](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.13/configure-cortex-xsoar/users-and-roles-management/configure-a-password-policy.md): Configure password policies in Cortex XSOAR 8.13 On-prem. - [Marketplace](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.13/configure-cortex-xsoar/marketplace.md): Use Marketplace in Cortex XSOAR 8.13 On-prem. - [Cortex Marketplace](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.13/configure-cortex-xsoar/marketplace/cortex-marketplace.md): Find content in Cortex XSOAR 8.13 On-prem Marketplace. - [Content packs](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.13/configure-cortex-xsoar/marketplace/content-packs.md): Use content packs in Cortex XSOAR 8.13 On-prem Marketplace. - [Content Pack Support Types](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.13/configure-cortex-xsoar/marketplace/content-pack-support-types.md): Review content pack support types in Cortex XSOAR 8.13 On-prem. - [Manage content packs](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.13/configure-cortex-xsoar/marketplace/manage-content-packs.md): Manage content packs in Cortex XSOAR 8.13 On-prem. - [Set up your use case with the Deployment Wizard](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.13/configure-cortex-xsoar/marketplace/set-up-your-use-case-with-the-deployment-wizard.md): Use the Deployment Wizard in Cortex XSOAR 8.13 On-prem. - [Marketplace FAQs](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.13/configure-cortex-xsoar/marketplace/marketplace-faqs.md): Review Marketplace FAQs for Cortex XSOAR 8.13 On-prem. - [Content pack update notifications](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.13/configure-cortex-xsoar/marketplace/content-pack-update-notifications.md): Configure content updates in Cortex XSOAR 8.13 On-prem. - [Customize content pack notifications](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.13/configure-cortex-xsoar/marketplace/content-pack-update-notifications/customize-content-pack-notifications.md): Customize content notifications in Cortex XSOAR 8.13 On-prem. - [Content pack contributions](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.13/configure-cortex-xsoar/marketplace/content-pack-contributions.md): Contribute content packs in Cortex XSOAR 8.13 On-prem. - [Create a content pack](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.13/configure-cortex-xsoar/marketplace/content-pack-contributions/create-a-content-pack.md): Create content packs in Cortex XSOAR 8.13 On-prem. - [Resubmit a content pack](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.13/configure-cortex-xsoar/marketplace/content-pack-contributions/resubmit-a-content-pack.md): Resubmit content packs in Cortex XSOAR 8.13 On-prem. - [Integrations](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.13/configure-cortex-xsoar/integrations.md): Configure integrations in Cortex XSOAR 8.13 On-prem. - [Integration use cases](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.13/configure-cortex-xsoar/integrations/integration-use-cases.md): Explore integration use cases in Cortex XSOAR 8.13 On-prem. - [Configure integrations](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.13/configure-cortex-xsoar/integrations/configure-integrations.md): Configure integrations in Cortex XSOAR 8.13 On-prem. - [Change the Docker image in an integration or script](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.13/configure-cortex-xsoar/integrations/change-the-docker-image-in-an-integration-or-script.md): Change Docker images in Cortex XSOAR 8.13 On-prem. - [Connect your engine to an image registry](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.13/configure-cortex-xsoar/integrations/change-the-docker-image-in-an-integration-or-script/connect-your-engine-to-an-image-registry.md): Connect engines to registries in Cortex XSOAR 8.13 On-prem. - [Pull images from a private image registry](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.13/configure-cortex-xsoar/integrations/change-the-docker-image-in-an-integration-or-script/pull-images-from-a-private-image-registry.md): Pull private images in Cortex XSOAR 8.13 On-prem. - [Manage credentials](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.13/configure-cortex-xsoar/integrations/manage-credentials.md): Manage credentials in Cortex XSOAR 8.13 On-prem. - [Add an integration instance](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.13/configure-cortex-xsoar/integrations/add-an-integration-instance.md): Add integration instances in Cortex XSOAR 8.13 On-prem. - [Fetch incidents from an integration instance](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.13/configure-cortex-xsoar/integrations/add-an-integration-instance/fetch-incidents-from-an-integration-instance.md): Fetch incidents in Cortex XSOAR 8.13 On-prem. - [Receive notifications on an incident fetch error](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.13/configure-cortex-xsoar/integrations/add-an-integration-instance/receive-notifications-on-an-incident-fetch-error.md): Configure fetch error notifications in Cortex XSOAR 8.13 On-prem. - [Configure integration permissions](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.13/configure-cortex-xsoar/integrations/add-an-integration-instance/configure-integration-permissions.md): Configure integration permissions in Cortex XSOAR 8.13 On-prem. - [Troubleshoot integrations](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.13/configure-cortex-xsoar/integrations/add-an-integration-instance/troubleshoot-integrations.md): Troubleshoot integrations in Cortex XSOAR 8.13 On-prem. - [Integration commands in the CLI](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.13/configure-cortex-xsoar/integrations/integration-commands-in-the-cli.md): Run integration commands in Cortex XSOAR 8.13 On-prem. - [Forward requests to long-running integrations](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.13/configure-cortex-xsoar/integrations/forward-requests-to-long-running-integrations.md): Forward integration requests in Cortex XSOAR 8.13 On-prem. - [Incident configuration](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.13/configure-cortex-xsoar/incident-configuration.md): Configure incidents in Cortex XSOAR 8.13 On-prem. - [Incident lifecycle](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.13/configure-cortex-xsoar/incident-configuration/incident-lifecycle.md): Manage the incident lifecycle in Cortex XSOAR 8.13 On-prem. - [Incident Customization](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.13/configure-cortex-xsoar/incident-configuration/incident-customization.md): Customize incidents in Cortex XSOAR 8.13 On-prem. - [Use incident context data](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.13/configure-cortex-xsoar/incident-configuration/incident-customization/use-incident-context-data.md): Use incident context data in Cortex XSOAR 8.13 On-prem. - [Create an incident type](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.13/configure-cortex-xsoar/incident-configuration/incident-customization/create-an-incident-type.md): Create incident types in Cortex XSOAR 8.13 On-prem. - [Create an incident field](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.13/configure-cortex-xsoar/incident-configuration/incident-customization/create-an-incident-field.md): Create incident fields in Cortex XSOAR 8.13 On-prem. - [Incident field trigger scripts](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.13/configure-cortex-xsoar/incident-configuration/incident-customization/create-an-incident-field/incident-field-trigger-scripts.md): Configure incident field triggers in Cortex XSOAR 8.13 On-prem. - [Create dynamic fields](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.13/configure-cortex-xsoar/incident-configuration/incident-customization/create-an-incident-field/create-dynamic-fields.md): Create dynamic fields in Cortex XSOAR 8.13 On-prem. - [Troubleshoot incident fields](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.13/configure-cortex-xsoar/incident-configuration/incident-customization/create-an-incident-field/troubleshoot-incident-fields.md): Troubleshoot incident fields in Cortex XSOAR 8.13 On-prem. - [Incident layout customization](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.13/configure-cortex-xsoar/incident-configuration/incident-customization/incident-layout-customization.md): Customize incident layouts in Cortex XSOAR 8.13 On-prem. - [Examples of using scripts in incident layouts](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.13/configure-cortex-xsoar/incident-configuration/incident-customization/incident-layout-customization/examples-of-using-scripts-in-incident-layouts.md): Use scripts in incident layouts in Cortex XSOAR 8.13 On-prem. - [Create an evidence field](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.13/configure-cortex-xsoar/incident-configuration/create-an-evidence-field.md): Create evidence fields in Cortex XSOAR 8.13 On-prem. - [Classification and mapping](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.13/configure-cortex-xsoar/incident-configuration/classification-and-mapping.md): Classify and map incidents in Cortex XSOAR 8.13 On-prem. - [Create an incident classifier](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.13/configure-cortex-xsoar/incident-configuration/classification-and-mapping/create-an-incident-classifier.md): Create incident classifiers in Cortex XSOAR 8.13 On-prem. - [Create an incident mapper](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.13/configure-cortex-xsoar/incident-configuration/classification-and-mapping/create-an-incident-mapper.md): Create incident mappers in Cortex XSOAR 8.13 On-prem. - [Set up incident mirroring](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.13/configure-cortex-xsoar/incident-configuration/set-up-incident-mirroring.md): Set up incident mirroring in Cortex XSOAR 8.13 On-prem. - [Incident deduplication in Cortex XSOAR](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.13/configure-cortex-xsoar/incident-configuration/incident-deduplication-in-cortex-xsoar.md): Deduplicate incidents in Cortex XSOAR 8.13 On-prem. - [Pre-process rules](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.13/configure-cortex-xsoar/incident-configuration/pre-process-rules.md): Create pre-process rules in Cortex XSOAR 8.13 On-prem. - [Use post-processing scripts in an incident](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.13/configure-cortex-xsoar/incident-configuration/use-post-processing-scripts-in-an-incident.md): Use post-processing scripts in Cortex XSOAR 8.13 On-prem. - [Customize incident close reasons](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.13/configure-cortex-xsoar/incident-configuration/customize-incident-close-reasons.md): Customize incident close reasons in Cortex XSOAR 8.13 On-prem. - [Configure inline value fields](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.13/configure-cortex-xsoar/incident-configuration/configure-inline-value-fields.md): Configure inline value fields in Cortex XSOAR 8.13 On-prem. - [Configure incident export and delete](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.13/configure-cortex-xsoar/incident-configuration/configure-incident-export-and-delete.md): Export and delete incidents in Cortex XSOAR 8.13 On-prem. - [Configure access to external storage](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.13/configure-cortex-xsoar/incident-configuration/configure-incident-export-and-delete/configure-access-to-external-storage.md): Configure external storage in Cortex XSOAR 8.13 On-prem. - [Schedule incident export and delete](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.13/configure-cortex-xsoar/incident-configuration/configure-incident-export-and-delete/schedule-incident-export-and-delete.md): Schedule incident exports and deletions to external storage in Cortex XSOAR 8.13 On-prem. - [Export an incident to CSV using the UTF8-BOM format](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.13/configure-cortex-xsoar/incident-configuration/export-an-incident-to-csv-using-the-utf8-bom-format.md): Export incidents as UTF8-BOM CSV in Cortex XSOAR 8.13 On-prem. - [Amazon S3 configuration example](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.13/configure-cortex-xsoar/incident-configuration/amazon-s3-configuration-example.md): Configure Amazon S3 storage in Cortex XSOAR 8.13 On-prem. - [Playbooks](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.13/configure-cortex-xsoar/playbooks.md): Create and manage playbooks in Cortex XSOAR 8.13 On-prem. - [What is a playbook?](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.13/configure-cortex-xsoar/playbooks/what-is-a-playbook.md): Learn about playbooks in Cortex XSOAR 8.13 On-prem. - [Playbook development checklist](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.13/configure-cortex-xsoar/playbooks/playbook-development-checklist.md): Follow the playbook development checklist in Cortex XSOAR 8.13 On-prem. - [Plan your playbook](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.13/configure-cortex-xsoar/playbooks/plan-your-playbook.md): Plan playbooks in Cortex XSOAR 8.13 On-prem. - [Develop your playbook](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.13/configure-cortex-xsoar/playbooks/develop-your-playbook.md): Develop playbooks in Cortex XSOAR 8.13 On-prem. - [Task 1. Choose from existing playbooks or create your own](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.13/configure-cortex-xsoar/playbooks/develop-your-playbook/task-1.-choose-from-existing-playbooks-or-create-your-own.md): Choose or create playbooks in Cortex XSOAR 8.13 On-prem. - [Task 2. Configure playbook settings](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.13/configure-cortex-xsoar/playbooks/develop-your-playbook/task-2.-configure-playbook-settings.md): Configure playbook settings in Cortex XSOAR 8.13 On-prem. - [Task 3. Add tasks](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.13/configure-cortex-xsoar/playbooks/develop-your-playbook/task-3.-add-tasks.md): Add tasks in Cortex XSOAR 8.13 On-prem playbooks. - [Set playbook inputs and outputs](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.13/configure-cortex-xsoar/playbooks/develop-your-playbook/task-3.-add-tasks/set-playbook-inputs-and-outputs.md): Set playbook inputs and outputs in Cortex XSOAR 8.13 On-prem. - [Create a section header](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.13/configure-cortex-xsoar/playbooks/develop-your-playbook/task-3.-add-tasks/create-a-section-header.md): Create section headers in Cortex XSOAR 8.13 On-prem playbooks. - [Create a standard task](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.13/configure-cortex-xsoar/playbooks/develop-your-playbook/task-3.-add-tasks/create-a-standard-task.md): Create standard tasks in Cortex XSOAR 8.13 On-prem playbooks. - [Create a conditional task](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.13/configure-cortex-xsoar/playbooks/develop-your-playbook/task-3.-add-tasks/create-a-conditional-task.md): Create conditional tasks in Cortex XSOAR 8.13 On-prem playbooks. - [Create a communication task](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.13/configure-cortex-xsoar/playbooks/develop-your-playbook/task-3.-add-tasks/create-a-communication-task.md): Create communication tasks in Cortex XSOAR 8.13 On-prem playbooks. - [Configure script error handling in a playbook](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.13/configure-cortex-xsoar/playbooks/develop-your-playbook/task-3.-add-tasks/configure-script-error-handling-in-a-playbook.md): Configure script error handling in Cortex XSOAR 8.13 On-prem playbooks. - [Task 4. Add inline documentation](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.13/configure-cortex-xsoar/playbooks/develop-your-playbook/task-4.-add-inline-documentation.md): Add inline documentation in Cortex XSOAR 8.13 On-prem playbooks. - [Task 5. Add custom playbook features](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.13/configure-cortex-xsoar/playbooks/develop-your-playbook/task-5.-add-custom-playbook-features.md): Add custom playbook features in Cortex XSOAR 8.13 On-prem. - [Task 6. Test and debug the playbook](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.13/configure-cortex-xsoar/playbooks/develop-your-playbook/task-6.-test-and-debug-the-playbook.md): Test and debug playbooks in Cortex XSOAR 8.13 On-prem. - [Task 7. Manage playbook content](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.13/configure-cortex-xsoar/playbooks/develop-your-playbook/task-7.-manage-playbook-content.md): Manage playbook content in Cortex XSOAR 8.13 On-prem. - [Customize a playbook for a phishing use case example](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.13/configure-cortex-xsoar/playbooks/develop-your-playbook/customize-a-playbook-for-a-phishing-use-case-example.md): Customize phishing playbooks in Cortex XSOAR 8.13 On-prem. - [Customize your playbook](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.13/configure-cortex-xsoar/playbooks/customize-your-playbook.md): Customize playbooks in Cortex XSOAR 8.13 On-prem. - [Customize the SOC name](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.13/configure-cortex-xsoar/playbooks/customize-your-playbook/customize-the-soc-name.md): Customize the SOC name in Cortex XSOAR 8.13 On-prem. - [Configure a sub-playbook](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.13/configure-cortex-xsoar/playbooks/customize-your-playbook/configure-a-sub-playbook.md): Configure sub-playbooks in Cortex XSOAR 8.13 On-prem. - [Filter and transform data](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.13/configure-cortex-xsoar/playbooks/customize-your-playbook/filter-and-transform-data.md): Filter and transform data in Cortex XSOAR 8.13 On-prem. - [Filter considerations, categories, and built-in filters](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.13/configure-cortex-xsoar/playbooks/customize-your-playbook/filter-and-transform-data/filter-considerations-categories-and-built-in-filters.md): Use built-in filters in Cortex XSOAR 8.13 On-prem. - [Transformer considerations, categories, and built-in transformers](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.13/configure-cortex-xsoar/playbooks/customize-your-playbook/filter-and-transform-data/transformer-considerations-categories-and-built-in-transformers.md): Use built-in transformers in Cortex XSOAR 8.13 On-prem. - [Extract indicators](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.13/configure-cortex-xsoar/playbooks/customize-your-playbook/extract-indicators.md): Extract indicators in Cortex XSOAR 8.13 On-prem. - [Extend context](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.13/configure-cortex-xsoar/playbooks/customize-your-playbook/extend-context.md): Extend context in Cortex XSOAR 8.13 On-prem. - [Set and update incident fields](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.13/configure-cortex-xsoar/playbooks/customize-your-playbook/set-and-update-incident-fields.md): Set and update incident fields in Cortex XSOAR 8.13 On-prem. - [Playbook polling](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.13/configure-cortex-xsoar/playbooks/customize-your-playbook/playbook-polling.md): Configure playbook polling in Cortex XSOAR 8.13 On-prem. - [Scripts](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.13/configure-cortex-xsoar/playbooks/scripts.md): Create and manage scripts in Cortex XSOAR 8.13 On-prem. - [Use existing scripts](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.13/configure-cortex-xsoar/playbooks/scripts/use-existing-scripts.md): Use existing scripts in Cortex XSOAR 8.13 On-prem. - [Create a script](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.13/configure-cortex-xsoar/playbooks/scripts/create-a-script.md): Create scripts in Cortex XSOAR 8.13 On-prem. - [Debug your playbook](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.13/configure-cortex-xsoar/playbooks/debug-your-playbook.md): Debug playbooks in Cortex XSOAR 8.13 On-prem. - [Troubleshoot playbook performance](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.13/configure-cortex-xsoar/playbooks/debug-your-playbook/troubleshoot-playbook-performance.md): Troubleshoot playbook performance in Cortex XSOAR 8.13 On-prem. - [Manage playbook content](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.13/configure-cortex-xsoar/playbooks/manage-playbook-content.md): Manage playbook content in Cortex XSOAR 8.13 On-prem. - [Best practices](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.13/configure-cortex-xsoar/playbooks/best-practices.md): Use playbook best practices in Cortex XSOAR 8.13 On-prem. - [Lists](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.13/configure-cortex-xsoar/lists.md): Create and manage lists in Cortex XSOAR 8.13 On-prem. - [What is a list?](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.13/configure-cortex-xsoar/lists/what-is-a-list.md): Learn about lists in Cortex XSOAR 8.13 On-prem. - [Create a list](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.13/configure-cortex-xsoar/lists/create-a-list.md): Create lists in Cortex XSOAR 8.13 On-prem. - [List commands](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.13/configure-cortex-xsoar/lists/list-commands.md): Use list commands in Cortex XSOAR 8.13 On-prem. - [Use cases: JSON lists](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.13/configure-cortex-xsoar/lists/use-cases-json-lists.md): Manage JSON lists in Cortex XSOAR 8.13 On-prem. - [Transform a list into an array](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.13/configure-cortex-xsoar/lists/transform-a-list-into-an-array.md): Transform lists into arrays in Cortex XSOAR 8.13 On-prem. - [Jobs](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.13/configure-cortex-xsoar/jobs.md): Configure scheduled jobs in Cortex XSOAR 8.13 On-prem. - [Manage jobs](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.13/configure-cortex-xsoar/jobs/manage-jobs.md): Manage jobs in Cortex XSOAR 8.13 On-prem. - [Create a time triggered job](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.13/configure-cortex-xsoar/jobs/create-a-time-triggered-job.md): Create time-triggered jobs in Cortex XSOAR 8.13 On-prem. - [Create a job triggered by a delta in a feed](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.13/configure-cortex-xsoar/jobs/create-a-job-triggered-by-a-delta-in-a-feed.md): Create feed-triggered jobs in Cortex XSOAR 8.13 On-prem. - [Create jobs to process indicators example](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.13/configure-cortex-xsoar/jobs/create-jobs-to-process-indicators-example.md): Process indicators with jobs in Cortex XSOAR 8.13 On-prem. - [SLAs](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.13/configure-cortex-xsoar/slas.md): Configure SLAs in Cortex XSOAR 8.13 On-prem. - [SLAs in Cortex XSOAR](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.13/configure-cortex-xsoar/slas/slas-in-cortex-xsoar.md): Learn about SLAs in Cortex XSOAR 8.13 On-prem. - [Configure an SLA in an incident type](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.13/configure-cortex-xsoar/slas/configure-an-sla-in-an-incident-type.md): Configure SLAs for incident types in Cortex XSOAR 8.13 On-prem. - [Configure Timer/SLA fields](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.13/configure-cortex-xsoar/slas/configure-timersla-fields.md): Configure timer and SLA fields in Cortex XSOAR 8.13 On-prem. - [Configure a playbook to run Timers/SLAs](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.13/configure-cortex-xsoar/slas/configure-a-playbook-to-run-timersslas.md): Configure playbooks to run SLA timers in Cortex XSOAR 8.13 On-prem. - [Automate changes to incident fields using SLA scripts](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.13/configure-cortex-xsoar/slas/automate-changes-to-incident-fields-using-sla-scripts.md): Automate incident fields with SLA scripts in Cortex XSOAR 8.13 On-prem. - [Create SLA scripts](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.13/configure-cortex-xsoar/slas/create-sla-scripts.md): Create SLA scripts in Cortex XSOAR 8.13 On-prem. - [Use SLA and Timer field commands manually in the CLI](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.13/configure-cortex-xsoar/slas/use-sla-and-timer-field-commands-manually-in-the-cli.md): Use SLA and timer commands in Cortex XSOAR 8.13 On-prem. - [Configure the Global Risk Threshold](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.13/configure-cortex-xsoar/slas/configure-the-global-risk-threshold.md): Configure the global risk threshold in Cortex XSOAR 8.13 On-prem. - [Search incidents for Timer/SLAs](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.13/configure-cortex-xsoar/slas/search-incidents-for-timerslas.md): Search incidents by SLA and timer fields in Cortex XSOAR 8.13 On-prem. - [Dashboards and Reports](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.13/configure-cortex-xsoar/dashboards-and-reports.md): Create dashboards and reports in Cortex XSOAR 8.13 On-prem. - [Dashboards](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.13/configure-cortex-xsoar/dashboards-and-reports/dashboards.md): Create and manage dashboards in Cortex XSOAR 8.13 On-prem. - [Dashboard actions](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.13/configure-cortex-xsoar/dashboards-and-reports/dashboards/dashboard-actions.md): Manage dashboard actions in Cortex XSOAR 8.13 On-prem. - [Manage dashboards](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.13/configure-cortex-xsoar/dashboards-and-reports/dashboards/manage-dashboards.md): Manage dashboards in Cortex XSOAR 8.13 On-prem. - [Reports](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.13/configure-cortex-xsoar/dashboards-and-reports/reports.md): Create and manage reports in Cortex XSOAR 8.13 On-prem. - [Manage reports](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.13/configure-cortex-xsoar/dashboards-and-reports/reports/manage-reports.md): Manage reports in Cortex XSOAR 8.13 On-prem. - [Configure the timezone in a report](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.13/configure-cortex-xsoar/dashboards-and-reports/reports/configure-the-timezone-in-a-report.md): Configure report time settings in Cortex XSOAR 8.13 On-prem. - [Troubleshoot script timeout for reports](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.13/configure-cortex-xsoar/dashboards-and-reports/reports/troubleshoot-script-timeout-for-reports.md): Troubleshoot report script timeouts in Cortex XSOAR 8.13 On-prem. - [Troubleshoot overlapping text and extra pages](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.13/configure-cortex-xsoar/dashboards-and-reports/reports/troubleshoot-overlapping-text-and-extra-pages.md): Troubleshoot PDF reports in Cortex XSOAR 8.13 On-prem. - [Widgets](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.13/configure-cortex-xsoar/dashboards-and-reports/widgets.md): Create and manage widgets in Cortex XSOAR 8.13 On-prem. - [Widget customization](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.13/configure-cortex-xsoar/dashboards-and-reports/widgets/widget-customization.md): Customize widgets in Cortex XSOAR 8.13 On-prem. - [Create a widget using the widget builder](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.13/configure-cortex-xsoar/dashboards-and-reports/widgets/create-a-widget-using-the-widget-builder.md): Create widgets with the widget builder in Cortex XSOAR 8.13 On-prem. - [Create a custom widget using a JSON file](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.13/configure-cortex-xsoar/dashboards-and-reports/widgets/create-a-custom-widget-using-a-json-file.md): Create JSON widgets in Cortex XSOAR 8.13 On-prem. - [Create a custom widget using a script](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.13/configure-cortex-xsoar/dashboards-and-reports/widgets/create-a-custom-widget-using-a-script.md): Create script-based widgets in Cortex XSOAR 8.13 On-prem. - [Create a widget from an incident](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.13/configure-cortex-xsoar/dashboards-and-reports/widgets/create-a-widget-from-an-incident.md): Create incident widgets in Cortex XSOAR 8.13 On-prem. - [Create a widget from an indicator](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.13/configure-cortex-xsoar/dashboards-and-reports/widgets/create-a-widget-from-an-indicator.md): Create indicator widgets in Cortex XSOAR 8.13 On-prem. - [Edit a widget](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.13/configure-cortex-xsoar/dashboards-and-reports/widgets/edit-a-widget.md): Edit widgets in Cortex XSOAR 8.13 On-prem. - [Add a widget in the War Room](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.13/configure-cortex-xsoar/dashboards-and-reports/widgets/add-a-widget-in-the-war-room.md): Add War Room widgets in Cortex XSOAR 8.13 On-prem. - [Saved By Dbot (ROI) Widget](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.13/configure-cortex-xsoar/dashboards-and-reports/widgets/saved-by-dbot-roi-widget.md): Customize the Saved By Dbot widget in Cortex XSOAR 8.13 On-prem. - [Incidents and indicators investigation](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.13/investigate-and-respond-to-threats/incidents-and-indicators-investigation.md): Investigate incidents and indicators ingested into Cortex XSOAR 8.13 On-prem. - [Incidents](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.13/investigate-and-respond-to-threats/incidents-and-indicators-investigation/incidents.md): Incidents are potential security data threats ingested or created in Cortex XSOAR 8.13 On-prem. - [Incident management](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.13/investigate-and-respond-to-threats/incidents-and-indicators-investigation/incident-management.md): Manage incidents in Cortex XSOAR 8.13 On-prem. - [Search for incidents](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.13/investigate-and-respond-to-threats/incidents-and-indicators-investigation/incident-management/search-for-incidents.md): Search incidents in Cortex XSOAR 8.13 On-prem. - [Create an incident](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.13/investigate-and-respond-to-threats/incidents-and-indicators-investigation/incident-management/create-an-incident.md): Create incidents in Cortex XSOAR 8.13 On-prem. - [Export incidents](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.13/investigate-and-respond-to-threats/incidents-and-indicators-investigation/incident-management/export-incidents.md): Export incidents in Cortex XSOAR 8.13 On-prem. - [Export incidents from the Incidents table](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.13/investigate-and-respond-to-threats/incidents-and-indicators-investigation/incident-management/export-incidents/export-incidents-from-the-incidents-table.md): Export incidents from the Incidents table as Excel, CSV, or JSON files in Cortex XSOAR 8.13 On-prem. - [Export incidents on demand](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.13/investigate-and-respond-to-threats/incidents-and-indicators-investigation/incident-management/export-incidents/export-incidents-on-demand.md): Export incidents on demand to external storage in Cortex XSOAR 8.13 On-prem. - [Investigate an incident](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.13/investigate-and-respond-to-threats/incidents-and-indicators-investigation/investigate-an-incident.md): Investigate incidents in Cortex XSOAR 8.13 On-prem. - [Retain incidents](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.13/investigate-and-respond-to-threats/incidents-and-indicators-investigation/investigate-an-incident/retain-incidents.md): Retain incidents in Cortex XSOAR 8.13 On-prem. - [Limit access to investigations using access control](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.13/investigate-and-respond-to-threats/incidents-and-indicators-investigation/investigate-an-incident/limit-access-to-investigations-using-access-control.md): Control investigation access in Cortex XSOAR 8.13 On-prem. - [Incident Tasks](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.13/investigate-and-respond-to-threats/incidents-and-indicators-investigation/investigate-an-incident/incident-tasks.md): Manage incident tasks in Cortex XSOAR 8.13 On-prem. - [Use the War Room in an investigation](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.13/investigate-and-respond-to-threats/incidents-and-indicators-investigation/investigate-an-incident/use-the-war-room-in-an-investigation.md): Use the War Room for investigations in Cortex XSOAR 8.13 On-prem. - [Schedule a command in the War Room](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.13/investigate-and-respond-to-threats/incidents-and-indicators-investigation/investigate-an-incident/schedule-a-command-in-the-war-room.md): Schedule War Room commands in Cortex XSOAR 8.13 On-prem. - [Run commands in the CLI](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.13/investigate-and-respond-to-threats/incidents-and-indicators-investigation/investigate-an-incident/run-commands-in-the-cli.md): Run CLI commands in Cortex XSOAR 8.13 On-prem. - [Evidence Handling](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.13/investigate-and-respond-to-threats/incidents-and-indicators-investigation/investigate-an-incident/evidence-handling.md): Manage investigation evidence in Cortex XSOAR 8.13 On-prem. - [Use the Work Plan in an investigation](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.13/investigate-and-respond-to-threats/incidents-and-indicators-investigation/investigate-an-incident/use-the-work-plan-in-an-investigation.md): Use the Work Plan in Cortex XSOAR 8.13 On-prem investigations. - [Investigate an incident using the canvas](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.13/investigate-and-respond-to-threats/incidents-and-indicators-investigation/investigate-an-incident/investigate-an-incident-using-the-canvas.md): Investigate incidents with the canvas in Cortex XSOAR 8.13 On-prem. - [Link incidents](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.13/investigate-and-respond-to-threats/incidents-and-indicators-investigation/investigate-an-incident/link-incidents.md): Link incidents in Cortex XSOAR 8.13 On-prem. - [Create an incident summary report](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.13/investigate-and-respond-to-threats/incidents-and-indicators-investigation/investigate-an-incident/create-an-incident-summary-report.md): Create incident summary reports in Cortex XSOAR 8.13 On-prem. - [Manage indicators](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.13/investigate-and-respond-to-threats/incidents-and-indicators-investigation/manage-indicators.md): Manage indicators in Cortex XSOAR 8.13 On-prem without a TIM license. - [Query indicators](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.13/investigate-and-respond-to-threats/incidents-and-indicators-investigation/manage-indicators/query-indicators.md): Query indicators in Cortex XSOAR 8.13 On-prem without a TIM license. - [View indicator relationships in an investigation](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.13/investigate-and-respond-to-threats/incidents-and-indicators-investigation/manage-indicators/view-indicator-relationships-in-an-investigation.md): View indicator relationships in Cortex XSOAR 8.13 On-prem investigations. - [Threat Intel Management](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.13/investigate-and-respond-to-threats/threat-intel-management.md): Manage threat intelligence in Cortex XSOAR 8.13 On-prem. - [Get started with Threat Intel Management](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.13/investigate-and-respond-to-threats/threat-intel-management/get-started-with-threat-intel-management.md): Get started with Threat Intel Management in Cortex XSOAR 8.13 On-prem. - [What is Threat Intel Management?](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.13/investigate-and-respond-to-threats/threat-intel-management/get-started-with-threat-intel-management/what-is-threat-intel-management.md): Learn about Threat Intel Management in Cortex XSOAR 8.13 On-prem. - [Threat Intel Management use cases](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.13/investigate-and-respond-to-threats/threat-intel-management/get-started-with-threat-intel-management/threat-intel-management-use-cases.md): Explore Threat Intel Management use cases in Cortex XSOAR 8.13 On-prem. - [Indicator concepts](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.13/investigate-and-respond-to-threats/threat-intel-management/get-started-with-threat-intel-management/indicator-concepts.md): Learn about indicator concepts in Cortex XSOAR 8.13 On-prem. - [Indicator lifecycle](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.13/investigate-and-respond-to-threats/threat-intel-management/get-started-with-threat-intel-management/indicator-lifecycle.md): Manage the indicator lifecycle in Cortex XSOAR 8.13 On-prem. - [Roles and responsibilities in Threat Intel Management](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.13/investigate-and-respond-to-threats/threat-intel-management/get-started-with-threat-intel-management/roles-and-responsibilities-in-threat-intel-management.md): Define Threat Intel Management roles in Cortex XSOAR 8.13 On-prem. - [Indicator configuration](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.13/investigate-and-respond-to-threats/threat-intel-management/indicator-configuration.md): Configure indicators in Cortex XSOAR 8.13 On-prem. - [Customize indicator types, fields, and layouts](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.13/investigate-and-respond-to-threats/threat-intel-management/indicator-configuration/customize-indicator-types-fields-and-layouts.md): Customize indicator types, fields, and layouts in Cortex XSOAR 8.13 On-prem. - [Create an indicator type](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.13/investigate-and-respond-to-threats/threat-intel-management/indicator-configuration/customize-indicator-types-fields-and-layouts/create-an-indicator-type.md): Create indicator types in Cortex XSOAR 8.13 On-prem. - [Indicator type profile](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.13/investigate-and-respond-to-threats/threat-intel-management/indicator-configuration/customize-indicator-types-fields-and-layouts/indicator-type-profile.md): Configure indicator type profiles in Cortex XSOAR 8.13 On-prem. - [File indicators](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.13/investigate-and-respond-to-threats/threat-intel-management/indicator-configuration/customize-indicator-types-fields-and-layouts/file-indicators.md): Manage file indicators in Cortex XSOAR 8.13 On-prem. - [Formatting scripts](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.13/investigate-and-respond-to-threats/threat-intel-management/indicator-configuration/customize-indicator-types-fields-and-layouts/formatting-scripts.md): Use indicator formatting scripts in Cortex XSOAR 8.13 On-prem. - [Enhancement scripts](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.13/investigate-and-respond-to-threats/threat-intel-management/indicator-configuration/customize-indicator-types-fields-and-layouts/enhancement-scripts.md): Use indicator enhancement scripts in Cortex XSOAR 8.13 On-prem. - [Reputation scripts](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.13/investigate-and-respond-to-threats/threat-intel-management/indicator-configuration/customize-indicator-types-fields-and-layouts/reputation-scripts.md): Use indicator reputation scripts in Cortex XSOAR 8.13 On-prem. - [Reputation commands](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.13/investigate-and-respond-to-threats/threat-intel-management/indicator-configuration/customize-indicator-types-fields-and-layouts/reputation-commands.md): Use indicator reputation commands in Cortex XSOAR 8.13 On-prem. - [Map custom indicator fields](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.13/investigate-and-respond-to-threats/threat-intel-management/indicator-configuration/customize-indicator-types-fields-and-layouts/map-custom-indicator-fields.md): Map custom indicator fields in Cortex XSOAR 8.13 On-prem. - [Create an indicator field](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.13/investigate-and-respond-to-threats/threat-intel-management/indicator-configuration/customize-indicator-types-fields-and-layouts/create-an-indicator-field.md): Create indicator fields in Cortex XSOAR 8.13 On-prem. - [Indicator fields structure](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.13/investigate-and-respond-to-threats/threat-intel-management/indicator-configuration/customize-indicator-types-fields-and-layouts/create-an-indicator-field/indicator-fields-structure.md): Understand indicator field structure in Cortex XSOAR 8.13 On-prem. - [Indicator field trigger scripts](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.13/investigate-and-respond-to-threats/threat-intel-management/indicator-configuration/customize-indicator-types-fields-and-layouts/create-an-indicator-field/indicator-field-trigger-scripts.md): Configure indicator field triggers in Cortex XSOAR 8.13 On-prem. - [Indicator layout customization](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.13/investigate-and-respond-to-threats/threat-intel-management/indicator-configuration/customize-indicator-types-fields-and-layouts/indicator-layout-customization.md): Customize indicator layouts in Cortex XSOAR 8.13 On-prem. - [Indicator classification and mapping](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.13/investigate-and-respond-to-threats/threat-intel-management/indicator-configuration/indicator-classification-and-mapping.md): Classify and map indicators in Cortex XSOAR 8.13 On-prem. - [Indicator extraction](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.13/investigate-and-respond-to-threats/threat-intel-management/indicator-configuration/indicator-extraction.md): Extract indicators in Cortex XSOAR 8.13 On-prem. - [Indicator extraction modes](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.13/investigate-and-respond-to-threats/threat-intel-management/indicator-configuration/indicator-extraction/indicator-extraction-modes.md): Configure indicator extraction modes in Cortex XSOAR 8.13 On-prem. - [Create indicator extraction rules for an incident type](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.13/investigate-and-respond-to-threats/threat-intel-management/indicator-configuration/indicator-extraction/create-indicator-extraction-rules-for-an-incident-type.md): Create indicator extraction rules in Cortex XSOAR 8.13 On-prem. - [Set the indicator extraction mode for a playbook task](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.13/investigate-and-respond-to-threats/threat-intel-management/indicator-configuration/indicator-extraction/set-the-indicator-extraction-mode-for-a-playbook-task.md): Set indicator extraction modes in Cortex XSOAR 8.13 On-prem playbook tasks. - [Disable indicator extraction for scripts or integrations](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.13/investigate-and-respond-to-threats/threat-intel-management/indicator-configuration/indicator-extraction/disable-indicator-extraction-for-scripts-or-integrations.md): Disable indicator extraction in Cortex XSOAR 8.13 On-prem. - [Troubleshoot indicator extraction](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.13/investigate-and-respond-to-threats/threat-intel-management/indicator-configuration/indicator-extraction/troubleshoot-indicator-extraction.md): Troubleshoot indicator extraction in Cortex XSOAR 8.13 On-prem. - [Configure the indicator timeline](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.13/investigate-and-respond-to-threats/threat-intel-management/indicator-configuration/configure-the-indicator-timeline.md): Configure the indicator timeline in Cortex XSOAR 8.13 On-prem. - [Configure indicator expiration](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.13/investigate-and-respond-to-threats/threat-intel-management/indicator-configuration/configure-indicator-expiration.md): Configure indicator expiration in Cortex XSOAR 8.13 On-prem. - [Configure Threat Intel feed integrations](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.13/investigate-and-respond-to-threats/threat-intel-management/indicator-configuration/configure-threat-intel-feed-integrations.md): Configure Threat Intel feed integrations in Cortex XSOAR 8.13 On-prem. - [Exclude indicators from enrichment](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.13/investigate-and-respond-to-threats/threat-intel-management/indicator-configuration/exclude-indicators-from-enrichment.md): Exclude indicators from enrichment in Cortex XSOAR 8.13 On-prem. - [Configure Threat Intelligence Management playbooks to process indicators](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.13/investigate-and-respond-to-threats/threat-intel-management/indicator-configuration/configure-threat-intelligence-management-playbooks-to-process-indicators.md): Configure Threat Intel playbooks in Cortex XSOAR 8.13 On-prem. - [Export indicators](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.13/investigate-and-respond-to-threats/threat-intel-management/export-indicators.md): Export indicators in Cortex XSOAR 8.13 On-prem. - [Customize Threat Intel Reports](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.13/investigate-and-respond-to-threats/threat-intel-management/customize-threat-intel-reports.md): Customize Threat Intel Reports in Cortex XSOAR 8.13 On-prem. - [Create a Threat Intel Report type](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.13/investigate-and-respond-to-threats/threat-intel-management/customize-threat-intel-reports/create-a-threat-intel-report-type.md): Create Threat Intel Report types in Cortex XSOAR 8.13 On-prem. - [Create a Threat Intel Report field](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.13/investigate-and-respond-to-threats/threat-intel-management/customize-threat-intel-reports/create-a-threat-intel-report-field.md): Create Threat Intel Report fields in Cortex XSOAR 8.13 On-prem. - [Create a Threat Intel Report layout](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.13/investigate-and-respond-to-threats/threat-intel-management/customize-threat-intel-reports/create-a-threat-intel-report-layout.md): Create Threat Intel Report layouts in Cortex XSOAR 8.13 On-prem. - [Indicator management](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.13/investigate-and-respond-to-threats/threat-intel-management/indicator-management.md): Manage indicators in Cortex XSOAR 8.13 On-prem. - [Query indicators](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.13/investigate-and-respond-to-threats/threat-intel-management/indicator-management/query-indicators.md): Query indicators in Cortex XSOAR 8.13 On-prem. - [Indicator investigation](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.13/investigate-and-respond-to-threats/threat-intel-management/indicator-investigation.md): Investigate indicators in Cortex XSOAR 8.13 On-prem. - [Indicator verdict](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.13/investigate-and-respond-to-threats/threat-intel-management/indicator-investigation/indicator-verdict.md): Review indicator verdicts in Cortex XSOAR 8.13 On-prem. - [Extract and enrich an indicator](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.13/investigate-and-respond-to-threats/threat-intel-management/indicator-investigation/extract-and-enrich-an-indicator.md): Extract and enrich indicators in Cortex XSOAR 8.13 On-prem. - [Expire an indicator](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.13/investigate-and-respond-to-threats/threat-intel-management/indicator-investigation/expire-an-indicator.md): Expire indicators in Cortex XSOAR 8.13 On-prem. - [Manage indicator relationships](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.13/investigate-and-respond-to-threats/threat-intel-management/indicator-investigation/manage-indicator-relationships.md): Manage indicator relationships in Cortex XSOAR 8.13 On-prem. - [Delete and exclude indicators](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.13/investigate-and-respond-to-threats/threat-intel-management/indicator-investigation/delete-and-exclude-indicators.md): Delete and exclude indicators in Cortex XSOAR 8.13 On-prem. - [Manage Threat Intel Reports](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.13/investigate-and-respond-to-threats/threat-intel-management/manage-threat-intel-reports.md): Manage Threat Intel Reports in Cortex XSOAR 8.13 On-prem. - [Troubleshoot](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.13/troubleshoot-and-reference/troubleshoot.md): Troubleshoot errors in Cortex XSOAR 8.13 On-prem. - [View system status in the System Diagnostics page](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.13/troubleshoot-and-reference/troubleshoot/view-system-status-in-the-system-diagnostics-page.md): View system diagnostics in Cortex XSOAR 8.13 On-prem. - [View Guard Rails warnings and errors](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.13/troubleshoot-and-reference/troubleshoot/view-guard-rails-warnings-and-errors.md): View Guard Rails warnings in Cortex XSOAR 8.13 On-prem. - [Access logs and log bundles](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.13/troubleshoot-and-reference/troubleshoot/access-logs-and-log-bundles.md): Access logs and log bundles in Cortex XSOAR 8.13 On-prem. - [Management audit logs](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.13/troubleshoot-and-reference/troubleshoot/management-audit-logs.md): Manage audit logs in Cortex XSOAR 8.13 On-prem. - [Manage syslog servers](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.13/troubleshoot-and-reference/troubleshoot/manage-syslog-servers.md): Manage syslog servers in Cortex XSOAR 8.13 On-prem. - [Configure log and notification forwarding](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.13/troubleshoot-and-reference/troubleshoot/configure-log-and-notification-forwarding.md): Configure log forwarding in Cortex XSOAR 8.13 On-prem. - [Integration logs](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.13/troubleshoot-and-reference/troubleshoot/integration-logs.md): View integration logs in Cortex XSOAR 8.13 On-prem. - [Reference](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.13/troubleshoot-and-reference/reference.md): Reference Cortex XSOAR 8.13 On-prem features and settings. - [Cortex XSOAR concepts](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.13/troubleshoot-and-reference/reference/cortex-xsoar-concepts.md): Learn core concepts in Cortex XSOAR 8.13 On-prem. - [How to search in Cortex XSOAR](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.13/troubleshoot-and-reference/reference/how-to-search-in-cortex-xsoar.md): Search in Cortex XSOAR 8.13 On-prem. - [How to use markdown in Cortex XSOAR](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.13/troubleshoot-and-reference/reference/how-to-use-markdown-in-cortex-xsoar.md): Use markdown in Cortex XSOAR 8.13 On-prem. - [User details and preferences](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.13/troubleshoot-and-reference/reference/user-details-and-preferences.md): Manage user details and preferences in Cortex XSOAR 8.13 On-prem. - [Server configurations](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.13/troubleshoot-and-reference/reference/server-configurations.md): Configure server settings in Cortex XSOAR 8.13 On-prem. - [New user FAQ](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.13/troubleshoot-and-reference/reference/new-user-faq.md): Review new user FAQs for Cortex XSOAR 8.13 On-prem. - [Cortex XSOAR API](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.13/troubleshoot-and-reference/reference/cortex-xsoar-api.md): Use the API in Cortex XSOAR 8.13 On-prem. - [Telemetry in Cortex XSOAR](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.13/troubleshoot-and-reference/reference/telemetry-in-cortex-xsoar.md): Manage telemetry in Cortex XSOAR 8.13 On-prem. - [Keyboard shortcuts](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.13/troubleshoot-and-reference/reference/keyboard-shortcuts.md): Use keyboard shortcuts in Cortex XSOAR 8.13 On-prem. - [Product support lifecycle](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.13/troubleshoot-and-reference/reference/product-support-lifecycle.md): Review the product support lifecycle for Cortex XSOAR 8.13 On-prem. - [Cortex XSOAR navigation cheat sheet](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.13/troubleshoot-and-reference/reference/cortex-xsoar-navigation-cheat-sheet.md): Navigate Cortex XSOAR 8.13 On-prem features. - [What is Cortex XSOAR multi-tenant?](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.13/multi-tenant/what-is-cortex-xsoar-multi-tenant.md): Learn about multi-tenant deployments in Cortex XSOAR 8.13 On-prem. - [Onboard Cortex XSOAR multi-tenant](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.13/multi-tenant/onboard-cortex-xsoar-multi-tenant.md): Onboard multi-tenant deployments in Cortex XSOAR 8.13 On-prem. - [Onboarding checklist for multi-tenant deployments](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.13/multi-tenant/onboard-cortex-xsoar-multi-tenant/onboarding-checklist-for-multi-tenant-deployments.md): Complete multi-tenant onboarding in Cortex XSOAR 8.13 On-prem. - [Step 1. Install Cortex XSOAR for multi-tenant](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.13/multi-tenant/onboard-cortex-xsoar-multi-tenant/step-1.-install-cortex-xsoar-for-multi-tenant.md): Install multi-tenant deployments in Cortex XSOAR 8.13 On-prem. - [Step 2. Pair child tenant to main tenant](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.13/multi-tenant/onboard-cortex-xsoar-multi-tenant/step-2.-pair-child-tenant-to-main-tenant.md): Pair child tenants in Cortex XSOAR 8.13 On-prem. - [Step 3. Set up an engine](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.13/multi-tenant/onboard-cortex-xsoar-multi-tenant/step-3.-set-up-an-engine.md): Set up engines in Cortex XSOAR 8.13 On-prem multi-tenant deployments. - [Step 4. Set up users and roles](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.13/multi-tenant/onboard-cortex-xsoar-multi-tenant/step-4.-set-up-users-and-roles.md): Set up multi-tenant users and roles in Cortex XSOAR 8.13 On-prem. - [Step 5. Install and configure content](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.13/multi-tenant/onboard-cortex-xsoar-multi-tenant/step-5.-install-and-configure-content.md): Configure multi-tenant content in Cortex XSOAR 8.13 On-prem. - [Child tenant management](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.13/multi-tenant/child-tenant-management.md): Manage child tenants in Cortex XSOAR 8.13 On-prem. - [Content management in multi-tenant](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.13/multi-tenant/child-tenant-management/content-management-in-multi-tenant.md): Manage multi-tenant content in Cortex XSOAR 8.13 On-prem. - [Add propagation labels to content](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.13/multi-tenant/child-tenant-management/content-management-in-multi-tenant/add-propagation-labels-to-content.md): Add content propagation labels in Cortex XSOAR 8.13 On-prem. - [Add propagation labels to a child tenant](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.13/multi-tenant/child-tenant-management/content-management-in-multi-tenant/add-propagation-labels-to-a-child-tenant.md): Add child tenant propagation labels in Cortex XSOAR 8.13 On-prem. - [Sync content to child tenants](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.13/multi-tenant/child-tenant-management/content-management-in-multi-tenant/sync-content-to-child-tenants.md): Sync content to child tenants in Cortex XSOAR 8.13 On-prem. - [Manage content using a remote repository](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.13/multi-tenant/child-tenant-management/content-management-in-multi-tenant/manage-content-using-a-remote-repository.md): Manage remote repository content in Cortex XSOAR 8.13 On-prem. - [Incident management on the main tenant](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.13/multi-tenant/incident-management-on-the-main-tenant.md): Manage main tenant incidents in Cortex XSOAR 8.13 On-prem. - [Manage main tenant users in an investigation](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.13/multi-tenant/incident-management-on-the-main-tenant/manage-main-tenant-users-in-an-investigation.md): Manage main tenant users in Cortex XSOAR 8.13 On-prem investigations. - [Run a command on multiple tenants](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.13/multi-tenant/incident-management-on-the-main-tenant/run-a-command-on-multiple-tenants.md): Run commands across tenants in Cortex XSOAR 8.13 On-prem. - [Indicator management on the main tenant](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.13/multi-tenant/indicator-management-on-the-main-tenant.md): Manage main tenant indicators in Cortex XSOAR 8.13 On-prem. * [Navigate the Cortex XSOAR 8.12 On-prem docs](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.12/learn-about-cortex-xsoar/readme.md): Start here for a visual overview of the main Cortex XSOAR 8.12 On-prem documentation areas. * [Get Started with Cortex XSOAR](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.12/learn-about-cortex-xsoar/get-started-with-cortex-xsoar.md): In Cortex XSOAR 8.12 On-prem, learn about architecture, roles, responsibilities, and licenses. * [What is Cortex XSOAR?](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.12/learn-about-cortex-xsoar/what-is-cortex-xsoar.md): Learn about Cortex XSOAR 8.12 On-prem features for security orchestration and automation. * [Cortex XSOAR architecture](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.12/learn-about-cortex-xsoar/cortex-xsoar-architecture.md): Explore the Cortex XSOAR 8.12 On-prem architecture, including cluster nodes and core services. * [Cortex XSOAR use cases](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.12/learn-about-cortex-xsoar/cortex-xsoar-use-cases.md): Explore recommended SOC automation use cases in Cortex XSOAR 8.12 On-prem. * [Understand Cortex XSOAR licenses](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.12/learn-about-cortex-xsoar/understand-cortex-xsoar-licenses.md): In Cortex XSOAR 8.12 On-prem, learn about license types, quotas, and user access. * [Roles and responsibilities](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.12/learn-about-cortex-xsoar/roles-and-responsibilities.md): In Cortex XSOAR 8.12 On-prem, learn about core SOC roles and responsibilities. * [Supported web browsers](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.12/learn-about-cortex-xsoar/supported-web-browsers.md): View supported web browsers for Cortex XSOAR 8.12 On-prem. * [How to onboard Cortex XSOAR](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.12/onboard-cortex-xsoar/onboard-and-configure-cortex-xsoar.md): In Cortex XSOAR 8.12 On-prem, onboard and configure your deployment. * [Plan your deployment](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.12/onboard-cortex-xsoar/plan-your-deployment.md): In Cortex XSOAR 8.12 On-prem, plan deployment, access, and content management. * [Deployment steps](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.12/onboard-cortex-xsoar/deployment-steps.md): In Cortex XSOAR 8.12 On-prem, follow the core deployment and onboarding steps. * [Onboarding checklist](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.12/onboard-cortex-xsoar/deployment-steps/onboarding-checklist.md): In Cortex XSOAR 8.12 On-prem, activate, provision, grant access, and configure. * [Step 1. Install Cortex XSOAR](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.12/onboard-cortex-xsoar/deployment-steps/step-1.-install-cortex-xsoar.md): In Cortex XSOAR 8.12 On-prem, install your deployment and add a license. * [Step 2. Set up an engine](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.12/onboard-cortex-xsoar/deployment-steps/step-2.-set-up-an-engine.md): In Cortex XSOAR 8.12 On-prem, set up an engine on a remote machine. * [Step 3. Set up a remote repository](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.12/onboard-cortex-xsoar/deployment-steps/step-3.-set-up-a-remote-repository.md): In Cortex XSOAR 8.12 On-prem, set up a remote repository for content development. * [Step 4. Set up users and roles](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.12/onboard-cortex-xsoar/deployment-steps/step-4.-set-up-users-and-roles.md): In Cortex XSOAR 8.12 On-prem, configure users, permissions, and predefined roles. * [Step 5. Install and configure content](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.12/onboard-cortex-xsoar/deployment-steps/step-5.-install-and-configure-content.md): In Cortex XSOAR 8.12 On-prem, install and configure content for your use case. * [Install content packs](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.12/onboard-cortex-xsoar/deployment-steps/step-5.-install-and-configure-content/install-content-packs.md): In Cortex XSOAR 8.12 On-prem, install content packs for your use case. * [Set up your use case with the Deployment Wizard](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.12/onboard-cortex-xsoar/deployment-steps/step-5.-install-and-configure-content/set-up-your-use-case-with-the-deployment-wizard.md): In Cortex XSOAR 8.12 On-prem, use the Deployment Wizard to adopt a use case. * [Post deployment](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.12/onboard-cortex-xsoar/post-deployment.md): In Cortex XSOAR 8.12 On-prem, complete post-deployment communication and system setup. * [User communication](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.12/onboard-cortex-xsoar/post-deployment/user-communication.md): In Cortex XSOAR 8.12 On-prem, configure communications for your users. * [Configure user notifications in Cortex XSOAR](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.12/onboard-cortex-xsoar/post-deployment/user-communication/configure-user-notifications-in-cortex-xsoar.md): In Cortex XSOAR 8.12 On-prem, configure notifications for your users. * [Customize system emails](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.12/onboard-cortex-xsoar/post-deployment/user-communication/customize-system-emails.md): In Cortex XSOAR 8.12 On-prem, customize system email messages. * [Configure system settings](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.12/onboard-cortex-xsoar/post-deployment/configure-system-settings.md): In Cortex XSOAR 8.12 On-prem, configure system settings for your deployment. * [Configure server settings](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.12/onboard-cortex-xsoar/post-deployment/configure-system-settings/configure-server-settings.md): In Cortex XSOAR 8.12 On-prem, configure server settings for your deployment. * [Configure security settings](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.12/onboard-cortex-xsoar/post-deployment/configure-system-settings/configure-security-settings.md): In Cortex XSOAR 8.12 On-prem, configure security settings for your deployment. * [How to install Cortex XSOAR](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.12/install-cortex-xsoar/cortex-xsoar-installation.md): In Cortex XSOAR 8.12 On-prem, install, maintain, and upgrade your deployment. * [High Availability for Cortex XSOAR](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.12/install-cortex-xsoar/high-availability-for-cortex-xsoar.md): In Cortex XSOAR 8.12 On-prem, configure High Availability for reliable operation. * [Load balancing for Cortex XSOAR](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.12/install-cortex-xsoar/load-balancing-for-cortex-xsoar.md): In Cortex XSOAR 8.12 On-prem, configure load balancing for reliable operation. * [System Requirements](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.12/install-cortex-xsoar/system-requirements.md): In Cortex XSOAR 8.12 On-prem, verify minimum system requirements for deployment. * [Hardware requirements](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.12/install-cortex-xsoar/system-requirements/hardware-requirements.md): In Cortex XSOAR 8.12 On-prem, review hardware requirements for installation. * [Port requirements for cluster communication](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.12/install-cortex-xsoar/system-requirements/port-requirements-for-cluster-communication.md): In Cortex XSOAR 8.12 On-prem, configure ports for cluster communication. * [URL requirements](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.12/install-cortex-xsoar/system-requirements/url-requirements.md): In Cortex XSOAR 8.12 On-prem, allow required URLs for installation and operation. * [Bandwidth and NTP requirements](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.12/install-cortex-xsoar/system-requirements/bandwidth-and-ntp-requirements.md): In Cortex XSOAR 8.12 On-prem, meet bandwidth and NTP synchronization requirements. * [Install Cortex XSOAR on a VM deployed on AWS](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.12/install-cortex-xsoar/install-cortex-xsoar-on-a-vm-deployed-on-aws.md): In Cortex XSOAR 8.12 On-prem, install a virtual machine on AWS. * [Task 1. Download the OVA Image and license from Cortex Gateway](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.12/install-cortex-xsoar/install-cortex-xsoar-on-a-vm-deployed-on-aws/task-1.-download-the-ova-image-and-license-from-cortex-gateway.md): In Cortex XSOAR 8.12 On-prem, download the OVA image and license from Cortex Gateway. * [Task 2. Deploy your virtual machine on AWS](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.12/install-cortex-xsoar/install-cortex-xsoar-on-a-vm-deployed-on-aws/task-2.-deploy-your-virtual-machine-on-aws.md): In Cortex XSOAR 8.12 On-prem, deploy your virtual machine on AWS. * [Task 3. Validate tenant nework and IP settings](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.12/install-cortex-xsoar/install-cortex-xsoar-on-a-vm-deployed-on-aws/task-3.-validate-tenant-nework-and-ip-settings.md): In Cortex XSOAR 8.12 On-prem, validate tenant network and IP settings. * [Task 4. Configure NTP servers](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.12/install-cortex-xsoar/install-cortex-xsoar-on-a-vm-deployed-on-aws/task-4.-configure-ntp-servers.md): In Cortex XSOAR 8.12 On-prem, configure NTP servers for your deployment. * [Task 5. (Optional) Configure proxy settings](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.12/install-cortex-xsoar/install-cortex-xsoar-on-a-vm-deployed-on-aws/task-5.-optional-configure-proxy-settings.md): In Cortex XSOAR 8.12 On-prem, configure optional proxy settings. * [Task 6. Establish trust between all nodes in a cluster](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.12/install-cortex-xsoar/install-cortex-xsoar-on-a-vm-deployed-on-aws/task-6.-establish-trust-between-all-nodes-in-a-cluster.md): In Cortex XSOAR 8.12 On-prem, establish trust between cluster nodes. * [Task 7. Install Cortex XSOAR on your VM](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.12/install-cortex-xsoar/install-cortex-xsoar-on-a-vm-deployed-on-aws/task-7.-install-cortex-xsoar-on-your-vm.md): In Cortex XSOAR 8.12 On-prem, install it on your virtual machine. * [Task 8. Verify you can log into Cortex XSOAR](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.12/install-cortex-xsoar/install-cortex-xsoar-on-a-vm-deployed-on-aws/task-8.-verify-you-can-log-into-cortex-xsoar.md): In Cortex XSOAR 8.12 On-prem, verify that you can sign in. * [Install Cortex XSOAR on a VM deployed on OCI](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.12/install-cortex-xsoar/install-cortex-xsoar-on-a-vm-deployed-on-oci.md): In Cortex XSOAR 8.12 On-prem, install a virtual machine on OCI. * [Task 1. Download the OVA image and license from Cortex Gateway](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.12/install-cortex-xsoar/install-cortex-xsoar-on-a-vm-deployed-on-oci/task-1.-download-the-ova-image-and-license-from-cortex-gateway.md): In Cortex XSOAR 8.12 On-prem, download the OVA image and license from Cortex Gateway. * [Task 2. Deploy your virtual machine on OCI](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.12/install-cortex-xsoar/install-cortex-xsoar-on-a-vm-deployed-on-oci/task-2.-deploy-your-virtual-machine-on-oci.md): In Cortex XSOAR 8.12 On-prem, deploy your virtual machine on OCI. * [Task 3. Validate tenant network and IP settings](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.12/install-cortex-xsoar/install-cortex-xsoar-on-a-vm-deployed-on-oci/task-3.-validate-tenant-network-and-ip-settings.md): In Cortex XSOAR 8.12 On-prem, validate tenant network and IP settings. * [Task 4. Configure NTP servers](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.12/install-cortex-xsoar/install-cortex-xsoar-on-a-vm-deployed-on-oci/task-4.-configure-ntp-servers.md): In Cortex XSOAR 8.12 On-prem, configure NTP servers for your deployment. * [Task 5. (Optional) Configure proxy settings](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.12/install-cortex-xsoar/install-cortex-xsoar-on-a-vm-deployed-on-oci/task-5.-optional-configure-proxy-settings.md): In Cortex XSOAR 8.12 On-prem, configure optional proxy settings. * [Task 6. Establish trust between all nodes in a cluster](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.12/install-cortex-xsoar/install-cortex-xsoar-on-a-vm-deployed-on-oci/task-6.-establish-trust-between-all-nodes-in-a-cluster.md): In Cortex XSOAR 8.12 On-prem, establish trust between cluster nodes. * [Task 7. Install Cortex XSOAR on your VM](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.12/install-cortex-xsoar/install-cortex-xsoar-on-a-vm-deployed-on-oci/task-7.-install-cortex-xsoar-on-your-vm.md): In Cortex XSOAR 8.12 On-prem, install it on your virtual machine. * [Task 8. Verify you can log into Cortex XSOAR](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.12/install-cortex-xsoar/install-cortex-xsoar-on-a-vm-deployed-on-oci/task-8.-verify-you-can-log-into-cortex-xsoar.md): In Cortex XSOAR 8.12 On-prem, verify that you can sign in. * [Install Cortex XSOAR on a VM deployed on Hyper-V](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.12/install-cortex-xsoar/install-cortex-xsoar-on-a-vm-deployed-on-hyper-v.md): In Cortex XSOAR 8.12 On-prem, install a virtual machine on Hyper-V. * [Install Cortex XSOAR on a VM deployed on VSphere](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.12/install-cortex-xsoar/install-cortex-xsoar-on-a-vm-deployed-on-vsphere.md): In Cortex XSOAR 8.12 On-prem, install a virtual machine on vSphere. * [Install Cortex XSOAR on a VM deployed on KVM](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.12/install-cortex-xsoar/install-cortex-xsoar-on-a-vm-deployed-on-kvm.md): In Cortex XSOAR 8.12 On-prem, install a virtual machine on KVM. * [Task 1. Download the QCOW2 image and license from Cortex Gateway](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.12/install-cortex-xsoar/install-cortex-xsoar-on-a-vm-deployed-on-kvm/task-1.-download-the-qcow2-image-and-license-from-cortex-gateway.md): In Cortex XSOAR 8.12 On-prem, download the QCOW2 image and license from Cortex Gateway. * [Task 2. Deploy your virtual machine on KVM](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.12/install-cortex-xsoar/install-cortex-xsoar-on-a-vm-deployed-on-kvm/task-2.-deploy-your-virtual-machine-on-kvm.md): In Cortex XSOAR 8.12 On-prem, deploy your virtual machine on KVM. * [Task 3. Configure tenant network and IP settings for each node](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.12/install-cortex-xsoar/install-cortex-xsoar-on-a-vm-deployed-on-kvm/task-3.-configure-tenant-network-and-ip-settings-for-each-node.md): In Cortex XSOAR 8.12 On-prem, configure tenant network and IP settings for each node. * [Task 4. Configure NTP servers](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.12/install-cortex-xsoar/install-cortex-xsoar-on-a-vm-deployed-on-kvm/task-4.-configure-ntp-servers.md): In Cortex XSOAR 8.12 On-prem, configure NTP servers for your deployment. * [Task 5. (Optional) Configure proxy settings](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.12/install-cortex-xsoar/install-cortex-xsoar-on-a-vm-deployed-on-kvm/task-5.-optional-configure-proxy-settings.md): In Cortex XSOAR 8.12 On-prem, configure optional proxy settings. * [Task 6. Establish trust between all nodes in a cluster](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.12/install-cortex-xsoar/install-cortex-xsoar-on-a-vm-deployed-on-kvm/task-6.-establish-trust-between-all-nodes-in-a-cluster.md): In Cortex XSOAR 8.12 On-prem, establish trust between cluster nodes. * [Task 7. Install Cortex XSOAR on your VM](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.12/install-cortex-xsoar/install-cortex-xsoar-on-a-vm-deployed-on-kvm/task-7.-install-cortex-xsoar-on-your-vm.md): In Cortex XSOAR 8.12 On-prem, install it on your virtual machine. * [Task 8. Verify you can log into Cortex XSOAR](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.12/install-cortex-xsoar/install-cortex-xsoar-on-a-vm-deployed-on-kvm/task-8.-verify-you-can-log-into-cortex-xsoar.md): In Cortex XSOAR 8.12 On-prem, verify that you can sign in. * [Post-installation](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.12/install-cortex-xsoar/post-installation.md): In Cortex XSOAR 8.12 On-prem, add a license, configure certificates, and maintain your VM. * [Add the Cortex XSOAR license](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.12/install-cortex-xsoar/post-installation/add-the-cortex-xsoar-license.md): In Cortex XSOAR 8.12 On-prem, download and add a license from Cortex Gateway. * [HTTPS with a signed certificate](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.12/install-cortex-xsoar/post-installation/https-with-a-signed-certificate.md): In Cortex XSOAR 8.12 On-prem, configure HTTPS with a signed certificate. * [Use a signed certificate instead of SSL verification](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.12/install-cortex-xsoar/post-installation/use-a-signed-certificate-instead-of-ssl-verification.md): In Cortex XSOAR 8.12 On-prem, use a signed certificate for MSSP connections. * [Optimize performance and robustness from the textual UI](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.12/install-cortex-xsoar/post-installation/optimize-performance-and-robustness-from-the-textual-ui.md): In Cortex XSOAR 8.12 On-prem, optimize performance from the VM textual UI. * [Manage nodes in a cluster](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.12/install-cortex-xsoar/post-installation/optimize-performance-and-robustness-from-the-textual-ui/manage-nodes-in-a-cluster.md): In Cortex XSOAR 8.12 On-prem, manage nodes in your cluster. * [Scale up hardware resources](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.12/install-cortex-xsoar/post-installation/optimize-performance-and-robustness-from-the-textual-ui/scale-up-hardware-resources.md): In Cortex XSOAR 8.12 On-prem, scale up hardware resources. * [Troubleshoot your installation](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.12/install-cortex-xsoar/troubleshoot-your-installation.md): In Cortex XSOAR 8.12 On-prem, troubleshoot installation from the VM textual UI. * [Common installation limitations and fixes](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.12/install-cortex-xsoar/troubleshoot-your-installation/common-installation-limitations-and-fixes.md): In Cortex XSOAR 8.12 On-prem, troubleshoot common installation limitations and issues. * [Access logs and log bundles](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.12/install-cortex-xsoar/troubleshoot-your-installation/access-logs-and-log-bundles.md): In Cortex XSOAR 8.12 On-prem, access logs and download troubleshooting bundles. * [Open a support session](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.12/install-cortex-xsoar/troubleshoot-your-installation/open-a-support-session.md): In Cortex XSOAR 8.12 On-prem, open a support session from the VM textual UI. * [Upload your license to the textual UI](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.12/install-cortex-xsoar/troubleshoot-your-installation/upload-your-license-to-the-textual-ui.md): In Cortex XSOAR 8.12 On-prem, upload a license to the VM textual UI. * [Shut down Cortex XSOAR](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.12/install-cortex-xsoar/troubleshoot-your-installation/shut-down-cortex-xsoar.md): In Cortex XSOAR 8.12 On-prem, shut down your deployment from the VM textual UI. * [Update Cortex XSOAR](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.12/install-cortex-xsoar/update-cortex-xsoar.md): In Cortex XSOAR 8.12 On-prem, upgrade your tenant to the latest version. * [How to back up and restore Cortex XSOAR](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.12/back-up-and-restore-cortex-xsoar/back-up-and-restore-cortex-xsoar.md): In Cortex XSOAR 8.12 On-prem, back up and restore your cluster data. * [Set up access to an external storage](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.12/back-up-and-restore-cortex-xsoar/set-up-access-to-an-external-storage.md): In Cortex XSOAR 8.12 On-prem, configure access to external storage. * [Back up data](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.12/back-up-and-restore-cortex-xsoar/back-up-data.md): From the Cortex XSOAR tenant, perform scheduled backups and on-demand backup and restore of Cortex XSOAR data. * [Backup guidelines and best practices](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.12/back-up-and-restore-cortex-xsoar/back-up-data/backup-guidelines-and-best-practices.md) * [Restore data](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.12/back-up-and-restore-cortex-xsoar/restore-data.md): In Cortex XSOAR 8.12 On-prem, restore data from an external backup. * [End-to-end example of Cortex XSOAR cluster backup and restore](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.12/back-up-and-restore-cortex-xsoar/end-to-end-example-of-cortex-xsoar-cluster-backup-and-restore.md): In Cortex XSOAR 8.12 On-prem, follow an end-to-end backup and restore workflow. * [Common backup and restore limitations and fixes](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.12/back-up-and-restore-cortex-xsoar/common-backup-and-restore-limitations-and-fixes.md): In Cortex XSOAR 8.12 On-prem, troubleshoot common backup and restore issues. * [Engines](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.12/configure-cortex-xsoar/engines.md): In Cortex XSOAR 8.12 On-prem, install, configure, and troubleshoot engines. * [What is an engine?](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.12/configure-cortex-xsoar/engines/what-is-an-engine.md): In Cortex XSOAR 8.12 On-prem, learn how engines connect external systems. * [Engine requirements](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.12/configure-cortex-xsoar/engines/engine-requirements.md): In Cortex XSOAR 8.12 On-prem, review engine hardware, OS, and URL requirements. * [Install an engine](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.12/configure-cortex-xsoar/engines/install-an-engine.md): In Cortex XSOAR 8.12 On-prem, install, deploy, and configure an engine. * [Engine air gap installation](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.12/configure-cortex-xsoar/engines/install-an-engine/engine-air-gap-installation.md): In Cortex XSOAR 8.12 On-prem, install an engine offline on RHEL 8. * [Docker](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.12/configure-cortex-xsoar/engines/install-an-engine/docker.md): In Cortex XSOAR 8.12 On-prem, install, configure, secure, and troubleshoot Docker. * [Install Docker](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.12/configure-cortex-xsoar/engines/install-an-engine/docker/install-docker.md): In Cortex XSOAR 8.12 On-prem, install Docker for engine operations. * [Install Docker distribution for Red Hat on an engine server](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.12/configure-cortex-xsoar/engines/install-an-engine/docker/install-docker-distribution-for-red-hat-on-an-engine-server.md): In Cortex XSOAR 8.12 On-prem, install Docker on a Red Hat engine server. * [Docker image security](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.12/configure-cortex-xsoar/engines/install-an-engine/docker/docker-image-security.md): In Cortex XSOAR 8.12 On-prem, secure Docker images used by engines. * [Use the Cortex XSOAR Container Registry](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.12/configure-cortex-xsoar/engines/install-an-engine/docker/use-the-cortex-xsoar-container-registry.md): In Cortex XSOAR 8.12 On-prem, use the Container Registry with engines. * [Docker FAQs](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.12/configure-cortex-xsoar/engines/install-an-engine/docker/docker-faqs.md): In Cortex XSOAR 8.12 On-prem, find answers to common Docker questions. * [Troubleshoot Docker issues](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.12/configure-cortex-xsoar/engines/install-an-engine/docker/troubleshoot-docker-issues.md): In Cortex XSOAR 8.12 On-prem, troubleshoot Docker issues on engines. * [Configure Docker pull rate limit](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.12/configure-cortex-xsoar/engines/install-an-engine/docker/configure-docker-pull-rate-limit.md): In Cortex XSOAR 8.12 On-prem, configure Docker image pull rate limits. * [Change the Docker installation folder](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.12/configure-cortex-xsoar/engines/install-an-engine/docker/change-the-docker-installation-folder.md): In Cortex XSOAR 8.12 On-prem, change the Docker installation directory. * [Configure Docker integrations to trust custom certificates](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.12/configure-cortex-xsoar/engines/install-an-engine/docker/configure-docker-integrations-to-trust-custom-certificates.md): In Cortex XSOAR 8.12 On-prem, configure Docker integrations to trust custom certificates. * [Configure Python Docker integrations to trust custom certificates](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.12/configure-cortex-xsoar/engines/install-an-engine/docker/configure-python-docker-integrations-to-trust-custom-certificates.md): In Cortex XSOAR 8.12 On-prem, configure Python Docker integrations to trust custom certificates. * [Docker hardening guide](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.12/configure-cortex-xsoar/engines/install-an-engine/docker/docker-hardening-guide.md): In Cortex XSOAR 8.12 On-prem, harden Docker for secure engine operations. * [Podman](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.12/configure-cortex-xsoar/engines/install-an-engine/podman.md): In Cortex XSOAR 8.12 On-prem, run Podman containers on RHEL 8 or later. * [Change container storage directory](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.12/configure-cortex-xsoar/engines/install-an-engine/podman/change-container-storage-directory.md): In Cortex XSOAR 8.12 On-prem, change the Podman container storage directory. * [Install Podman](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.12/configure-cortex-xsoar/engines/install-an-engine/podman/install-podman.md): In Cortex XSOAR 8.12 On-prem, install Podman for engine operations. * [Migrate From Docker to Podman](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.12/configure-cortex-xsoar/engines/install-an-engine/podman/migrate-from-docker-to-podman.md): In Cortex XSOAR 8.12 On-prem, migrate an engine from Docker to Podman. * [Troubleshoot Podman](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.12/configure-cortex-xsoar/engines/install-an-engine/podman/troubleshoot-podman.md): In Cortex XSOAR 8.12 On-prem, troubleshoot Podman on an engine. * [Manage engines](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.12/configure-cortex-xsoar/engines/manage-engines.md): In Cortex XSOAR 8.12 On-prem, manage engines and load-balancing groups. * [Upgrade an engine](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.12/configure-cortex-xsoar/engines/upgrade-an-engine.md): In Cortex XSOAR 8.12 On-prem, upgrade an engine from the tenant or remote machine. * [Remove an engine](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.12/configure-cortex-xsoar/engines/remove-an-engine.md): In Cortex XSOAR 8.12 On-prem, remove an engine using operating system commands. * [Configure engines](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.12/configure-cortex-xsoar/engines/configure-engines.md): In Cortex XSOAR 8.12 On-prem, configure engines in d1.conf or the UI. * [Configure the engine to use a web proxy](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.12/configure-cortex-xsoar/engines/configure-engines/configure-the-engine-to-use-a-web-proxy.md): Configure a Cortex XSOAR engine to use a web proxy by editing the d1.conf file. * [Configure the engine to call the server without using a proxy](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.12/configure-cortex-xsoar/engines/configure-engines/configure-the-engine-to-call-the-server-without-using-a-proxy.md): In Cortex XSOAR 8.12 On-prem, configure an engine to bypass a proxy. * [Use NGINX as a reverse proxy](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.12/configure-cortex-xsoar/engines/configure-engines/configure-the-engine-to-call-the-server-without-using-a-proxy/use-nginx-as-a-reverse-proxy.md): In Cortex XSOAR 8.12 On-prem, use NGINX as an engine reverse proxy. * [Configure an engine to use custom certificates](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.12/configure-cortex-xsoar/engines/configure-an-engine-to-use-custom-certificates.md): In Cortex XSOAR 8.12 On-prem, configure an engine to use custom certificates. * [Use an engine in an integration](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.12/configure-cortex-xsoar/engines/use-an-engine-in-an-integration.md): In Cortex XSOAR 8.12 On-prem, use an engine with an integration. * [Run a script using an engine](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.12/configure-cortex-xsoar/engines/run-a-script-using-an-engine.md): In Cortex XSOAR 8.12 On-prem, run scripts on an engine or load-balancing group. * [Troubleshoot engines](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.12/configure-cortex-xsoar/engines/troubleshoot-engines.md): In Cortex XSOAR 8.12 On-prem, troubleshoot engines using logs and errors. * [Troubleshoot integrations running on engines](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.12/configure-cortex-xsoar/engines/troubleshoot-integrations-running-on-engines.md): In Cortex XSOAR 8.12 On-prem, troubleshoot integrations running on engines. * [Remote Repository Management](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.12/configure-cortex-xsoar/remote-repository-management.md): In Cortex XSOAR 8.12 On-prem, configure and manage remote repositories across development and production tenants. * [Content management in Cortex XSOAR](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.12/configure-cortex-xsoar/remote-repository-management/content-management-in-cortex-xsoar.md): In Cortex XSOAR 8.12 On-prem, manage content using manual, CI/CD, or remote repository workflows. * [Set up a private remote repository](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.12/configure-cortex-xsoar/remote-repository-management/set-up-a-private-remote-repository.md): In Cortex XSOAR 8.12 On-prem, set up a private remote repository for tenant content. * [Push content from a development tenant](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.12/configure-cortex-xsoar/remote-repository-management/push-content-from-a-development-tenant.md): In Cortex XSOAR 8.12 On-prem, push development tenant content to a remote repository. * [Install content on a production tenant](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.12/configure-cortex-xsoar/remote-repository-management/install-content-on-a-production-tenant.md): In Cortex XSOAR 8.12 On-prem, install remote repository content on a production tenant. * [Remote repository troubleshooting](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.12/configure-cortex-xsoar/remote-repository-management/remote-repository-troubleshooting.md): In Cortex XSOAR 8.12 On-prem, troubleshoot remote repository content management issues. * [Users and Roles Management](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.12/configure-cortex-xsoar/users-and-roles-management.md): In Cortex XSOAR 8.12 On-prem, manage users, roles, groups, and authentication. * [Users and roles in Cortex XSOAR](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.12/configure-cortex-xsoar/users-and-roles-management/users-and-roles-in-cortex-xsoar.md): In Cortex XSOAR 8.12 On-prem, configure user access through roles, groups, and authentication. * [Roles management](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.12/configure-cortex-xsoar/users-and-roles-management/roles-management.md): In Cortex XSOAR 8.12 On-prem, configure roles and their tenant permissions. * [Role-based permissions](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.12/configure-cortex-xsoar/users-and-roles-management/roles-management/role-based-permissions.md): In Cortex XSOAR 8.12 On-prem, configure role-based permissions and page access. * [Manage roles in the Cortex XSOAR tenant](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.12/configure-cortex-xsoar/users-and-roles-management/roles-management/manage-roles-in-the-cortex-xsoar-tenant.md): In Cortex XSOAR 8.12 On-prem, create, manage, and assign tenant roles. * [User group management](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.12/configure-cortex-xsoar/users-and-roles-management/user-group-management.md): In Cortex XSOAR 8.12 On-prem, create user groups and assign roles and users. * [Set up authentication](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.12/configure-cortex-xsoar/users-and-roles-management/set-up-authentication.md): In Cortex XSOAR 8.12 On-prem, configure local user authentication or SAML SSO. * [Create users in Cortex XSOAR](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.12/configure-cortex-xsoar/users-and-roles-management/set-up-authentication/create-users-in-cortex-xsoar.md): In Cortex XSOAR 8.12 On-prem, invite local users and assign their access. * [Authenticate users using SSO](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.12/configure-cortex-xsoar/users-and-roles-management/set-up-authentication/authenticate-users-using-sso.md): In Cortex XSOAR 8.12 On-prem, authenticate tenant users through SAML SSO. * [Set up Okta as the Identity Provider Using SAML 2.0](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.12/configure-cortex-xsoar/users-and-roles-management/set-up-authentication/set-up-okta-as-the-identity-provider-using-saml-2.0.md): In Cortex XSOAR 8.12 On-prem, configure Okta as a SAML 2.0 identity provider. * [Set up Microsoft Entra ID as the Identity Provider Using SAML 2.0](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.12/configure-cortex-xsoar/users-and-roles-management/set-up-authentication/set-up-microsoft-entra-id-as-the-identity-provider-using-saml-2.0.md): In Cortex XSOAR 8.12 On-prem, configure Microsoft Entra ID as a SAML 2.0 identity provider. * [User management](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.12/configure-cortex-xsoar/users-and-roles-management/user-management.md): In Cortex XSOAR 8.12 On-prem, manage user access, roles, and groups. * [Configure a password policy](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.12/configure-cortex-xsoar/users-and-roles-management/configure-a-password-policy.md): In Cortex XSOAR 8.12 On-prem, configure password complexity, expiration, and lockout policies. * [Marketplace](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.12/configure-cortex-xsoar/marketplace.md): In Cortex XSOAR 8.12 On-prem, use Marketplace to discover and manage content packs. * [Cortex Marketplace](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.12/configure-cortex-xsoar/marketplace/cortex-marketplace.md): In Cortex XSOAR 8.12 On-prem, search Marketplace content by use case, integration, and category. * [Content packs](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.12/configure-cortex-xsoar/marketplace/content-packs.md): In Cortex XSOAR 8.12 On-prem, find content packs for your security use cases. * [Content Pack Support Types](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.12/configure-cortex-xsoar/marketplace/content-pack-support-types.md): In Cortex XSOAR 8.12 On-prem, understand Marketplace content pack support types. * [Manage content packs](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.12/configure-cortex-xsoar/marketplace/manage-content-packs.md): In Cortex XSOAR 8.12 On-prem, install, update, revert, and delete content packs. * [Set up your use case with the Deployment Wizard](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.12/configure-cortex-xsoar/marketplace/set-up-your-use-case-with-the-deployment-wizard.md): In Cortex XSOAR 8.12 On-prem, use the Deployment Wizard to configure a security use case. * [Marketplace FAQs](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.12/configure-cortex-xsoar/marketplace/marketplace-faqs.md): In Cortex XSOAR 8.12 On-prem, find answers to common Marketplace content questions. * [Content pack update notifications](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.12/configure-cortex-xsoar/marketplace/content-pack-update-notifications.md): In Cortex XSOAR 8.12 On-prem, enable update notifications for selected content packs. * [Customize content pack notifications](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.12/configure-cortex-xsoar/marketplace/content-pack-update-notifications/customize-content-pack-notifications.md): In Cortex XSOAR 8.12 On-prem, customize content pack update notification delivery. * [Content pack contributions](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.12/configure-cortex-xsoar/marketplace/content-pack-contributions.md): In Cortex XSOAR 8.12 On-prem, create and submit Marketplace content pack contributions. * [Create a content pack](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.12/configure-cortex-xsoar/marketplace/content-pack-contributions/create-a-content-pack.md): In Cortex XSOAR 8.12 On-prem, create and submit a Marketplace content pack. * [Resubmit a content pack](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.12/configure-cortex-xsoar/marketplace/content-pack-contributions/resubmit-a-content-pack.md): In Cortex XSOAR 8.12 On-prem, resubmit an updated Marketplace content pack. * [Integrations](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.12/configure-cortex-xsoar/integrations.md): In Cortex XSOAR 8.12 On-prem, configure, manage, and troubleshoot integrations. * [Integration use cases](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.12/configure-cortex-xsoar/integrations/integration-use-cases.md): In Cortex XSOAR 8.12 On-prem, explore integration use cases for security operations. * [Configure integrations](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.12/configure-cortex-xsoar/integrations/configure-integrations.md): In Cortex XSOAR 8.12 On-prem, configure integrations and create custom integrations. * [Change the Docker image in an integration or script](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.12/configure-cortex-xsoar/integrations/change-the-docker-image-in-an-integration-or-script.md): In Cortex XSOAR 8.12 On-prem, change Docker images for integrations and scripts. * [Connect your engine to an image registry](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.12/configure-cortex-xsoar/integrations/change-the-docker-image-in-an-integration-or-script/connect-your-engine-to-an-image-registry.md): In Cortex XSOAR 8.12 On-prem, connect an engine to an authenticated image registry. * [Pull images from a private image registry](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.12/configure-cortex-xsoar/integrations/change-the-docker-image-in-an-integration-or-script/pull-images-from-a-private-image-registry.md): In Cortex XSOAR 8.12 On-prem, pull Docker images from a private registry. * [Manage credentials](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.12/configure-cortex-xsoar/integrations/manage-credentials.md): In Cortex XSOAR 8.12 On-prem, manage credentials for integration instances. * [Configure an external credentials vault](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.12/configure-cortex-xsoar/integrations/manage-credentials/configure-an-external-credentials-vault.md): In Cortex XSOAR 8.12 On-prem, configure an external credentials vault. * [Add an integration instance](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.12/configure-cortex-xsoar/integrations/add-an-integration-instance.md): In Cortex XSOAR 8.12 On-prem, add integration instances and ingest incidents or indicators. * [Fetch incidents from an integration instance](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.12/configure-cortex-xsoar/integrations/add-an-integration-instance/fetch-incidents-from-an-integration-instance.md): In Cortex XSOAR 8.12 On-prem, configure an integration instance to fetch incidents. * [Receive notifications on an incident fetch error](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.12/configure-cortex-xsoar/integrations/add-an-integration-instance/receive-notifications-on-an-incident-fetch-error.md): In Cortex XSOAR 8.12 On-prem, receive notifications for integration incident fetch errors. * [Configure integration permissions](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.12/configure-cortex-xsoar/integrations/add-an-integration-instance/configure-integration-permissions.md): In Cortex XSOAR 8.12 On-prem, restrict integration commands through role permissions. * [Troubleshoot integrations](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.12/configure-cortex-xsoar/integrations/add-an-integration-instance/troubleshoot-integrations.md): In Cortex XSOAR 8.12 On-prem, troubleshoot integration configuration and runtime issues. * [Integration commands in the CLI](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.12/configure-cortex-xsoar/integrations/integration-commands-in-the-cli.md): In Cortex XSOAR 8.12 On-prem, run integration commands from the CLI. * [Forward requests to long-running integrations](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.12/configure-cortex-xsoar/integrations/forward-requests-to-long-running-integrations.md): In Cortex XSOAR 8.12 On-prem, forward requests to long-running integrations. * [Incident configuration](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.12/configure-cortex-xsoar/incident-configuration.md): In Cortex XSOAR 8.12 On-prem, customize incident workflows, fields, and processing. * [Incident lifecycle](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.12/configure-cortex-xsoar/incident-configuration/incident-lifecycle.md): In Cortex XSOAR 8.12 On-prem, understand incident lifecycle stages and processing. * [Incident Customization](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.12/configure-cortex-xsoar/incident-configuration/incident-customization.md): In Cortex XSOAR 8.12 On-prem, create and edit incident types, fields, and layouts. * [Use incident context data](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.12/configure-cortex-xsoar/incident-configuration/incident-customization/use-incident-context-data.md): In Cortex XSOAR 8.12 On-prem, use context data in incident layouts and fields. * [Create an incident type](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.12/configure-cortex-xsoar/incident-configuration/incident-customization/create-an-incident-type.md): In Cortex XSOAR 8.12 On-prem, create and edit incident types. * [Create an incident field](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.12/configure-cortex-xsoar/incident-configuration/incident-customization/create-an-incident-field.md): In Cortex XSOAR 8.12 On-prem, create custom incident fields. * [Incident field trigger scripts](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.12/configure-cortex-xsoar/incident-configuration/incident-customization/create-an-incident-field/incident-field-trigger-scripts.md): In Cortex XSOAR 8.12 On-prem, configure trigger scripts for incident fields. * [Create dynamic fields](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.12/configure-cortex-xsoar/incident-configuration/incident-customization/create-an-incident-field/create-dynamic-fields.md): In Cortex XSOAR 8.12 On-prem, create dynamic incident fields. * [Troubleshoot incident fields](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.12/configure-cortex-xsoar/incident-configuration/incident-customization/create-an-incident-field/troubleshoot-incident-fields.md): In Cortex XSOAR 8.12 On-prem, troubleshoot incident field configuration issues. * [Incident layout customization](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.12/configure-cortex-xsoar/incident-configuration/incident-customization/incident-layout-customization.md): In Cortex XSOAR 8.12 On-prem, customize incident layouts to show relevant information. * [Create an evidence field](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.12/configure-cortex-xsoar/incident-configuration/create-an-evidence-field.md): In Cortex XSOAR 8.12 On-prem, create custom evidence fields. * [Classification and mapping](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.12/configure-cortex-xsoar/incident-configuration/classification-and-mapping.md): In Cortex XSOAR 8.12 On-prem, classify and map integration instances. * [Create an incident classifier](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.12/configure-cortex-xsoar/incident-configuration/classification-and-mapping/create-an-incident-classifier.md): In Cortex XSOAR 8.12 On-prem, create incident classifiers for integration ingestion. * [Create an incident mapper](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.12/configure-cortex-xsoar/incident-configuration/classification-and-mapping/create-an-incident-mapper.md): In Cortex XSOAR 8.12 On-prem, create and apply incident mappers. * [Set up incident mirroring](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.12/configure-cortex-xsoar/incident-configuration/set-up-incident-mirroring.md): In Cortex XSOAR 8.12 On-prem, configure integrations to mirror incidents. * [Incident deduplication in Cortex XSOAR](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.12/configure-cortex-xsoar/incident-configuration/incident-deduplication-in-cortex-xsoar.md): In Cortex XSOAR 8.12 On-prem, deduplicate incidents using rules or playbooks. * [Pre-process rules](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.12/configure-cortex-xsoar/incident-configuration/pre-process-rules.md): In Cortex XSOAR 8.12 On-prem, create pre-process rules for ingested incidents. * [Use post-processing scripts in an incident](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.12/configure-cortex-xsoar/incident-configuration/use-post-processing-scripts-in-an-incident.md): In Cortex XSOAR 8.12 On-prem, run post-processing scripts before incident closure. * [Customize incident close reasons](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.12/configure-cortex-xsoar/incident-configuration/customize-incident-close-reasons.md): In Cortex XSOAR 8.12 On-prem, customize incident close reasons through server configuration. * [Configure inline value fields](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.12/configure-cortex-xsoar/incident-configuration/configure-inline-value-fields.md): In Cortex XSOAR 8.12 On-prem, configure inline value fields in incident layouts. * [Configure incident export and delete](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.12/configure-cortex-xsoar/incident-configuration/configure-incident-export-and-delete.md): In Cortex XSOAR 8.12 On-prem, export and delete incidents using external storage. * [Configure access to external storage](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.12/configure-cortex-xsoar/incident-configuration/configure-incident-export-and-delete/configure-access-to-external-storage.md): In Cortex XSOAR 8.12 On-prem, configure external storage for incident exports. * [Schedule incident export and delete](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.12/configure-cortex-xsoar/incident-configuration/configure-incident-export-and-delete/schedule-incident-export-and-delete.md): Schedule incident exports and deletions to external storage in Cortex XSOAR 8.12 On-prem. * [Export an incident to CSV using the UTF8-BOM format](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.12/configure-cortex-xsoar/incident-configuration/export-an-incident-to-csv-using-the-utf8-bom-format.md): In Cortex XSOAR 8.12 On-prem, export incidents to UTF8-BOM CSV files. * [Amazon S3 configuration example](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.12/configure-cortex-xsoar/incident-configuration/amazon-s3-configuration-example.md): In Cortex XSOAR 8.12 On-prem, configure Amazon S3 for backups and incident exports. * [Playbooks](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.12/configure-cortex-xsoar/playbooks.md): In Cortex XSOAR 8.12 On-prem, build playbooks that automate security operations workflows. * [What is a playbook?](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.12/configure-cortex-xsoar/playbooks/what-is-a-playbook.md): In Cortex XSOAR 8.12 On-prem, use playbooks to automate security processes. * [Playbook development checklist](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.12/configure-cortex-xsoar/playbooks/playbook-development-checklist.md): In Cortex XSOAR 8.12 On-prem, follow the playbook development checklist. * [Plan your playbook](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.12/configure-cortex-xsoar/playbooks/plan-your-playbook.md): In Cortex XSOAR 8.12 On-prem, plan a playbook for your security workflow. * [Develop your playbook](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.12/configure-cortex-xsoar/playbooks/develop-your-playbook.md): In Cortex XSOAR 8.12 On-prem, create or customize playbooks. * [Task 1. Choose from existing playbooks or create your own](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.12/configure-cortex-xsoar/playbooks/develop-your-playbook/task-1.-choose-from-existing-playbooks-or-create-your-own.md): In Cortex XSOAR 8.12 On-prem, choose an existing playbook or create one. * [Task 2. Configure playbook settings](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.12/configure-cortex-xsoar/playbooks/develop-your-playbook/task-2.-configure-playbook-settings.md): In Cortex XSOAR 8.12 On-prem, configure playbook settings. * [Task 3. Add tasks](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.12/configure-cortex-xsoar/playbooks/develop-your-playbook/task-3.-add-tasks.md): In Cortex XSOAR 8.12 On-prem, add tasks to a playbook. * [Set playbook inputs and outputs](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.12/configure-cortex-xsoar/playbooks/develop-your-playbook/task-3.-add-tasks/set-playbook-inputs-and-outputs.md): In Cortex XSOAR 8.12 On-prem, set playbook task inputs and outputs. * [Create a section header](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.12/configure-cortex-xsoar/playbooks/develop-your-playbook/task-3.-add-tasks/create-a-section-header.md): In Cortex XSOAR 8.12 On-prem, create section headers in playbooks. * [Create a standard task](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.12/configure-cortex-xsoar/playbooks/develop-your-playbook/task-3.-add-tasks/create-a-standard-task.md): In Cortex XSOAR 8.12 On-prem, create standard playbook tasks. * [Create a conditional task](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.12/configure-cortex-xsoar/playbooks/develop-your-playbook/task-3.-add-tasks/create-a-conditional-task.md): In Cortex XSOAR 8.12 On-prem, create conditional playbook tasks. * [Create a communication task](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.12/configure-cortex-xsoar/playbooks/develop-your-playbook/task-3.-add-tasks/create-a-communication-task.md): In Cortex XSOAR 8.12 On-prem, create communication tasks in playbooks. * [Configure script error handling in a playbook](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.12/configure-cortex-xsoar/playbooks/develop-your-playbook/task-3.-add-tasks/configure-script-error-handling-in-a-playbook.md): In Cortex XSOAR 8.12 On-prem, configure script error handling in playbooks. * [Task 4. Add custom playbook features](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.12/configure-cortex-xsoar/playbooks/develop-your-playbook/task-4.-add-custom-playbook-features.md): In Cortex XSOAR 8.12 On-prem, add custom features to playbooks. * [Task 5. Test and debug the playbook](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.12/configure-cortex-xsoar/playbooks/develop-your-playbook/task-5.-test-and-debug-the-playbook.md): In Cortex XSOAR 8.12 On-prem, test and debug playbooks. * [Task 6. Manage playbook content](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.12/configure-cortex-xsoar/playbooks/develop-your-playbook/task-6.-manage-playbook-content.md): In Cortex XSOAR 8.12 On-prem, manage playbook content. * [Customize a playbook for a phishing use case example](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.12/configure-cortex-xsoar/playbooks/develop-your-playbook/customize-a-playbook-for-a-phishing-use-case-example.md): In Cortex XSOAR 8.12 On-prem, customize a playbook for phishing investigations. * [Customize your playbook](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.12/configure-cortex-xsoar/playbooks/customize-your-playbook.md): In Cortex XSOAR 8.12 On-prem, customize playbooks with data, scripts, and tasks. * [Customize the SOC name](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.12/configure-cortex-xsoar/playbooks/customize-your-playbook/customize-the-soc-name.md): In Cortex XSOAR 8.12 On-prem, customize the SOC name in communication tasks. * [Configure a sub-playbook](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.12/configure-cortex-xsoar/playbooks/customize-your-playbook/configure-a-sub-playbook.md): In Cortex XSOAR 8.12 On-prem, configure sub-playbooks and loops. * [Filter and transform data](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.12/configure-cortex-xsoar/playbooks/customize-your-playbook/filter-and-transform-data.md): In Cortex XSOAR 8.12 On-prem, filter and transform data in playbooks. * [Transformer considerations, categories, and built-in transformers](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.12/configure-cortex-xsoar/playbooks/customize-your-playbook/filter-and-transform-data/transformer-considerations-categories-and-built-in-transformers.md): In Cortex XSOAR 8.12 On-prem, use built-in transformers in playbooks. * [Extract indicators](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.12/configure-cortex-xsoar/playbooks/customize-your-playbook/extract-indicators.md): In Cortex XSOAR 8.12 On-prem, extract and enrich indicators in playbooks. * [Extend context](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.12/configure-cortex-xsoar/playbooks/customize-your-playbook/extend-context.md): In Cortex XSOAR 8.12 On-prem, extend context with integration and command data. * [Set and update incident fields](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.12/configure-cortex-xsoar/playbooks/customize-your-playbook/set-and-update-incident-fields.md): In Cortex XSOAR 8.12 On-prem, set and update incident fields in playbooks. * [Playbook polling](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.12/configure-cortex-xsoar/playbooks/customize-your-playbook/playbook-polling.md): In Cortex XSOAR 8.12 On-prem, use playbook polling for remote processes. * [Scripts](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.12/configure-cortex-xsoar/playbooks/scripts.md): In Cortex XSOAR 8.12 On-prem, create, edit, and manage automation scripts. * [Use existing scripts](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.12/configure-cortex-xsoar/playbooks/scripts/use-existing-scripts.md): In Cortex XSOAR 8.12 On-prem, use existing scripts in playbooks and the War Room. * [Create a script](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.12/configure-cortex-xsoar/playbooks/scripts/create-a-script.md): In Cortex XSOAR 8.12 On-prem, create and edit automation scripts. * [Debug your playbook](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.12/configure-cortex-xsoar/playbooks/debug-your-playbook.md): In Cortex XSOAR 8.12 On-prem, debug playbooks with breakpoints and task overrides. * [Troubleshoot playbook performance](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.12/configure-cortex-xsoar/playbooks/debug-your-playbook/troubleshoot-playbook-performance.md): In Cortex XSOAR 8.12 On-prem, troubleshoot playbook performance using metadata. * [Manage playbook content](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.12/configure-cortex-xsoar/playbooks/manage-playbook-content.md): In Cortex XSOAR 8.12 On-prem, manage playbook content and versions. * [Playbook best practices](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.12/configure-cortex-xsoar/playbooks/best-practices.md): In Cortex XSOAR 8.12 On-prem, follow playbook development best practices. * [Lists](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.12/configure-cortex-xsoar/lists.md): In Cortex XSOAR 8.12 On-prem, create and manage lists for playbooks and scripts. * [What is a list?](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.12/configure-cortex-xsoar/lists/what-is-a-list.md): In Cortex XSOAR 8.12 On-prem, create and manage lists. * [Create a list](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.12/configure-cortex-xsoar/lists/create-a-list.md): In Cortex XSOAR 8.12 On-prem, create lists for playbooks, scripts, and the CLI. * [List commands](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.12/configure-cortex-xsoar/lists/list-commands.md): In Cortex XSOAR 8.12 On-prem, use list commands in the CLI, playbooks, and scripts. * [Use cases: JSON lists](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.12/configure-cortex-xsoar/lists/use-cases-json-lists.md): In Cortex XSOAR 8.12 On-prem, manage JSON lists for automations and playbooks. * [Transform a list into an array](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.12/configure-cortex-xsoar/lists/transform-a-list-into-an-array.md): In Cortex XSOAR 8.12 On-prem, transform a list into an array for tasks and integrations. * [Jobs](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.12/configure-cortex-xsoar/jobs.md): In Cortex XSOAR 8.12 On-prem, create scheduled and event-triggered jobs for playbooks. * [Manage jobs](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.12/configure-cortex-xsoar/jobs/manage-jobs.md): In Cortex XSOAR 8.12 On-prem, manage time-triggered and feed-triggered playbook jobs. * [Create a time triggered job](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.12/configure-cortex-xsoar/jobs/create-a-time-triggered-job.md): In Cortex XSOAR 8.12 On-prem, create time-triggered and feed-triggered playbook jobs. * [Create a job triggered by a delta in a feed](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.12/configure-cortex-xsoar/jobs/create-a-job-triggered-by-a-delta-in-a-feed.md): In Cortex XSOAR 8.12 On-prem, create a job triggered by feed content changes. * [Create jobs to process indicators example](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.12/configure-cortex-xsoar/jobs/create-jobs-to-process-indicators-example.md): In Cortex XSOAR 8.12 On-prem, create jobs that process and export indicators. * [SLAs](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.12/configure-cortex-xsoar/slas.md): In Cortex XSOAR 8.12 On-prem, configure SLAs to manage investigation goals and deadlines. * [SLAs in Cortex XSOAR](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.12/configure-cortex-xsoar/slas/slas-in-cortex-xsoar.md): In Cortex XSOAR 8.12 On-prem, use SLA fields to track deadlines and trigger actions. * [Configure an SLA in an incident type](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.12/configure-cortex-xsoar/slas/configure-an-sla-in-an-incident-type.md): In Cortex XSOAR 8.12 On-prem, add SLA time and date fields to incident types. * [Configure Timer/SLA fields](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.12/configure-cortex-xsoar/slas/configure-timersla-fields.md): In Cortex XSOAR 8.12 On-prem, configure timer and SLA fields with trigger scripts. * [Configure a playbook to run Timers/SLAs](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.12/configure-cortex-xsoar/slas/configure-a-playbook-to-run-timersslas.md): In Cortex XSOAR 8.12 On-prem, configure playbooks to run SLA timers. * [Automate changes to incident fields using SLA scripts](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.12/configure-cortex-xsoar/slas/automate-changes-to-incident-fields-using-sla-scripts.md): In Cortex XSOAR 8.12 On-prem, use SLA scripts to automate incident field changes. * [Create SLA scripts](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.12/configure-cortex-xsoar/slas/create-sla-scripts.md): In Cortex XSOAR 8.12 On-prem, create SLA scripts for breached deadlines. * [Use SLA and Timer field commands manually in the CLI](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.12/configure-cortex-xsoar/slas/use-sla-and-timer-field-commands-manually-in-the-cli.md): In Cortex XSOAR 8.12 On-prem, run SLA and timer field commands from the CLI. * [Configure the Global Risk Threshold](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.12/configure-cortex-xsoar/slas/configure-the-global-risk-threshold.md): In Cortex XSOAR 8.12 On-prem, configure the global SLA risk threshold. * [Search incidents for Timer/SLAs](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.12/configure-cortex-xsoar/slas/search-incidents-for-timerslas.md): In Cortex XSOAR 8.12 On-prem, search incidents by SLA status and timer fields. * [Dashboards and Reports](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.12/configure-cortex-xsoar/dashboards-and-reports.md): In Cortex XSOAR 8.12 On-prem, create, manage, and share dashboards, reports, and widgets. * [Dashboards](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.12/configure-cortex-xsoar/dashboards-and-reports/dashboards.md): In Cortex XSOAR 8.12 On-prem, create, customize, and share dashboards. * [Dashboard actions](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.12/configure-cortex-xsoar/dashboards-and-reports/dashboards/dashboard-actions.md): In Cortex XSOAR 8.12 On-prem, create, import, share, and delete dashboards. * [Manage dashboards](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.12/configure-cortex-xsoar/dashboards-and-reports/dashboards/manage-dashboards.md): In Cortex XSOAR 8.12 On-prem, customize dashboards and add widgets. * [Reports](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.12/configure-cortex-xsoar/dashboards-and-reports/reports.md): In Cortex XSOAR 8.12 On-prem, create, customize, and schedule reports. * [Manage reports](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.12/configure-cortex-xsoar/dashboards-and-reports/reports/manage-reports.md): In Cortex XSOAR 8.12 On-prem, manage reports, widgets, schedules, and time settings. * [Configure the timezone in a report](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.12/configure-cortex-xsoar/dashboards-and-reports/reports/configure-the-timezone-in-a-report.md): In Cortex XSOAR 8.12 On-prem, configure report timezones and time formats. * [Troubleshoot script timeout for reports](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.12/configure-cortex-xsoar/dashboards-and-reports/reports/troubleshoot-script-timeout-for-reports.md): In Cortex XSOAR 8.12 On-prem, configure report script timeout values. * [Troubleshoot overlapping text and extra pages](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.12/configure-cortex-xsoar/dashboards-and-reports/reports/troubleshoot-overlapping-text-and-extra-pages.md): In Cortex XSOAR 8.12 On-prem, fix overlapping text and extra PDF report pages. * [Widgets](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.12/configure-cortex-xsoar/dashboards-and-reports/widgets.md): In Cortex XSOAR 8.12 On-prem, create and edit dashboard and report widgets. * [Widget customization](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.12/configure-cortex-xsoar/dashboards-and-reports/widgets/widget-customization.md): In Cortex XSOAR 8.12 On-prem, customize widgets for dashboards and reports. * [Create a widget using the widget builder](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.12/configure-cortex-xsoar/dashboards-and-reports/widgets/create-a-widget-using-the-widget-builder.md): In Cortex XSOAR 8.12 On-prem, use the widget builder for dashboards and reports. * [Create a custom widget using a JSON file](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.12/configure-cortex-xsoar/dashboards-and-reports/widgets/create-a-custom-widget-using-a-json-file.md): In Cortex XSOAR 8.12 On-prem, create custom dashboard and report widgets using JSON. * [Create a custom widget using a script](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.12/configure-cortex-xsoar/dashboards-and-reports/widgets/create-a-custom-widget-using-a-script.md): In Cortex XSOAR 8.12 On-prem, create custom dashboard and report widgets using scripts. * [Create a widget from an incident](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.12/configure-cortex-xsoar/dashboards-and-reports/widgets/create-a-widget-from-an-incident.md): In Cortex XSOAR 8.12 On-prem, create custom widgets from incident searches. * [Create a widget from an indicator](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.12/configure-cortex-xsoar/dashboards-and-reports/widgets/create-a-widget-from-an-indicator.md): In Cortex XSOAR 8.12 On-prem, create custom widgets from indicators. * [Edit a widget](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.12/configure-cortex-xsoar/dashboards-and-reports/widgets/edit-a-widget.md): In Cortex XSOAR 8.12 On-prem, edit widgets in the library, dashboards, and reports. * [Add a widget in the War Room](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.12/configure-cortex-xsoar/dashboards-and-reports/widgets/add-a-widget-in-the-war-room.md): In Cortex XSOAR 8.12 On-prem, add script-based widgets in the War Room. * [Saved By Dbot (ROI) Widget](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.12/configure-cortex-xsoar/dashboards-and-reports/widgets/saved-by-dbot-roi-widget.md): In Cortex XSOAR 8.12 On-prem, customize the Saved by Dbot ROI widget. * [Incidents and indicators investigation](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.12/investigate-and-respond-to-threats/incidents-and-indicators-investigation.md): Investigate incidents and indicators that have been ingested into Cortex XSOAR 8.12 On-prem. * [Incidents](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.12/investigate-and-respond-to-threats/incidents-and-indicators-investigation/incidents.md): Incidents are potential security data threats that are ingested or created in Cortex XSOAR 8.12 On-prem for investigation and remediation. * [Incident management](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.12/investigate-and-respond-to-threats/incidents-and-indicators-investigation/incident-management.md): In Cortex XSOAR 8.12 On-prem, view, manage, create, and export incidents. * [Search for incidents](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.12/investigate-and-respond-to-threats/incidents-and-indicators-investigation/incident-management/search-for-incidents.md): In Cortex XSOAR 8.12 On-prem, search incidents and save search queries. * [Create an incident](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.12/investigate-and-respond-to-threats/incidents-and-indicators-investigation/incident-management/create-an-incident.md): In Cortex XSOAR 8.12 On-prem, create incidents manually, through the API, or by import. * [Export incidents](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.12/investigate-and-respond-to-threats/incidents-and-indicators-investigation/incident-management/export-incidents.md): In Cortex XSOAR 8.12 On-prem, export incidents manually or on a schedule. * [Export incidents from the Incidents table](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.12/investigate-and-respond-to-threats/incidents-and-indicators-investigation/incident-management/export-incidents/export-incidents-from-the-incidents-table.md): Export incidents from the Incidents table as Excel, CSV, or JSON files in Cortex XSOAR 8.12 On-prem. * [Export incidents on demand](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.12/investigate-and-respond-to-threats/incidents-and-indicators-investigation/incident-management/export-incidents/export-incidents-on-demand.md): In Cortex XSOAR 8.12 On-prem, export incidents on demand to external storage. * [Investigate an incident](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.12/investigate-and-respond-to-threats/incidents-and-indicators-investigation/investigate-an-incident.md): In Cortex XSOAR 8.12 On-prem, investigate incidents and take remediation actions. * [Retain incidents](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.12/investigate-and-respond-to-threats/incidents-and-indicators-investigation/investigate-an-incident/retain-incidents.md): In Cortex XSOAR 8.12 On-prem, retain up to 1,000 incidents. * [Limit access to investigations using access control](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.12/investigate-and-respond-to-threats/incidents-and-indicators-investigation/investigate-an-incident/limit-access-to-investigations-using-access-control.md): In Cortex XSOAR 8.12 On-prem, limit access to incidents and investigations. * [Incident Tasks](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.12/investigate-and-respond-to-threats/incidents-and-indicators-investigation/investigate-an-incident/incident-tasks.md): In Cortex XSOAR 8.12 On-prem, use playbook and to-do tasks in investigations. * [Use the War Room in an investigation](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.12/investigate-and-respond-to-threats/incidents-and-indicators-investigation/investigate-an-incident/use-the-war-room-in-an-investigation.md): In Cortex XSOAR 8.12 On-prem, use the War Room for real-time incident investigations. * [Schedule a command in the War Room](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.12/investigate-and-respond-to-threats/incidents-and-indicators-investigation/investigate-an-incident/schedule-a-command-in-the-war-room.md): In Cortex XSOAR 8.12 On-prem, schedule commands from the War Room. * [Run commands in the CLI](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.12/investigate-and-respond-to-threats/incidents-and-indicators-investigation/investigate-an-incident/run-commands-in-the-cli.md): In Cortex XSOAR 8.12 On-prem, run system, integration, and script commands from the CLI. * [Evidence Handling](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.12/investigate-and-respond-to-threats/incidents-and-indicators-investigation/investigate-an-incident/evidence-handling.md): In Cortex XSOAR 8.12 On-prem, add and manage investigation evidence from the War Room. * [Use the Work Plan in an investigation](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.12/investigate-and-respond-to-threats/incidents-and-indicators-investigation/investigate-an-incident/use-the-work-plan-in-an-investigation.md): In Cortex XSOAR 8.12 On-prem, use the Work Plan to manage playbook workflows. * [Add ad hoc tasks to a Work Plan as part of your investigation](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.12/investigate-and-respond-to-threats/incidents-and-indicators-investigation/investigate-an-incident/use-the-work-plan-in-an-investigation/add-ad-hoc-tasks-to-a-work-plan-as-part-of-your-investigation.md): In Cortex XSOAR 8.12 On-prem, add ad hoc tasks to an investigation Work Plan. * [Investigate an incident using the canvas](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.12/investigate-and-respond-to-threats/incidents-and-indicators-investigation/investigate-an-incident/investigate-an-incident-using-the-canvas.md): In Cortex XSOAR 8.12 On-prem, visually map incidents using the investigation canvas. * [Link incidents](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.12/investigate-and-respond-to-threats/incidents-and-indicators-investigation/investigate-an-incident/link-incidents.md): In Cortex XSOAR 8.12 On-prem, link related incidents from the UI or CLI. * [Create an incident summary report](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.12/investigate-and-respond-to-threats/incidents-and-indicators-investigation/investigate-an-incident/create-an-incident-summary-report.md): In Cortex XSOAR 8.12 On-prem, create and save incident summary report templates. * [Manage indicators](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.12/investigate-and-respond-to-threats/incidents-and-indicators-investigation/manage-indicators.md): In Cortex XSOAR 8.12 On-prem, create, edit, search, export, and delete indicators. * [Query indicators](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.12/investigate-and-respond-to-threats/incidents-and-indicators-investigation/manage-indicators/query-indicators.md): In Cortex XSOAR 8.12 On-prem, query indicators in the threat intel library. * [View indicator relationships in an investigation](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.12/investigate-and-respond-to-threats/incidents-and-indicators-investigation/manage-indicators/view-indicator-relationships-in-an-investigation.md): In Cortex XSOAR 8.12 On-prem, create and use indicator relationships during investigations. * [Threat Intel Management](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.12/investigate-and-respond-to-threats/threat-intel-management.md): In Cortex XSOAR 8.12 On-prem, manage indicators, relationships, enrichment, layouts, and TIM reports. * [Get started with Threat Intel Management](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.12/investigate-and-respond-to-threats/threat-intel-management/get-started-with-threat-intel-management.md): In Cortex XSOAR 8.12 On-prem, get started with Threat Intel Management investigations. * [What is Threat Intel Management?](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.12/investigate-and-respond-to-threats/threat-intel-management/get-started-with-threat-intel-management/what-is-threat-intel-management.md): In Cortex XSOAR 8.12 On-prem, learn about Threat Intel Management and its use cases. * [Threat Intel Management use cases](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.12/investigate-and-respond-to-threats/threat-intel-management/get-started-with-threat-intel-management/threat-intel-management-use-cases.md): In Cortex XSOAR 8.12 On-prem, explore Threat Intel Management use cases for analysts. * [Indicator concepts](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.12/investigate-and-respond-to-threats/threat-intel-management/get-started-with-threat-intel-management/indicator-concepts.md): In Cortex XSOAR 8.12 On-prem, learn core indicator concepts. * [Indicator lifecycle](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.12/investigate-and-respond-to-threats/threat-intel-management/get-started-with-threat-intel-management/indicator-lifecycle.md): In Cortex XSOAR 8.12 On-prem, understand the indicator lifecycle for investigation and remediation. * [Roles and responsibilities in Threat Intel Management](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.12/investigate-and-respond-to-threats/threat-intel-management/get-started-with-threat-intel-management/roles-and-responsibilities-in-threat-intel-management.md): In Cortex XSOAR 8.12 On-prem, understand Threat Intel Management roles and responsibilities. * [Indicator configuration](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.12/investigate-and-respond-to-threats/threat-intel-management/indicator-configuration.md): In Cortex XSOAR 8.12 On-prem, configure indicator types, fields, layouts, and extraction. * [Customize indicator types, fields, and layouts](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.12/investigate-and-respond-to-threats/threat-intel-management/indicator-configuration/customize-indicator-types-fields-and-layouts.md): In Cortex XSOAR 8.12 On-prem, customize indicator types, fields, and layouts. * [Create an indicator type](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.12/investigate-and-respond-to-threats/threat-intel-management/indicator-configuration/customize-indicator-types-fields-and-layouts/create-an-indicator-type.md): In Cortex XSOAR 8.12 On-prem, create custom indicator types. * [Indicator type profile](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.12/investigate-and-respond-to-threats/threat-intel-management/indicator-configuration/customize-indicator-types-fields-and-layouts/create-an-indicator-type/indicator-type-profile.md): In Cortex XSOAR 8.12 On-prem, configure indicator type profiles. * [File indicators](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.12/investigate-and-respond-to-threats/threat-intel-management/indicator-configuration/customize-indicator-types-fields-and-layouts/create-an-indicator-type/file-indicators.md): In Cortex XSOAR 8.12 On-prem, configure file indicators. * [Formatting scripts](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.12/investigate-and-respond-to-threats/threat-intel-management/indicator-configuration/customize-indicator-types-fields-and-layouts/create-an-indicator-type/formatting-scripts.md): In Cortex XSOAR 8.12 On-prem, use formatting scripts for indicators. * [Enhancement scripts](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.12/investigate-and-respond-to-threats/threat-intel-management/indicator-configuration/customize-indicator-types-fields-and-layouts/create-an-indicator-type/enhancement-scripts.md): In Cortex XSOAR 8.12 On-prem, use enhancement scripts for indicators. * [Reputation scripts](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.12/investigate-and-respond-to-threats/threat-intel-management/indicator-configuration/customize-indicator-types-fields-and-layouts/create-an-indicator-type/reputation-scripts.md): In Cortex XSOAR 8.12 On-prem, use reputation scripts for indicators. * [Reputation commands](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.12/investigate-and-respond-to-threats/threat-intel-management/indicator-configuration/customize-indicator-types-fields-and-layouts/create-an-indicator-type/reputation-commands.md): In Cortex XSOAR 8.12 On-prem, configure reputation commands for indicators. * [Map custom indicator fields](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.12/investigate-and-respond-to-threats/threat-intel-management/indicator-configuration/customize-indicator-types-fields-and-layouts/create-an-indicator-type/map-custom-indicator-fields.md): In Cortex XSOAR 8.12 On-prem, map custom indicator fields. * [Create an indicator field](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.12/investigate-and-respond-to-threats/threat-intel-management/indicator-configuration/customize-indicator-types-fields-and-layouts/create-an-indicator-field.md): In Cortex XSOAR 8.12 On-prem, create custom indicator fields. * [Indicator fields structure](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.12/investigate-and-respond-to-threats/threat-intel-management/indicator-configuration/customize-indicator-types-fields-and-layouts/create-an-indicator-field/indicator-fields-structure.md): In Cortex XSOAR 8.12 On-prem, understand indicator field structure. * [Indicator field trigger scripts](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.12/investigate-and-respond-to-threats/threat-intel-management/indicator-configuration/customize-indicator-types-fields-and-layouts/create-an-indicator-field/indicator-field-trigger-scripts.md): In Cortex XSOAR 8.12 On-prem, configure trigger scripts for indicator fields. * [Indicator layout customization](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.12/investigate-and-respond-to-threats/threat-intel-management/indicator-configuration/customize-indicator-types-fields-and-layouts/create-an-indicator-field/indicator-layout-customization.md): In Cortex XSOAR 8.12 On-prem, customize indicator layouts. * [Indicator classification and mapping](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.12/investigate-and-respond-to-threats/threat-intel-management/indicator-configuration/indicator-classification-and-mapping.md): In Cortex XSOAR 8.12 On-prem, classify and map indicators. * [Indicator extraction](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.12/investigate-and-respond-to-threats/threat-intel-management/indicator-configuration/indicator-extraction.md): In Cortex XSOAR 8.12 On-prem, extract and enrich indicators from incident fields. * [Indicator extraction modes](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.12/investigate-and-respond-to-threats/threat-intel-management/indicator-configuration/indicator-extraction/indicator-extraction-modes.md): In Cortex XSOAR 8.12 On-prem, configure indicator extraction modes. * [Create indicator extraction rules for an incident type](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.12/investigate-and-respond-to-threats/threat-intel-management/indicator-configuration/indicator-extraction/create-indicator-extraction-rules-for-an-incident-type.md): In Cortex XSOAR 8.12 On-prem, create indicator extraction rules for incident types. * [Set the indicator extraction mode for a playbook task](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.12/investigate-and-respond-to-threats/threat-intel-management/indicator-configuration/indicator-extraction/set-the-indicator-extraction-mode-for-a-playbook-task.md): In Cortex XSOAR 8.12 On-prem, set indicator extraction modes for playbook tasks. * [Disable indicator extraction for scripts or integrations](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.12/investigate-and-respond-to-threats/threat-intel-management/indicator-configuration/indicator-extraction/disable-indicator-extraction-for-scripts-or-integrations.md): In Cortex XSOAR 8.12 On-prem, disable indicator extraction for scripts and integrations. * [Troubleshoot indicator extraction](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.12/investigate-and-respond-to-threats/threat-intel-management/indicator-configuration/indicator-extraction/troubleshoot-indicator-extraction.md): In Cortex XSOAR 8.12 On-prem, troubleshoot indicator extraction issues. * [Configure the indicator timeline](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.12/investigate-and-respond-to-threats/threat-intel-management/indicator-configuration/configure-the-indicator-timeline.md): In Cortex XSOAR 8.12 On-prem, configure and optimize the indicator timeline. * [Configure indicator expiration](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.12/investigate-and-respond-to-threats/threat-intel-management/indicator-configuration/configure-indicator-expiration.md): In Cortex XSOAR 8.12 On-prem, configure indicator expiration status and defaults. * [Configure Threat Intel feed integrations](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.12/investigate-and-respond-to-threats/threat-intel-management/indicator-configuration/configure-threat-intel-feed-integrations.md): In Cortex XSOAR 8.12 On-prem, configure Threat Intel feed integrations. * [Exclude indicators from enrichment](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.12/investigate-and-respond-to-threats/threat-intel-management/indicator-configuration/exclude-indicators-from-enrichment.md): In Cortex XSOAR 8.12 On-prem, exclude indicators from enrichment. * [Configure Threat Intelligence Management playbooks to process indicators](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.12/investigate-and-respond-to-threats/threat-intel-management/indicator-configuration/configure-threat-intelligence-management-playbooks-to-process-indicators.md): In Cortex XSOAR 8.12 On-prem, configure TIM playbooks to process indicators. * [Export indicators](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.12/investigate-and-respond-to-threats/threat-intel-management/export-indicators.md): In Cortex XSOAR 8.12 On-prem, export indicators through tables, integrations, playbooks, and EDLs. * [Customize Threat Intel Reports](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.12/investigate-and-respond-to-threats/threat-intel-management/customize-threat-intel-reports.md): In Cortex XSOAR 8.12 On-prem, configure and customize Threat Intel Report types. * [Create a Threat Intel Report type](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.12/investigate-and-respond-to-threats/threat-intel-management/customize-threat-intel-reports/create-a-threat-intel-report-type.md): In Cortex XSOAR 8.12 On-prem, create or detach Threat Intel Report types. * [Create a Threat Intel Report field](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.12/investigate-and-respond-to-threats/threat-intel-management/customize-threat-intel-reports/create-a-threat-intel-report-field.md): In Cortex XSOAR 8.12 On-prem, create Threat Intel Report fields and layouts. * [Create a Threat Intel Report layout](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.12/investigate-and-respond-to-threats/threat-intel-management/customize-threat-intel-reports/create-a-threat-intel-report-layout.md): In Cortex XSOAR 8.12 On-prem, configure Threat Intel Report layouts and script content. * [Indicator management](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.12/investigate-and-respond-to-threats/threat-intel-management/indicator-management.md): In Cortex XSOAR 8.12 On-prem, create, edit, search, export, and delete threat indicators. * [Query indicators](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.12/investigate-and-respond-to-threats/threat-intel-management/indicator-management/query-indicators.md): In Cortex XSOAR 8.12 On-prem, query indicators in the threat intel library. * [Indicator investigation](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.12/investigate-and-respond-to-threats/threat-intel-management/indicator-investigation.md): In Cortex XSOAR 8.12 On-prem, investigate indicators, reports, and relationships with TIM. * [Indicator verdict](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.12/investigate-and-respond-to-threats/threat-intel-management/indicator-investigation/indicator-verdict.md): In Cortex XSOAR 8.12 On-prem, manage indicator verdicts, types, layouts, and exclusion lists. * [Extract and enrich an indicator](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.12/investigate-and-respond-to-threats/threat-intel-management/indicator-investigation/extract-and-enrich-an-indicator.md): In Cortex XSOAR 8.12 On-prem, extract and enrich indicators. * [Expire an indicator](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.12/investigate-and-respond-to-threats/threat-intel-management/indicator-investigation/expire-an-indicator.md): In Cortex XSOAR 8.12 On-prem, expire indicators from the CLI or UI. * [Manage indicator relationships](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.12/investigate-and-respond-to-threats/threat-intel-management/indicator-investigation/manage-indicator-relationships.md): In Cortex XSOAR 8.12 On-prem, create and manage indicator relationships. * [Delete and exclude indicators](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.12/investigate-and-respond-to-threats/threat-intel-management/indicator-investigation/delete-and-exclude-indicators.md): In Cortex XSOAR 8.12 On-prem, delete indicators and manage exclusion lists. * [Manage Threat Intel Reports](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.12/investigate-and-respond-to-threats/threat-intel-management/manage-threat-intel-reports.md): In Cortex XSOAR 8.12 On-prem, manage Threat Intel Reports. * [Troubleshoot](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.12/troubleshoot-and-reference/troubleshoot.md): In Cortex XSOAR 8.12 On-prem, troubleshoot system errors and operational issues. * [View system status in the System Diagnostics page](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.12/troubleshoot-and-reference/troubleshoot/view-system-status-in-the-system-diagnostics-page.md): In Cortex XSOAR 8.12 On-prem, view errors and system status in System Diagnostics. * [View Guard Rails warnings and errors](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.12/troubleshoot-and-reference/troubleshoot/view-guard-rails-warnings-and-errors.md): In Cortex XSOAR 8.12 On-prem, review Guard Rails warnings and errors affecting performance. * [Access logs and log bundles](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.12/troubleshoot-and-reference/troubleshoot/access-logs-and-log-bundles.md): In Cortex XSOAR 8.12 On-prem, access logs and download troubleshooting log bundles. * [Management audit logs](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.12/troubleshoot-and-reference/troubleshoot/management-audit-logs.md): In Cortex XSOAR 8.12 On-prem, view, export, extract, and purge management audit logs. * [Manage syslog servers](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.12/troubleshoot-and-reference/troubleshoot/manage-syslog-servers.md): In Cortex XSOAR 8.12 On-prem, add and configure syslog servers. * [Configure log and notification forwarding](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.12/troubleshoot-and-reference/troubleshoot/configure-log-and-notification-forwarding.md): In Cortex XSOAR 8.12 On-prem, forward audit, integration, and Guard Rails logs. * [Integration logs](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.12/troubleshoot-and-reference/troubleshoot/integration-logs.md): In Cortex XSOAR 8.12 On-prem, view and export integration logs for troubleshooting. * [Reference](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.12/troubleshoot-and-reference/reference.md): In Cortex XSOAR 8.12 On-prem, access product reference and configuration information. * [Cortex XSOAR concepts](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.12/troubleshoot-and-reference/reference/cortex-xsoar-concepts.md): In Cortex XSOAR 8.12 On-prem, learn common product concepts. * [How to search in Cortex XSOAR](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.12/troubleshoot-and-reference/reference/how-to-search-in-cortex-xsoar.md): In Cortex XSOAR 8.12 On-prem, search using Lucene syntax and product search tools. * [How to use markdown in Cortex XSOAR](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.12/troubleshoot-and-reference/reference/how-to-use-markdown-in-cortex-xsoar.md): In Cortex XSOAR 8.12 On-prem, use markdown for text formatting. * [User details and preferences](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.12/troubleshoot-and-reference/reference/user-details-and-preferences.md): In Cortex XSOAR 8.12 On-prem, manage user details, preferences, and notifications. * [Server configurations](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.12/troubleshoot-and-reference/reference/server-configurations.md): In Cortex XSOAR 8.12 On-prem, customize and troubleshoot server configuration settings. * [New user FAQ](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.12/troubleshoot-and-reference/reference/new-user-faq.md): In Cortex XSOAR 8.12 On-prem, find answers to common new-user questions. * [Cortex XSOAR API](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.12/troubleshoot-and-reference/reference/cortex-xsoar-api.md): In Cortex XSOAR 8.12 On-prem, generate an API key and make API calls. * [Telemetry in Cortex XSOAR](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.12/troubleshoot-and-reference/reference/telemetry-in-cortex-xsoar.md): In Cortex XSOAR 8.12 On-prem, learn how telemetry data improves the product. * [Keyboard shortcuts](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.12/troubleshoot-and-reference/reference/keyboard-shortcuts.md): In Cortex XSOAR 8.12 On-prem, use keyboard shortcuts across product pages. * [Product support lifecycle](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.12/troubleshoot-and-reference/reference/product-support-lifecycle.md): In Cortex XSOAR 8.12 On-prem, review the product support lifecycle. * [Cortex XSOAR navigation cheat sheet](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.12/troubleshoot-and-reference/reference/cortex-xsoar-navigation-cheat-sheet.md): In Cortex XSOAR 8.12 On-prem, navigate commonly used product features. * [What is Cortex XSOAR multi-tenant?](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.12/multi-tenant/what-is-cortex-xsoar-multi-tenant.md): Learn about Cortex XSOAR 8.12 On-prem multi-tenant deployments that provide data segregation while enabling you to manage multiple tenants from a main tenant. * [Onboard Cortex XSOAR multi-tenant](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.12/multi-tenant/onboard-cortex-xsoar-multi-tenant.md): In Cortex XSOAR 8.12 On-prem, install, pair, and manage main and child tenants. * [Onboarding checklist for multi-tenant deployments](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.12/multi-tenant/onboard-cortex-xsoar-multi-tenant/onboarding-checklist-for-multi-tenant-deployments.md): In Cortex XSOAR 8.12 On-prem, follow the multi-tenant and MSSP onboarding checklist. * [Step 1. Install Cortex XSOAR for multi-tenant](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.12/multi-tenant/onboard-cortex-xsoar-multi-tenant/step-1.-install-cortex-xsoar-for-multi-tenant.md): In Cortex XSOAR 8.12 On-prem, install a multi-tenant deployment and add a license. * [Step 2. Pair child tenant to main tenant](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.12/multi-tenant/onboard-cortex-xsoar-multi-tenant/step-2.-pair-child-tenant-to-main-tenant.md): In Cortex XSOAR 8.12 On-prem, pair a child tenant with its main tenant. * [Step 3. Set up an engine](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.12/multi-tenant/onboard-cortex-xsoar-multi-tenant/step-3.-set-up-an-engine.md): In Cortex XSOAR 8.12 On-prem, install engines and configure tenant network access. * [Step 4. Set up users and roles](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.12/multi-tenant/onboard-cortex-xsoar-multi-tenant/step-4.-set-up-users-and-roles.md): In Cortex XSOAR 8.12 On-prem, configure multi-tenant users, roles, and SAML authentication. * [Step 5. Install and configure content](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.12/multi-tenant/onboard-cortex-xsoar-multi-tenant/step-5.-install-and-configure-content.md): In Cortex XSOAR 8.12 On-prem, install and configure multi-tenant and MSSP content. * [Child tenant management](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.12/multi-tenant/child-tenant-management.md): In Cortex XSOAR 8.12 On-prem, manage child tenants and their content centrally. * [Content management in multi-tenant](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.12/multi-tenant/child-tenant-management/content-management-in-multi-tenant.md): In Cortex XSOAR 8.12 On-prem, distribute content to child tenants with propagation labels. * [Add propagation labels to content](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.12/multi-tenant/child-tenant-management/content-management-in-multi-tenant/add-propagation-labels-to-content.md): In Cortex XSOAR 8.12 On-prem, add propagation labels to multi-tenant content. * [Add propagation labels to a child tenant](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.12/multi-tenant/child-tenant-management/content-management-in-multi-tenant/add-propagation-labels-to-a-child-tenant.md): In Cortex XSOAR 8.12 On-prem, add propagation labels to child tenants. * [Sync content to child tenants](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.12/multi-tenant/child-tenant-management/content-management-in-multi-tenant/sync-content-to-child-tenants.md): In Cortex XSOAR 8.12 On-prem, sync content from the main tenant to child tenants. * [Manage content using a remote repository](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.12/multi-tenant/child-tenant-management/content-management-in-multi-tenant/manage-content-using-a-remote-repository.md): In Cortex XSOAR 8.12 On-prem, manage multi-tenant content using a remote repository. * [Incident management on the main tenant](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.12/multi-tenant/incident-management-on-the-main-tenant.md): In Cortex XSOAR 8.12 On-prem, manage incidents and take action across child tenants. * [Run a command on multiple tenants](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.12/multi-tenant/incident-management-on-the-main-tenant/run-a-command-on-multiple-tenants.md): In Cortex XSOAR 8.12 On-prem, run commands across incidents on multiple tenants. * [Indicator management on the main tenant](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.12/multi-tenant/indicator-management-on-the-main-tenant.md): In Cortex XSOAR 8.12 On-prem, view and act on indicators from the main tenant. - [Navigate the Cortex XSOAR 8.11 On-prem docs](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.11/learn-about-cortex-xsoar/readme.md): Start here for a visual overview of Cortex XSOAR 8.11 On-prem documentation. - [Get Started with Cortex XSOAR](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.11/learn-about-cortex-xsoar/get-started-with-cortex-xsoar.md): Get started with Cortex XSOAR 8.11 On-prem, including architecture, roles, responsibilities, and licenses. - [What is Cortex XSOAR?](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.11/learn-about-cortex-xsoar/get-started-with-cortex-xsoar/what-is-cortex-xsoar.md): Learn about features in Cortex XSOAR 8.11 On-prem. - [Cortex XSOAR architecture](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.11/learn-about-cortex-xsoar/get-started-with-cortex-xsoar/cortex-xsoar-architecture.md): Explore the Cortex XSOAR 8.11 On-prem architecture. - [Cortex XSOAR use cases](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.11/learn-about-cortex-xsoar/get-started-with-cortex-xsoar/cortex-xsoar-use-cases.md): Explore SOC automation use cases in Cortex XSOAR 8.11 On-prem. - [Understand Cortex XSOAR licenses](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.11/learn-about-cortex-xsoar/get-started-with-cortex-xsoar/understand-cortex-xsoar-licenses.md): Understand licenses for Cortex XSOAR 8.11 On-prem. - [Roles and responsibilities](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.11/learn-about-cortex-xsoar/get-started-with-cortex-xsoar/roles-and-responsibilities.md): Learn about core SOC roles in Cortex XSOAR 8.11 On-prem. - [Supported web browsers](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.11/learn-about-cortex-xsoar/get-started-with-cortex-xsoar/supported-web-browsers.md): Review supported web browsers for Cortex XSOAR 8.11 On-prem. - [Onboard and configure Cortex XSOAR](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.11/onboard-cortex-xsoar/onboard-and-configure-cortex-xsoar.md): Follow the steps to onboard and configure Cortex XSOAR 8.11 On-prem. - [Plan your deployment](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.11/onboard-cortex-xsoar/onboard-and-configure-cortex-xsoar/plan-your-deployment.md): Plan deployment and onboarding for Cortex XSOAR 8.11 On-prem. - [Onboarding checklist](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.11/onboard-cortex-xsoar/onboard-and-configure-cortex-xsoar/onboarding-checklist.md): Activate, provision, grant access, and configure Cortex XSOAR 8.11 On-prem. - [Step 1. Install Cortex XSOAR](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.11/onboard-cortex-xsoar/onboard-and-configure-cortex-xsoar/step-1.-install-cortex-xsoar.md): Install Cortex XSOAR 8.11 On-prem, including system requirements and licensing. - [Step 2. Set up an engine](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.11/onboard-cortex-xsoar/onboard-and-configure-cortex-xsoar/step-2.-set-up-an-engine.md): Set up an engine for Cortex XSOAR 8.11 On-prem on a remote machine. - [Step 3. Set up a remote repository](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.11/onboard-cortex-xsoar/onboard-and-configure-cortex-xsoar/step-3.-set-up-a-remote-repository.md): Set up remote repository content management in Cortex XSOAR 8.11 On-prem. - [Step 4. Set up users and roles](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.11/onboard-cortex-xsoar/onboard-and-configure-cortex-xsoar/step-4.-set-up-users-and-roles.md): View permissions and predefined roles in Cortex XSOAR 8.11 On-prem. - [Step 5. Install and configure content](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.11/onboard-cortex-xsoar/onboard-and-configure-cortex-xsoar/step-5.-install-and-configure-content.md): Learn what content includes in Cortex XSOAR 8.11 On-prem. - [What is content?](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.11/onboard-cortex-xsoar/onboard-and-configure-cortex-xsoar/step-5.-install-and-configure-content/what-is-content.md): Learn what content includes in Cortex XSOAR 8.11 On-prem. - [Install content packs](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.11/onboard-cortex-xsoar/onboard-and-configure-cortex-xsoar/step-5.-install-and-configure-content/install-content-packs.md): Install content packs in Cortex XSOAR 8.11 On-prem. - [Set up your use case with the Deployment Wizard](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.11/onboard-cortex-xsoar/onboard-and-configure-cortex-xsoar/step-5.-install-and-configure-content/set-up-your-use-case-with-the-deployment-wizard.md): Use the Deployment Wizard in Cortex XSOAR 8.11 On-prem to adopt a use case. - [Post deployment](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.11/onboard-cortex-xsoar/onboard-and-configure-cortex-xsoar/post-deployment.md): Complete post-deployment configuration in Cortex XSOAR 8.11 On-prem. - [User communication](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.11/onboard-cortex-xsoar/onboard-and-configure-cortex-xsoar/post-deployment/user-communication.md): Configure user communication in Cortex XSOAR 8.11 On-prem. - [Configure user notifications in Cortex XSOAR](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.11/onboard-cortex-xsoar/onboard-and-configure-cortex-xsoar/post-deployment/user-communication/configure-user-notifications-in-cortex-xsoar.md): Configure user notifications in Cortex XSOAR 8.11 On-prem. - [Customize system emails](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.11/onboard-cortex-xsoar/onboard-and-configure-cortex-xsoar/post-deployment/user-communication/customize-system-emails.md): Customize system emails in Cortex XSOAR 8.11 On-prem. - [Configure system settings](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.11/onboard-cortex-xsoar/onboard-and-configure-cortex-xsoar/post-deployment/configure-system-settings.md): Configure system settings in Cortex XSOAR 8.11 On-prem. - [Configure server settings](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.11/onboard-cortex-xsoar/onboard-and-configure-cortex-xsoar/post-deployment/configure-system-settings/configure-server-settings.md): Configure server settings in Cortex XSOAR 8.11 On-prem. - [Configure security settings](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.11/onboard-cortex-xsoar/onboard-and-configure-cortex-xsoar/post-deployment/configure-system-settings/configure-security-settings.md): Configure security settings in Cortex XSOAR 8.11 On-prem. - [Cortex XSOAR Installation](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.11/onboard-cortex-xsoar/cortex-xsoar-installation.md): Install Cortex XSOAR 8.11 On-prem and complete post-installation steps. - [Installation overview](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.11/onboard-cortex-xsoar/cortex-xsoar-installation/installation-overview.md): Review installation options for Cortex XSOAR 8.11 On-prem. - [High Availability for Cortex XSOAR](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.11/onboard-cortex-xsoar/cortex-xsoar-installation/high-availability-for-cortex-xsoar.md): Configure high availability for Cortex XSOAR 8.11 On-prem. - [Load balancing for Cortex XSOAR](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.11/onboard-cortex-xsoar/cortex-xsoar-installation/load-balancing-for-cortex-xsoar.md): Configure load balancing for Cortex XSOAR 8.11 On-prem. - [System Requirements](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.11/onboard-cortex-xsoar/cortex-xsoar-installation/system-requirements.md): Review system requirements for Cortex XSOAR 8.11 On-prem. - [Hardware requirements](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.11/onboard-cortex-xsoar/cortex-xsoar-installation/system-requirements/hardware-requirements.md): Review hardware requirements for Cortex XSOAR 8.11 On-prem. - [Port requirements for cluster communication](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.11/onboard-cortex-xsoar/cortex-xsoar-installation/system-requirements/port-requirements-for-cluster-communication.md): Configure cluster communication ports for Cortex XSOAR 8.11 On-prem. - [URL requirements](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.11/onboard-cortex-xsoar/cortex-xsoar-installation/system-requirements/url-requirements.md): Review required URLs for Cortex XSOAR 8.11 On-prem. - [Bandwidth and NTP requirements](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.11/onboard-cortex-xsoar/cortex-xsoar-installation/system-requirements/bandwidth-and-ntp-requirements.md): Review bandwidth and NTP requirements for Cortex XSOAR 8.11 On-prem. - [Install Cortex XSOAR on a VM deployed on AWS](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.11/onboard-cortex-xsoar/cortex-xsoar-installation/install-cortex-xsoar-on-a-vm-deployed-on-aws.md): Install Cortex XSOAR 8.11 On-prem on a VM deployed on AWS. - [Task 1. Download the OVA Image and license from Cortex Gateway](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.11/onboard-cortex-xsoar/cortex-xsoar-installation/install-cortex-xsoar-on-a-vm-deployed-on-aws/task-1.-download-the-ova-image-and-license-from-cortex-gateway.md): Download the OVA image and license for Cortex XSOAR 8.11 On-prem. - [Task 2. Deploy your virtual machine on AWS](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.11/onboard-cortex-xsoar/cortex-xsoar-installation/install-cortex-xsoar-on-a-vm-deployed-on-aws/task-2.-deploy-your-virtual-machine-on-aws.md): Deploy a Cortex XSOAR 8.11 On-prem virtual machine on AWS. - [Task 3. Validate tenant network and IP settings](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.11/onboard-cortex-xsoar/cortex-xsoar-installation/install-cortex-xsoar-on-a-vm-deployed-on-aws/task-3.-validate-tenant-nework-and-ip-settings.md): Validate tenant network and IP settings for Cortex XSOAR 8.11 On-prem. - [Task 4. Configure NTP servers](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.11/onboard-cortex-xsoar/cortex-xsoar-installation/install-cortex-xsoar-on-a-vm-deployed-on-aws/task-4.-configure-ntp-servers.md): Configure NTP servers for Cortex XSOAR 8.11 On-prem. - [Task 5. (Optional) Configure proxy settings](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.11/onboard-cortex-xsoar/cortex-xsoar-installation/install-cortex-xsoar-on-a-vm-deployed-on-aws/task-5.-optional-configure-proxy-settings.md): Configure proxy settings for Cortex XSOAR 8.11 On-prem. - [Task 6. Establish trust between all nodes in a cluster](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.11/onboard-cortex-xsoar/cortex-xsoar-installation/install-cortex-xsoar-on-a-vm-deployed-on-aws/task-6.-establish-trust-between-all-nodes-in-a-cluster.md): Establish cluster node trust for Cortex XSOAR 8.11 On-prem. - [Task 7. Install Cortex XSOAR on your VM](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.11/onboard-cortex-xsoar/cortex-xsoar-installation/install-cortex-xsoar-on-a-vm-deployed-on-aws/task-7.-install-cortex-xsoar-on-your-vm.md): Install Cortex XSOAR 8.11 On-prem on your virtual machine. - [Task 8. Verify you can log into Cortex XSOAR](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.11/onboard-cortex-xsoar/cortex-xsoar-installation/install-cortex-xsoar-on-a-vm-deployed-on-aws/task-8.-verify-you-can-log-into-cortex-xsoar.md): Verify access to Cortex XSOAR 8.11 On-prem. - [Install Cortex XSOAR on a VM deployed on OCI](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.11/onboard-cortex-xsoar/cortex-xsoar-installation/install-cortex-xsoar-on-a-vm-deployed-on-oci.md): Install Cortex XSOAR 8.11 On-prem on a VM deployed on OCI. - [Task 1. Download the OVA image and license from Cortex Gateway](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.11/onboard-cortex-xsoar/cortex-xsoar-installation/install-cortex-xsoar-on-a-vm-deployed-on-oci/task-1.-download-the-ova-image-and-license-from-cortex-gateway.md): Download the OVA image and license for Cortex XSOAR 8.11 On-prem. - [Task 2. Deploy your virtual machine on OCI](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.11/onboard-cortex-xsoar/cortex-xsoar-installation/install-cortex-xsoar-on-a-vm-deployed-on-oci/task-2.-deploy-your-virtual-machine-on-oci.md): Deploy a Cortex XSOAR 8.11 On-prem virtual machine on OCI. - [Task 3. Validate tenant network and IP settings](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.11/onboard-cortex-xsoar/cortex-xsoar-installation/install-cortex-xsoar-on-a-vm-deployed-on-oci/task-3.-validate-tenant-network-and-ip-settings.md): Validate tenant network and IP settings for Cortex XSOAR 8.11 On-prem. - [Task 4. Configure NTP servers](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.11/onboard-cortex-xsoar/cortex-xsoar-installation/install-cortex-xsoar-on-a-vm-deployed-on-oci/task-4.-configure-ntp-servers.md): Configure NTP servers for Cortex XSOAR 8.11 On-prem. - [Task 5. (Optional) Configure proxy settings](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.11/onboard-cortex-xsoar/cortex-xsoar-installation/install-cortex-xsoar-on-a-vm-deployed-on-oci/task-5.-optional-configure-proxy-settings.md): Configure proxy settings for Cortex XSOAR 8.11 On-prem. - [Task 6. Establish trust between all nodes in a cluster](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.11/onboard-cortex-xsoar/cortex-xsoar-installation/install-cortex-xsoar-on-a-vm-deployed-on-oci/task-6.-establish-trust-between-all-nodes-in-a-cluster.md): Establish cluster node trust for Cortex XSOAR 8.11 On-prem. - [Task 7. Install Cortex XSOAR on your VM](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.11/onboard-cortex-xsoar/cortex-xsoar-installation/install-cortex-xsoar-on-a-vm-deployed-on-oci/task-7.-install-cortex-xsoar-on-your-vm.md): Install Cortex XSOAR 8.11 On-prem on your virtual machine. - [Task 8. Verify you can log into Cortex XSOAR](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.11/onboard-cortex-xsoar/cortex-xsoar-installation/install-cortex-xsoar-on-a-vm-deployed-on-oci/task-8.-verify-you-can-log-into-cortex-xsoar.md): Verify access to Cortex XSOAR 8.11 On-prem. - [Install Cortex XSOAR on a VM deployed on Hyper-V](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.11/onboard-cortex-xsoar/cortex-xsoar-installation/install-cortex-xsoar-on-a-vm-deployed-on-hyper-v.md): Install Cortex XSOAR 8.11 On-prem on a VM deployed on Hyper-V. - [Install Cortex XSOAR on a VM deployed on VSphere](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.11/onboard-cortex-xsoar/cortex-xsoar-installation/install-cortex-xsoar-on-a-vm-deployed-on-vsphere.md): Install Cortex XSOAR 8.11 On-prem on a VM deployed on vSphere. - [Install Cortex XSOAR on a VM deployed on KVM](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.11/onboard-cortex-xsoar/cortex-xsoar-installation/install-cortex-xsoar-on-a-vm-deployed-on-kvm.md): Install Cortex XSOAR 8.11 On-prem on a VM deployed on KVM. - [Task 1. Download the QCOW2 image and license from Cortex Gateway](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.11/onboard-cortex-xsoar/cortex-xsoar-installation/install-cortex-xsoar-on-a-vm-deployed-on-kvm/task-1.-download-the-qcow2-image-and-license-from-cortex-gateway.md): Download the QCOW2 image and license for Cortex XSOAR 8.11 On-prem. - [Task 2. Deploy your virtual machine on KVM](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.11/onboard-cortex-xsoar/cortex-xsoar-installation/install-cortex-xsoar-on-a-vm-deployed-on-kvm/task-2.-deploy-your-virtual-machine-on-kvm.md): Deploy a Cortex XSOAR 8.11 On-prem virtual machine on KVM. - [Task 3. Configure tenant network and IP settings for each node](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.11/onboard-cortex-xsoar/cortex-xsoar-installation/install-cortex-xsoar-on-a-vm-deployed-on-kvm/task-3.-configure-tenant-network-and-ip-settings-for-each-node.md): Configure tenant network and IP settings for Cortex XSOAR 8.11 On-prem. - [Task 4. Configure NTP servers](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.11/onboard-cortex-xsoar/cortex-xsoar-installation/install-cortex-xsoar-on-a-vm-deployed-on-kvm/task-4.-configure-ntp-servers.md): Configure NTP servers for Cortex XSOAR 8.11 On-prem. - [Task 5. (Optional) Configure proxy settings](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.11/onboard-cortex-xsoar/cortex-xsoar-installation/install-cortex-xsoar-on-a-vm-deployed-on-kvm/task-5.-optional-configure-proxy-settings.md): Configure proxy settings for Cortex XSOAR 8.11 On-prem. - [Task 6. Establish trust between all nodes in a cluster](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.11/onboard-cortex-xsoar/cortex-xsoar-installation/install-cortex-xsoar-on-a-vm-deployed-on-kvm/task-6.-establish-trust-between-all-nodes-in-a-cluster.md): Establish cluster node trust for Cortex XSOAR 8.11 On-prem. - [Task 7. Install Cortex XSOAR on your VM](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.11/onboard-cortex-xsoar/cortex-xsoar-installation/install-cortex-xsoar-on-a-vm-deployed-on-kvm/task-7.-install-cortex-xsoar-on-your-vm.md): Install Cortex XSOAR 8.11 On-prem on your virtual machine. - [Task 8. Verify you can log into Cortex XSOAR](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.11/onboard-cortex-xsoar/cortex-xsoar-installation/install-cortex-xsoar-on-a-vm-deployed-on-kvm/task-8.-verify-you-can-log-into-cortex-xsoar.md): Verify access to Cortex XSOAR 8.11 On-prem. - [Post-installation](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.11/onboard-cortex-xsoar/cortex-xsoar-installation/post-installation.md): Complete post-installation tasks for Cortex XSOAR 8.11 On-prem. - [Add the Cortex XSOAR license](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.11/onboard-cortex-xsoar/cortex-xsoar-installation/post-installation/add-the-cortex-xsoar-license.md): Add a license to Cortex XSOAR 8.11 On-prem. - [HTTPS with a signed certificate](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.11/onboard-cortex-xsoar/cortex-xsoar-installation/post-installation/https-with-a-signed-certificate.md): Configure HTTPS with a signed certificate in Cortex XSOAR 8.11 On-prem. - [Use a signed certificate instead of SSL verification](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.11/onboard-cortex-xsoar/cortex-xsoar-installation/post-installation/use-a-signed-certificate-instead-of-ssl-verification.md): Use a signed certificate in Cortex XSOAR 8.11 On-prem for MSSP. - [Optimize performance and robustness from the textual UI](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.11/onboard-cortex-xsoar/cortex-xsoar-installation/post-installation/optimize-performance-and-robustness-from-the-textual-ui.md): Optimize Cortex XSOAR 8.11 On-prem from the VM textual UI. - [Manage your SSH admin password](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.11/onboard-cortex-xsoar/cortex-xsoar-installation/post-installation/manage-your-ssh-admin-password.md): Manage the SSH admin password for Cortex XSOAR 8.11 On-prem. - [Troubleshoot your installation](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.11/onboard-cortex-xsoar/cortex-xsoar-installation/troubleshoot-your-installation.md): Troubleshoot a Cortex XSOAR 8.11 On-prem installation. - [Common installation limitations and fixes](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.11/onboard-cortex-xsoar/cortex-xsoar-installation/troubleshoot-your-installation/common-installation-limitations-and-fixes.md): Troubleshoot common Cortex XSOAR 8.11 On-prem installation issues. - [Access logs and log bundles](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.11/onboard-cortex-xsoar/cortex-xsoar-installation/troubleshoot-your-installation/access-logs-and-log-bundles.md): Access logs and log bundles in Cortex XSOAR 8.11 On-prem. - [Open a support session](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.11/onboard-cortex-xsoar/cortex-xsoar-installation/troubleshoot-your-installation/open-a-support-session.md): Open a support session for Cortex XSOAR 8.11 On-prem. - [Upload your license to the textual UI](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.11/onboard-cortex-xsoar/cortex-xsoar-installation/troubleshoot-your-installation/upload-your-license-to-the-textual-ui.md): Upload a license through the Cortex XSOAR 8.11 On-prem textual UI. - [Shut down Cortex XSOAR](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.11/onboard-cortex-xsoar/cortex-xsoar-installation/troubleshoot-your-installation/shut-down-cortex-xsoar.md): Shut down Cortex XSOAR 8.11 On-prem from the textual UI. - [Update Cortex XSOAR](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.11/onboard-cortex-xsoar/cortex-xsoar-installation/update-cortex-xsoar.md): Update Cortex XSOAR 8.11 On-prem. - [Back up and Restore Cortex XSOAR](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.11/onboard-cortex-xsoar/back-up-and-restore-cortex-xsoar.md): Back up and restore your cluster in Cortex XSOAR 8.11 On-prem. - [Set up access to an external storage](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.11/onboard-cortex-xsoar/back-up-and-restore-cortex-xsoar/set-up-access-to-an-external-storage.md): Set up external storage access for backups in Cortex XSOAR 8.11 On-prem. - [Back up data](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.11/onboard-cortex-xsoar/back-up-and-restore-cortex-xsoar/back-up-data.md): Create scheduled and on-demand backups in Cortex XSOAR 8.11 On-prem. - [Backup guidelines and best practices](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.11/onboard-cortex-xsoar/back-up-and-restore-cortex-xsoar/back-up-data/backup-guidelines-and-best-practices.md): Follow backup guidelines and best practices in Cortex XSOAR 8.11 On-prem. - [Restore data](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.11/onboard-cortex-xsoar/back-up-and-restore-cortex-xsoar/restore-data.md): Restore backed-up data in Cortex XSOAR 8.11 On-prem. - [End-to-end example of Cortex XSOAR cluster backup and restore](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.11/onboard-cortex-xsoar/back-up-and-restore-cortex-xsoar/end-to-end-example-of-cortex-xsoar-cluster-backup-and-restore.md): Follow an end-to-end cluster backup and restore workflow in Cortex XSOAR 8.11 On-prem. - [Common backup and restore limitations and fixes](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.11/onboard-cortex-xsoar/back-up-and-restore-cortex-xsoar/common-backup-and-restore-limitations-and-fixes.md): Troubleshoot backup and restore issues in Cortex XSOAR 8.11 On-prem. - [Engines](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.11/configure-cortex-xsoar/engines.md): Install, manage, configure, and troubleshoot engines in Cortex XSOAR 8.11 On-prem. - [What is an engine?](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.11/configure-cortex-xsoar/engines/what-is-an-engine.md): Learn how engines work in Cortex XSOAR 8.11 On-prem. - [Engine requirements](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.11/configure-cortex-xsoar/engines/engine-requirements.md): Review engine requirements in Cortex XSOAR 8.11 On-prem. - [Install an engine](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.11/configure-cortex-xsoar/engines/install-an-engine.md): Install, deploy, and configure engines in Cortex XSOAR 8.11 On-prem. - [Engine air gap installation](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.11/configure-cortex-xsoar/engines/install-an-engine/engine-air-gap-installation.md): Install an engine offline in Cortex XSOAR 8.11 On-prem. - [Docker](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.11/configure-cortex-xsoar/engines/install-an-engine/docker.md): Configure, secure, and troubleshoot Docker in Cortex XSOAR 8.11 On-prem. - [Install Docker](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.11/configure-cortex-xsoar/engines/install-an-engine/docker/install-docker.md): Install Docker for engines in Cortex XSOAR 8.11 On-prem. - [Install Docker distribution for Red Hat on an engine server](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.11/configure-cortex-xsoar/engines/install-an-engine/docker/install-docker-distribution-for-red-hat-on-an-engine-server.md): Install Docker for Red Hat on an engine server in Cortex XSOAR 8.11 On-prem. - [Docker image security](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.11/configure-cortex-xsoar/engines/install-an-engine/docker/docker-image-security.md): Secure Docker images in Cortex XSOAR 8.11 On-prem. - [Use the Cortex XSOAR Container Registry](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.11/configure-cortex-xsoar/engines/install-an-engine/docker/use-the-cortex-xsoar-container-registry.md): Use the container registry in Cortex XSOAR 8.11 On-prem. - [Docker FAQs](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.11/configure-cortex-xsoar/engines/install-an-engine/docker/docker-faqs.md): Find Docker answers for Cortex XSOAR 8.11 On-prem. - [Troubleshoot Docker issues](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.11/configure-cortex-xsoar/engines/install-an-engine/docker/troubleshoot-docker-issues.md): Troubleshoot Docker issues in Cortex XSOAR 8.11 On-prem. - [Configure Docker pull rate limit](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.11/configure-cortex-xsoar/engines/install-an-engine/docker/configure-docker-pull-rate-limit.md): Configure Docker pull limits in Cortex XSOAR 8.11 On-prem. - [Change the Docker installation folder](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.11/configure-cortex-xsoar/engines/install-an-engine/docker/change-the-docker-installation-folder.md): Change the Docker installation folder in Cortex XSOAR 8.11 On-prem. - [Configure Docker integrations to trust custom certificates](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.11/configure-cortex-xsoar/engines/install-an-engine/docker/configure-docker-integrations-to-trust-custom-certificates.md): Configure Docker integrations for custom certificates in Cortex XSOAR 8.11 On-prem. - [Configure Python Docker integrations to trust custom certificates](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.11/configure-cortex-xsoar/engines/install-an-engine/docker/configure-python-docker-integrations-to-trust-custom-certificates.md): Configure Python Docker integrations for custom certificates in Cortex XSOAR 8.11 On-prem. - [Docker hardening guide](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.11/configure-cortex-xsoar/engines/install-an-engine/docker/docker-hardening-guide.md): Harden Docker deployments in Cortex XSOAR 8.11 On-prem. - [Podman](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.11/configure-cortex-xsoar/engines/install-an-engine/podman.md): Run Podman containers for engines in Cortex XSOAR 8.11 On-prem. - [Install Podman](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.11/configure-cortex-xsoar/engines/install-an-engine/podman/install-podman.md): Install Podman for engines in Cortex XSOAR 8.11 On-prem. - [Change container storage directory](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.11/configure-cortex-xsoar/engines/install-an-engine/podman/change-container-storage-directory.md): Change the container storage directory in Cortex XSOAR 8.11 On-prem. - [Migrate From Docker to Podman](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.11/configure-cortex-xsoar/engines/install-an-engine/podman/migrate-from-docker-to-podman.md): Migrate engine containers to Podman in Cortex XSOAR 8.11 On-prem. - [Troubleshoot Podman](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.11/configure-cortex-xsoar/engines/install-an-engine/podman/troubleshoot-podman.md): Troubleshoot Podman in Cortex XSOAR 8.11 On-prem. - [Manage engines](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.11/configure-cortex-xsoar/engines/manage-engines.md): Manage engines and load-balancing groups in Cortex XSOAR 8.11 On-prem. - [Upgrade an engine](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.11/configure-cortex-xsoar/engines/upgrade-an-engine.md): Upgrade an engine in Cortex XSOAR 8.11 On-prem. - [Remove an engine](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.11/configure-cortex-xsoar/engines/remove-an-engine.md): Remove an engine in Cortex XSOAR 8.11 On-prem. - [Configure engines](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.11/configure-cortex-xsoar/engines/configure-engines.md): Configure engines in Cortex XSOAR 8.11 On-prem. - [Configure the engine to use a web proxy](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.11/configure-cortex-xsoar/engines/configure-engines/configure-the-engine-to-use-a-web-proxy.md): Configure an engine web proxy in Cortex XSOAR 8.11 On-prem. - [Configure the engine to call the server without using a proxy](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.11/configure-cortex-xsoar/engines/configure-engines/configure-the-engine-to-call-the-server-without-using-a-proxy.md): Configure direct engine server access in Cortex XSOAR 8.11 On-prem. - [Use NGINX as a reverse proxy](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.11/configure-cortex-xsoar/engines/configure-engines/use-nginx-as-a-reverse-proxy.md): Use NGINX as an engine reverse proxy in Cortex XSOAR 8.11 On-prem. - [Configure an engine to use custom certificates](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.11/configure-cortex-xsoar/engines/configure-engines/configure-an-engine-to-use-custom-certificates.md): Configure custom engine certificates in Cortex XSOAR 8.11 On-prem. - [Use an engine in an integration](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.11/configure-cortex-xsoar/engines/use-an-engine-in-an-integration.md): Use an engine with an integration in Cortex XSOAR 8.11 On-prem. - [Run a script using an engine](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.11/configure-cortex-xsoar/engines/run-a-script-using-an-engine.md): Run a script using an engine in Cortex XSOAR 8.11 On-prem. - [Troubleshoot engines](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.11/configure-cortex-xsoar/engines/troubleshoot-engines.md): Troubleshoot engines in Cortex XSOAR 8.11 On-prem. - [Troubleshoot integrations running on engines](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.11/configure-cortex-xsoar/engines/troubleshoot-integrations-running-on-engines.md): Troubleshoot integrations running on engines in Cortex XSOAR 8.11 On-prem. - [Remote Repository Management](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.11/configure-cortex-xsoar/remote-repository-management.md): Configure and manage remote repositories in Cortex XSOAR 8.11 On-prem. - [Content management in Cortex XSOAR](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.11/configure-cortex-xsoar/remote-repository-management/content-management-in-cortex-xsoar.md): Manage content with remote repositories in Cortex XSOAR 8.11 On-prem. - [Set up a private remote repository](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.11/configure-cortex-xsoar/remote-repository-management/set-up-a-private-remote-repository.md): Set up a private remote repository in Cortex XSOAR 8.11 On-prem. - [Push content from a development tenant](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.11/configure-cortex-xsoar/remote-repository-management/push-content-from-a-development-tenant.md): Push content from a development tenant in Cortex XSOAR 8.11 On-prem. - [Install content on a production tenant](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.11/configure-cortex-xsoar/remote-repository-management/install-content-on-a-production-tenant.md): Install remote repository content on a production tenant in Cortex XSOAR 8.11 On-prem. - [Remote repository troubleshooting](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.11/configure-cortex-xsoar/remote-repository-management/remote-repository-troubleshooting.md): Troubleshoot remote repository issues in Cortex XSOAR 8.11 On-prem. - [Users and Roles Management](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.11/configure-cortex-xsoar/users-and-roles-management.md): Manage users, roles, groups, and authentication in Cortex XSOAR 8.11 On-prem. - [Users and roles in Cortex XSOAR](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.11/configure-cortex-xsoar/users-and-roles-management/users-and-roles-in-cortex-xsoar.md): Configure users, roles, groups, and authentication in Cortex XSOAR 8.11 On-prem. - [Roles management](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.11/configure-cortex-xsoar/users-and-roles-management/roles-management.md): Configure roles in Cortex XSOAR 8.11 On-prem. - [Role-based permissions](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.11/configure-cortex-xsoar/users-and-roles-management/roles-management/role-based-permissions.md): Configure role-based permissions in Cortex XSOAR 8.11 On-prem. - [Manage roles in the Cortex XSOAR tenant](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.11/configure-cortex-xsoar/users-and-roles-management/roles-management/manage-roles-in-the-cortex-xsoar-tenant.md): Manage roles in Cortex XSOAR 8.11 On-prem. - [User group management](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.11/configure-cortex-xsoar/users-and-roles-management/user-group-management.md): Create and manage user groups in Cortex XSOAR 8.11 On-prem. - [Set up authentication](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.11/configure-cortex-xsoar/users-and-roles-management/set-up-authentication.md): Set up local and SSO authentication in Cortex XSOAR 8.11 On-prem. - [Create users in Cortex XSOAR](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.11/configure-cortex-xsoar/users-and-roles-management/set-up-authentication/create-users-in-cortex-xsoar.md): Create local users in Cortex XSOAR 8.11 On-prem. - [Authenticate users using SSO](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.11/configure-cortex-xsoar/users-and-roles-management/set-up-authentication/authenticate-users-using-sso.md): Authenticate users with SSO in Cortex XSOAR 8.11 On-prem. - [Set up Okta as the Identity Provider Using SAML 2.0](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.11/configure-cortex-xsoar/users-and-roles-management/set-up-authentication/set-up-okta-as-the-identity-provider-using-saml-2.0.md): Set up Okta SAML authentication in Cortex XSOAR 8.11 On-prem. - [Set up Microsoft Entra ID as the Identity Provider Using SAML 2.0](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.11/configure-cortex-xsoar/users-and-roles-management/set-up-authentication/set-up-microsoft-entra-id-as-the-identity-provider-using-saml-2.0.md): Set up Microsoft Entra ID SAML authentication in Cortex XSOAR 8.11 On-prem. - [User management](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.11/configure-cortex-xsoar/users-and-roles-management/user-management.md): Invite and manage users in Cortex XSOAR 8.11 On-prem. - [Configure a password policy](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.11/configure-cortex-xsoar/users-and-roles-management/configure-a-password-policy.md): Configure a password policy in Cortex XSOAR 8.11 On-prem. - [Marketplace](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.11/configure-cortex-xsoar/marketplace.md): Discover and manage content packs in Cortex XSOAR 8.11 On-prem Marketplace. - [Cortex Marketplace](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.11/configure-cortex-xsoar/marketplace/cortex-marketplace.md): Search Marketplace content in Cortex XSOAR 8.11 On-prem. - [Content packs](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.11/configure-cortex-xsoar/marketplace/content-packs.md): Use Marketplace content packs in Cortex XSOAR 8.11 On-prem. - [Content Pack Support Types](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.11/configure-cortex-xsoar/marketplace/content-pack-support-types.md): Review content pack support types in Cortex XSOAR 8.11 On-prem. - [Manage content packs](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.11/configure-cortex-xsoar/marketplace/manage-content-packs.md): Install and manage content packs in Cortex XSOAR 8.11 On-prem. - [Set up your use case with the Deployment Wizard](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.11/configure-cortex-xsoar/marketplace/set-up-your-use-case-with-the-deployment-wizard.md): Set up a use case with the Deployment Wizard in Cortex XSOAR 8.11 On-prem. - [Marketplace FAQs](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.11/configure-cortex-xsoar/marketplace/marketplace-faqs.md): Find Marketplace answers for Cortex XSOAR 8.11 On-prem. - [Content pack update notifications](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.11/configure-cortex-xsoar/marketplace/content-pack-update-notifications.md): Enable content pack update notifications in Cortex XSOAR 8.11 On-prem. - [Customize content pack notifications](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.11/configure-cortex-xsoar/marketplace/content-pack-update-notifications/customize-content-pack-notifications.md): Customize content pack notifications in Cortex XSOAR 8.11 On-prem. - [Content pack contributions](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.11/configure-cortex-xsoar/marketplace/content-pack-contributions.md): Contribute content packs to Marketplace in Cortex XSOAR 8.11 On-prem. - [Create a content pack](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.11/configure-cortex-xsoar/marketplace/content-pack-contributions/create-a-content-pack.md): Create a Marketplace content pack in Cortex XSOAR 8.11 On-prem. - [Resubmit a content pack](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.11/configure-cortex-xsoar/marketplace/content-pack-contributions/resubmit-a-content-pack.md): Resubmit a Marketplace content pack in Cortex XSOAR 8.11 On-prem. - [Integrations](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.11/configure-cortex-xsoar/integrations.md): Configure and manage integrations in Cortex XSOAR 8.11 On-prem. - [Integration use cases](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.11/configure-cortex-xsoar/integrations/integration-use-cases.md): Explore common integration use cases in Cortex XSOAR 8.11 On-prem. - [Configure integrations](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.11/configure-cortex-xsoar/integrations/configure-integrations.md): Configure integrations in Cortex XSOAR 8.11 On-prem. - [Change the Docker image in an integration or script](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.11/configure-cortex-xsoar/integrations/change-the-docker-image-in-an-integration-or-script.md): Change Docker images for integrations and scripts in Cortex XSOAR 8.11 On-prem. - [Connect your engine to an image registry](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.11/configure-cortex-xsoar/integrations/change-the-docker-image-in-an-integration-or-script/connect-your-engine-to-an-image-registry.md): Connect an engine to an image registry in Cortex XSOAR 8.11 On-prem. - [Pull images from a private image registry](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.11/configure-cortex-xsoar/integrations/change-the-docker-image-in-an-integration-or-script/pull-images-from-a-private-image-registry.md): Pull private registry images in Cortex XSOAR 8.11 On-prem. - [Manage credentials](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.11/configure-cortex-xsoar/integrations/manage-credentials.md): Manage integration credentials in Cortex XSOAR 8.11 On-prem. - [Add an integration instance](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.11/configure-cortex-xsoar/integrations/add-an-integration-instance.md): Add an integration instance in Cortex XSOAR 8.11 On-prem. - [Fetch incidents from an integration instance](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.11/configure-cortex-xsoar/integrations/add-an-integration-instance/fetch-incidents-from-an-integration-instance.md): Fetch incidents from an integration instance in Cortex XSOAR 8.11 On-prem. - [Receive notifications on an incident fetch error](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.11/configure-cortex-xsoar/integrations/add-an-integration-instance/receive-notifications-on-an-incident-fetch-error.md): Receive integration fetch error notifications in Cortex XSOAR 8.11 On-prem. - [Configure integration permissions](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.11/configure-cortex-xsoar/integrations/add-an-integration-instance/configure-integration-permissions.md): Configure integration permissions in Cortex XSOAR 8.11 On-prem. - [Troubleshoot integrations](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.11/configure-cortex-xsoar/integrations/add-an-integration-instance/troubleshoot-integrations.md): Troubleshoot integrations in Cortex XSOAR 8.11 On-prem. - [Integration commands in the CLI](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.11/configure-cortex-xsoar/integrations/integration-commands-in-the-cli.md): Run integration commands in the CLI in Cortex XSOAR 8.11 On-prem. - [Forward requests to long-running integrations](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.11/configure-cortex-xsoar/integrations/forward-requests-to-long-running-integrations.md): Forward requests to long-running integrations in Cortex XSOAR 8.11 On-prem. - [Incident configuration](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.11/configure-cortex-xsoar/incident-configuration.md): Configure incidents in Cortex XSOAR 8.11 On-prem. - [Incident lifecycle](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.11/configure-cortex-xsoar/incident-configuration/incident-lifecycle.md): Understand the incident lifecycle in Cortex XSOAR 8.11 On-prem. - [Incident Customization](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.11/configure-cortex-xsoar/incident-configuration/incident-customization.md): Customize incident types, fields, and layouts in Cortex XSOAR 8.11 On-prem. - [Use incident context data](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.11/configure-cortex-xsoar/incident-configuration/incident-customization/use-incident-context-data.md): Use incident context data in Cortex XSOAR 8.11 On-prem. - [Create an incident type](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.11/configure-cortex-xsoar/incident-configuration/incident-customization/create-an-incident-type.md): Create incident types in Cortex XSOAR 8.11 On-prem. - [Create an incident field](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.11/configure-cortex-xsoar/incident-configuration/incident-customization/create-an-incident-field.md): Create incident fields in Cortex XSOAR 8.11 On-prem. - [Incident field trigger scripts](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.11/configure-cortex-xsoar/incident-configuration/incident-customization/create-an-incident-field/incident-field-trigger-scripts.md): Configure incident field trigger scripts in Cortex XSOAR 8.11 On-prem. - [Create dynamic fields](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.11/configure-cortex-xsoar/incident-configuration/incident-customization/create-an-incident-field/create-dynamic-fields.md): Create dynamic incident fields in Cortex XSOAR 8.11 On-prem. - [Troubleshoot incident fields](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.11/configure-cortex-xsoar/incident-configuration/incident-customization/create-an-incident-field/troubleshoot-incident-fields.md): Troubleshoot incident fields in Cortex XSOAR 8.11 On-prem. - [Incident layout customization](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.11/configure-cortex-xsoar/incident-configuration/incident-customization/incident-layout-customization.md): Customize incident layouts in Cortex XSOAR 8.11 On-prem. - [Examples of using scripts in incident layouts](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.11/configure-cortex-xsoar/incident-configuration/incident-customization/incident-layout-customization/examples-of-using-scripts-in-incident-layouts.md): Use scripts in incident layouts in Cortex XSOAR 8.11 On-prem. - [Classification and mapping](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.11/configure-cortex-xsoar/incident-configuration/classification-and-mapping.md): Configure incident classification and mapping in Cortex XSOAR 8.11 On-prem. - [Create an incident classifier](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.11/configure-cortex-xsoar/incident-configuration/classification-and-mapping/create-an-incident-classifier.md): Create an incident classifier in Cortex XSOAR 8.11 On-prem. - [Create an incident mapper](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.11/configure-cortex-xsoar/incident-configuration/classification-and-mapping/create-an-incident-mapper.md): Create an incident mapper in Cortex XSOAR 8.11 On-prem. - [Set up incident mirroring](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.11/configure-cortex-xsoar/incident-configuration/set-up-incident-mirroring.md): Set up incident mirroring in Cortex XSOAR 8.11 On-prem. - [Incident deduplication in Cortex XSOAR](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.11/configure-cortex-xsoar/incident-configuration/incident-deduplication-in-cortex-xsoar.md): Deduplicate incidents in Cortex XSOAR 8.11 On-prem. - [Pre-process rules](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.11/configure-cortex-xsoar/incident-configuration/pre-process-rules.md): Configure incident pre-process rules in Cortex XSOAR 8.11 On-prem. - [Use post-processing scripts in an incident](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.11/configure-cortex-xsoar/incident-configuration/use-post-processing-scripts-in-an-incident.md): Use post-processing scripts in Cortex XSOAR 8.11 On-prem. - [Customize incident close reasons](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.11/configure-cortex-xsoar/incident-configuration/customize-incident-close-reasons.md): Customize incident close reasons in Cortex XSOAR 8.11 On-prem. - [Configure inline value fields](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.11/configure-cortex-xsoar/incident-configuration/configure-inline-value-fields.md): Configure inline value fields in Cortex XSOAR 8.11 On-prem. - [Configure incident export and delete](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.11/configure-cortex-xsoar/incident-configuration/configure-incident-export-and-delete.md): Configure incident export and deletion in Cortex XSOAR 8.11 On-prem. - [Configure access to external storage](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.11/configure-cortex-xsoar/incident-configuration/configure-incident-export-and-delete/configure-access-to-external-storage.md): Configure external storage access in Cortex XSOAR 8.11 On-prem. - [Schedule incident export and delete](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.11/configure-cortex-xsoar/incident-configuration/configure-incident-export-and-delete/schedule-incident-export-and-delete.md): Schedule incident exports and deletions to external storage in Cortex XSOAR 8.11 On-prem. - [Export an incident to CSV using the UTF8-BOM format](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.11/configure-cortex-xsoar/incident-configuration/export-an-incident-to-csv-using-the-utf8-bom-format.md): Export incidents to UTF8-BOM CSV in Cortex XSOAR 8.11 On-prem. - [Amazon S3 configuration example](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.11/configure-cortex-xsoar/incident-configuration/amazon-s3-configuration-example.md): Configure Amazon S3 storage in Cortex XSOAR 8.11 On-prem. - [Playbooks](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.11/configure-cortex-xsoar/playbooks.md): Build and automate workflows with playbooks in Cortex XSOAR 8.11 On-prem. - [What is a playbook?](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.11/configure-cortex-xsoar/playbooks/what-is-a-playbook.md): Learn about playbooks in Cortex XSOAR 8.11 On-prem. - [Playbook development checklist](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.11/configure-cortex-xsoar/playbooks/playbook-development-checklist.md): Follow the playbook development checklist in Cortex XSOAR 8.11 On-prem. - [Plan your playbook](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.11/configure-cortex-xsoar/playbooks/plan-your-playbook.md): Plan a playbook in Cortex XSOAR 8.11 On-prem. - [Develop your playbook](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.11/configure-cortex-xsoar/playbooks/develop-your-playbook.md): Develop playbooks in Cortex XSOAR 8.11 On-prem. - [Task 1. Choose from existing playbooks or create your own](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.11/configure-cortex-xsoar/playbooks/develop-your-playbook/task-1.-choose-from-existing-playbooks-or-create-your-own.md): Choose or create a playbook in Cortex XSOAR 8.11 On-prem. - [Task 2. Configure playbook settings](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.11/configure-cortex-xsoar/playbooks/develop-your-playbook/task-2.-configure-playbook-settings.md): Configure playbook settings in Cortex XSOAR 8.11 On-prem. - [Task 3. Add tasks](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.11/configure-cortex-xsoar/playbooks/develop-your-playbook/task-3.-add-tasks.md): Add tasks to a playbook in Cortex XSOAR 8.11 On-prem. - [Set playbook inputs and outputs](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.11/configure-cortex-xsoar/playbooks/develop-your-playbook/task-3.-add-tasks/set-playbook-inputs-and-outputs.md): Set playbook inputs and outputs in Cortex XSOAR 8.11 On-prem. - [Create a section header](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.11/configure-cortex-xsoar/playbooks/develop-your-playbook/task-3.-add-tasks/create-a-section-header.md): Create a playbook section header in Cortex XSOAR 8.11 On-prem. - [Create a standard task](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.11/configure-cortex-xsoar/playbooks/develop-your-playbook/task-3.-add-tasks/create-a-standard-task.md): Create a standard playbook task in Cortex XSOAR 8.11 On-prem. - [Create a conditional task](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.11/configure-cortex-xsoar/playbooks/develop-your-playbook/task-3.-add-tasks/create-a-conditional-task.md): Create a conditional playbook task in Cortex XSOAR 8.11 On-prem. - [Create a communication task](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.11/configure-cortex-xsoar/playbooks/develop-your-playbook/task-3.-add-tasks/create-a-communication-task.md): Create a communication task in Cortex XSOAR 8.11 On-prem. - [Configure script error handling in a playbook](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.11/configure-cortex-xsoar/playbooks/develop-your-playbook/task-3.-add-tasks/configure-script-error-handling-in-a-playbook.md): Configure script error handling in Cortex XSOAR 8.11 On-prem. - [Task 4. Add custom playbook features](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.11/configure-cortex-xsoar/playbooks/develop-your-playbook/task-4.-add-custom-playbook-features.md): Add custom playbook features in Cortex XSOAR 8.11 On-prem. - [Task 5. Test and debug the playbook](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.11/configure-cortex-xsoar/playbooks/develop-your-playbook/task-5.-test-and-debug-the-playbook.md): Test and debug playbooks in Cortex XSOAR 8.11 On-prem. - [Task 6. Manage playbook content](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.11/configure-cortex-xsoar/playbooks/develop-your-playbook/task-6.-manage-playbook-content.md): Manage playbook content in Cortex XSOAR 8.11 On-prem. - [Customize a playbook for a phishing use case example](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.11/configure-cortex-xsoar/playbooks/develop-your-playbook/customize-a-playbook-for-a-phishing-use-case-example.md): Customize phishing playbooks in Cortex XSOAR 8.11 On-prem. - [Customize your playbook](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.11/configure-cortex-xsoar/playbooks/customize-your-playbook.md): Customize playbooks in Cortex XSOAR 8.11 On-prem. - [Customize the SOC name](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.11/configure-cortex-xsoar/playbooks/customize-your-playbook/customize-the-soc-name.md): Customize the SOC name in Cortex XSOAR 8.11 On-prem. - [Configure a sub-playbook](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.11/configure-cortex-xsoar/playbooks/customize-your-playbook/configure-a-sub-playbook.md): Configure sub-playbooks in Cortex XSOAR 8.11 On-prem. - [Filter and transform data](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.11/configure-cortex-xsoar/playbooks/customize-your-playbook/filter-and-transform-data.md): Filter and transform data in Cortex XSOAR 8.11 On-prem. - [Filter considerations, categories, and built-in filters](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.11/configure-cortex-xsoar/playbooks/customize-your-playbook/filter-and-transform-data/filter-considerations-categories-and-built-in-filters.md): Use filters in Cortex XSOAR 8.11 On-prem. - [Transformer considerations, categories, and built-in transformers](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.11/configure-cortex-xsoar/playbooks/customize-your-playbook/filter-and-transform-data/transformer-considerations-categories-and-built-in-transformers.md): Use transformers in Cortex XSOAR 8.11 On-prem. - [Extract indicators](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.11/configure-cortex-xsoar/playbooks/customize-your-playbook/extract-indicators.md): Extract indicators in Cortex XSOAR 8.11 On-prem. - [Extend context](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.11/configure-cortex-xsoar/playbooks/customize-your-playbook/extend-context.md): Extend context in Cortex XSOAR 8.11 On-prem. - [Set and update incident fields](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.11/configure-cortex-xsoar/playbooks/customize-your-playbook/set-and-update-incident-fields.md): Set and update incident fields in Cortex XSOAR 8.11 On-prem. - [Playbook polling](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.11/configure-cortex-xsoar/playbooks/customize-your-playbook/playbook-polling.md): Configure playbook polling in Cortex XSOAR 8.11 On-prem. - [Scripts](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.11/configure-cortex-xsoar/playbooks/scripts.md): Create and edit scripts in Cortex XSOAR 8.11 On-prem. - [Use existing scripts](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.11/configure-cortex-xsoar/playbooks/scripts/use-existing-scripts.md): Use existing scripts in Cortex XSOAR 8.11 On-prem. - [Create a script](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.11/configure-cortex-xsoar/playbooks/scripts/create-a-script.md): Create scripts in Cortex XSOAR 8.11 On-prem. - [Debug your playbook](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.11/configure-cortex-xsoar/playbooks/debug-your-playbook.md): Debug playbooks in Cortex XSOAR 8.11 On-prem. - [Troubleshoot playbook performance](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.11/configure-cortex-xsoar/playbooks/debug-your-playbook/troubleshoot-playbook-performance.md): Troubleshoot playbook performance in Cortex XSOAR 8.11 On-prem. - [Manage playbook content](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.11/configure-cortex-xsoar/playbooks/manage-playbook-content.md): Manage playbook content in Cortex XSOAR 8.11 On-prem. - [Best practices](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.11/configure-cortex-xsoar/playbooks/best-practices.md): Follow playbook best practices in Cortex XSOAR 8.11 On-prem. - [Lists](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.11/configure-cortex-xsoar/lists.md): Create and manage lists in Cortex XSOAR 8.11 On-prem. - [What is a list?](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.11/configure-cortex-xsoar/lists/what-is-a-list.md): Learn about lists in Cortex XSOAR 8.11 On-prem. - [Create a list](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.11/configure-cortex-xsoar/lists/create-a-list.md): Create a list in Cortex XSOAR 8.11 On-prem. - [List commands](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.11/configure-cortex-xsoar/lists/list-commands.md): Use list commands in Cortex XSOAR 8.11 On-prem. - [Use cases: JSON lists](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.11/configure-cortex-xsoar/lists/use-cases-json-lists.md): Manage JSON lists in Cortex XSOAR 8.11 On-prem. - [Transform a list into an array](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.11/configure-cortex-xsoar/lists/transform-a-list-into-an-array.md): Transform lists into arrays in Cortex XSOAR 8.11 On-prem. - [Jobs](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.11/configure-cortex-xsoar/jobs.md): Create and manage jobs in Cortex XSOAR 8.11 On-prem. - [Manage jobs](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.11/configure-cortex-xsoar/jobs/manage-jobs.md): Manage jobs in Cortex XSOAR 8.11 On-prem. - [Create a time triggered job](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.11/configure-cortex-xsoar/jobs/create-a-time-triggered-job.md): Create time-triggered jobs in Cortex XSOAR 8.11 On-prem. - [Create a job triggered by a delta in a feed](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.11/configure-cortex-xsoar/jobs/create-a-job-triggered-by-a-delta-in-a-feed.md): Create feed-triggered jobs in Cortex XSOAR 8.11 On-prem. - [Create jobs to process indicators example](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.11/configure-cortex-xsoar/jobs/create-jobs-to-process-indicators-example.md): Process indicators with jobs in Cortex XSOAR 8.11 On-prem. - [SLAs](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.11/configure-cortex-xsoar/slas.md): Configure SLAs in Cortex XSOAR 8.11 On-prem. - [SLAs in Cortex XSOAR](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.11/configure-cortex-xsoar/slas/slas-in-cortex-xsoar.md): Learn about SLAs in Cortex XSOAR 8.11 On-prem. - [Configure an SLA in an incident type](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.11/configure-cortex-xsoar/slas/configure-an-sla-in-an-incident-type.md): Configure SLAs in incident types in Cortex XSOAR 8.11 On-prem. - [Configure Timer/SLA fields](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.11/configure-cortex-xsoar/slas/configure-timersla-fields.md): Configure timer and SLA fields in Cortex XSOAR 8.11 On-prem. - [Configure a playbook to run Timers/SLAs](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.11/configure-cortex-xsoar/slas/configure-a-playbook-to-run-timersslas.md): Configure playbooks to run timers and SLAs in Cortex XSOAR 8.11 On-prem. - [Automate changes to incident fields using SLA scripts](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.11/configure-cortex-xsoar/slas/automate-changes-to-incident-fields-using-sla-scripts.md): Automate incident field changes with SLA scripts in Cortex XSOAR 8.11 On-prem. - [Create SLA scripts](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.11/configure-cortex-xsoar/slas/create-sla-scripts.md): Create SLA scripts in Cortex XSOAR 8.11 On-prem. - [Use SLA and Timer field commands manually in the CLI](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.11/configure-cortex-xsoar/slas/use-sla-and-timer-field-commands-manually-in-the-cli.md): Use SLA and timer commands in Cortex XSOAR 8.11 On-prem. - [Configure the Global Risk Threshold](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.11/configure-cortex-xsoar/slas/configure-the-global-risk-threshold.md): Configure the global risk threshold in Cortex XSOAR 8.11 On-prem. - [Search incidents for Timer/SLAs](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.11/configure-cortex-xsoar/slas/search-incidents-for-timerslas.md): Search incidents by timer and SLA in Cortex XSOAR 8.11 On-prem. - [Dashboards and Reports](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.11/configure-cortex-xsoar/dashboards-and-reports.md): Create dashboards, reports, and widgets in Cortex XSOAR 8.11 On-prem. - [Dashboards](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.11/configure-cortex-xsoar/dashboards-and-reports/dashboards.md): Create, edit, and share dashboards in Cortex XSOAR 8.11 On-prem. - [Dashboard actions](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.11/configure-cortex-xsoar/dashboards-and-reports/dashboards/dashboard-actions.md): Manage dashboards and customizable widgets in Cortex XSOAR 8.11 On-prem. - [Manage dashboards](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.11/configure-cortex-xsoar/dashboards-and-reports/dashboards/manage-dashboards.md): Create, customize, and share dashboards in Cortex XSOAR 8.11 On-prem. - [Reports](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.11/configure-cortex-xsoar/dashboards-and-reports/reports.md): Create, edit, and schedule reports in Cortex XSOAR 8.11 On-prem. - [Manage reports](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.11/configure-cortex-xsoar/dashboards-and-reports/reports/manage-reports.md): Create, customize, schedule, and generate reports in Cortex XSOAR 8.11 On-prem. - [Configure the timezone in a report](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.11/configure-cortex-xsoar/dashboards-and-reports/reports/configure-the-timezone-in-a-report.md): Configure report timezones and time formats in Cortex XSOAR 8.11 On-prem. - [Troubleshoot script timeout for reports](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.11/configure-cortex-xsoar/dashboards-and-reports/reports/troubleshoot-script-timeout-for-reports.md): Change report script timeout values in Cortex XSOAR 8.11 On-prem. - [Troubleshoot overlapping text and extra pages](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.11/configure-cortex-xsoar/dashboards-and-reports/reports/troubleshoot-overlapping-text-and-extra-pages.md): Fix overlapping text and extra PDF pages in Cortex XSOAR 8.11 On-prem reports. - [Widgets](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.11/configure-cortex-xsoar/dashboards-and-reports/widgets.md): Create and edit dashboard and report widgets in Cortex XSOAR 8.11 On-prem. - [Widget customization](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.11/configure-cortex-xsoar/dashboards-and-reports/widgets/widget-customization.md): Customize widgets for dashboards and reports in Cortex XSOAR 8.11 On-prem. - [Create a widget using the widget builder](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.11/configure-cortex-xsoar/dashboards-and-reports/widgets/create-a-widget-using-the-widget-builder.md): Create widgets with Widget Builder in Cortex XSOAR 8.11 On-prem. - [Create a custom widget using a JSON file](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.11/configure-cortex-xsoar/dashboards-and-reports/widgets/create-a-custom-widget-using-a-json-file.md): Create custom JSON widgets in Cortex XSOAR 8.11 On-prem. - [Create a custom widget using a script](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.11/configure-cortex-xsoar/dashboards-and-reports/widgets/create-a-custom-widget-using-a-script.md): Create custom script-based widgets in Cortex XSOAR 8.11 On-prem. - [Create a widget from an incident](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.11/configure-cortex-xsoar/dashboards-and-reports/widgets/create-a-widget-from-an-incident.md): Create custom widgets from incident searches in Cortex XSOAR 8.11 On-prem. - [Create a widget from an indicator](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.11/configure-cortex-xsoar/dashboards-and-reports/widgets/create-a-widget-from-an-indicator.md): Create custom indicator widgets in Cortex XSOAR 8.11 On-prem. - [Edit a widget](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.11/configure-cortex-xsoar/dashboards-and-reports/widgets/edit-a-widget.md): Edit Widgets Library, dashboard, and report widgets in Cortex XSOAR 8.11 On-prem. - [Add a widget in the War Room](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.11/configure-cortex-xsoar/dashboards-and-reports/widgets/add-a-widget-in-the-war-room.md): Add script-based War Room widgets in Cortex XSOAR 8.11 On-prem. - [Saved By Dbot (ROI) Widget](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.11/configure-cortex-xsoar/dashboards-and-reports/widgets/saved-by-dbot-roi-widget.md): Customize the Saved By Dbot ROI widget in Cortex XSOAR 8.11 On-prem. - [Incidents and indicators investigation](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.11/investigate-and-respond-to-threats/incidents-and-indicators-investigation.md): Investigate incidents and indicators in Cortex XSOAR 8.11 On-prem. - [Incidents](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.11/investigate-and-respond-to-threats/incidents-and-indicators-investigation/incidents.md): Investigate and remediate incidents in Cortex XSOAR 8.11 On-prem. - [Incident management](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.11/investigate-and-respond-to-threats/incidents-and-indicators-investigation/incident-management.md): View and manage incidents in Cortex XSOAR 8.11 On-prem. - [Search for incidents](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.11/investigate-and-respond-to-threats/incidents-and-indicators-investigation/incident-management/search-for-incidents.md): Search and save incident queries in Cortex XSOAR 8.11 On-prem. - [Create an incident](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.11/investigate-and-respond-to-threats/incidents-and-indicators-investigation/incident-management/create-an-incident.md): Create incidents manually, through the API, or by importing data in Cortex XSOAR 8.11 On-prem. - [Export incidents](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.11/investigate-and-respond-to-threats/incidents-and-indicators-investigation/incident-management/export-incidents.md): Export and schedule incident exports in Cortex XSOAR 8.11 On-prem. - [Export incidents from the Incidents table](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.11/investigate-and-respond-to-threats/incidents-and-indicators-investigation/incident-management/export-incidents/export-incidents-from-the-incidents-table.md): Export incidents from the Incidents table as Excel, CSV, or JSON files in Cortex XSOAR 8.11 On-prem. - [Export incidents on demand](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.11/investigate-and-respond-to-threats/incidents-and-indicators-investigation/incident-management/export-incidents/export-incidents-on-demand.md): Export incidents on demand to external storage in Cortex XSOAR 8.11 On-prem. - [Investigate an incident](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.11/investigate-and-respond-to-threats/incidents-and-indicators-investigation/investigate-an-incident.md): Investigate incidents and take remediation steps in Cortex XSOAR 8.11 On-prem. - [Retain incidents](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.11/investigate-and-respond-to-threats/incidents-and-indicators-investigation/investigate-an-incident/retain-incidents.md): Retain incidents in Cortex XSOAR 8.11 On-prem. - [Limit access to investigations using access control](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.11/investigate-and-respond-to-threats/incidents-and-indicators-investigation/investigate-an-incident/limit-access-to-investigations-using-access-control.md): Limit access to investigations in Cortex XSOAR 8.11 On-prem. - [Incident Tasks](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.11/investigate-and-respond-to-threats/incidents-and-indicators-investigation/investigate-an-incident/incident-tasks.md): Manage incident and playbook tasks in Cortex XSOAR 8.11 On-prem. - [Use the War Room in an investigation](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.11/investigate-and-respond-to-threats/incidents-and-indicators-investigation/investigate-an-incident/use-the-war-room-in-an-investigation.md): Use the War Room for incident investigations in Cortex XSOAR 8.11 On-prem. - [Schedule a command in the War Room](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.11/investigate-and-respond-to-threats/incidents-and-indicators-investigation/investigate-an-incident/schedule-a-command-in-the-war-room.md): Schedule War Room commands in Cortex XSOAR 8.11 On-prem. - [Run commands in the CLI](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.11/investigate-and-respond-to-threats/incidents-and-indicators-investigation/investigate-an-incident/run-commands-in-the-cli.md): Run system, integration, and script commands in Cortex XSOAR 8.11 On-prem. - [Evidence Handling](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.11/investigate-and-respond-to-threats/incidents-and-indicators-investigation/investigate-an-incident/evidence-handling.md): Manage investigation evidence in Cortex XSOAR 8.11 On-prem. - [Use the Work Plan in an investigation](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.11/investigate-and-respond-to-threats/incidents-and-indicators-investigation/investigate-an-incident/use-the-work-plan-in-an-investigation.md): Monitor and manage playbook workflows in Cortex XSOAR 8.11 On-prem. - [Investigate an incident using the canvas](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.11/investigate-and-respond-to-threats/incidents-and-indicators-investigation/investigate-an-incident/investigate-an-incident-using-the-canvas.md): Map and investigate incidents with the canvas in Cortex XSOAR 8.11 On-prem. - [Link incidents](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.11/investigate-and-respond-to-threats/incidents-and-indicators-investigation/investigate-an-incident/link-incidents.md): Link incidents in Cortex XSOAR 8.11 On-prem. - [Create an incident summary report](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.11/investigate-and-respond-to-threats/incidents-and-indicators-investigation/investigate-an-incident/create-an-incident-summary-report.md): Create incident summary reports in Cortex XSOAR 8.11 On-prem. - [Manage indicators](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.11/investigate-and-respond-to-threats/incidents-and-indicators-investigation/manage-indicators.md): Manage and search indicators in Cortex XSOAR 8.11 On-prem. - [Query indicators](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.11/investigate-and-respond-to-threats/incidents-and-indicators-investigation/manage-indicators/query-indicators.md): Query indicators in Cortex XSOAR 8.11 On-prem. - [View indicator relationships in an investigation](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.11/investigate-and-respond-to-threats/incidents-and-indicators-investigation/manage-indicators/view-indicator-relationships-in-an-investigation.md): Create and investigate indicator relationships in Cortex XSOAR 8.11 On-prem. - [Threat Intel Management](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.11/investigate-and-respond-to-threats/threat-intel-management.md): Manage threat intelligence in Cortex XSOAR 8.11 On-prem. - [Get started with Threat Intel Management](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.11/investigate-and-respond-to-threats/threat-intel-management/get-started-with-threat-intel-management.md): Get started with Threat Intel Management in Cortex XSOAR 8.11 On-prem. - [What is Threat Intel Management?](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.11/investigate-and-respond-to-threats/threat-intel-management/get-started-with-threat-intel-management/what-is-threat-intel-management.md): Learn about Threat Intel Management in Cortex XSOAR 8.11 On-prem. - [Threat Intel Management use cases](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.11/investigate-and-respond-to-threats/threat-intel-management/get-started-with-threat-intel-management/threat-intel-management-use-cases.md): Explore Threat Intel Management use cases in Cortex XSOAR 8.11 On-prem. - [Indicator concepts](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.11/investigate-and-respond-to-threats/threat-intel-management/get-started-with-threat-intel-management/indicator-concepts.md): Learn indicator concepts in Cortex XSOAR 8.11 On-prem. - [Indicator lifecycle](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.11/investigate-and-respond-to-threats/threat-intel-management/get-started-with-threat-intel-management/indicator-lifecycle.md): Understand the indicator lifecycle in Cortex XSOAR 8.11 On-prem. - [Roles and responsibilities in Threat Intel Management](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.11/investigate-and-respond-to-threats/threat-intel-management/get-started-with-threat-intel-management/roles-and-responsibilities-in-threat-intel-management.md): Understand Threat Intel Management roles in Cortex XSOAR 8.11 On-prem. - [Indicator configuration](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.11/investigate-and-respond-to-threats/threat-intel-management/indicator-configuration.md): Configure indicators in Cortex XSOAR 8.11 On-prem. - [Customize indicator types, fields, and layouts](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.11/investigate-and-respond-to-threats/threat-intel-management/indicator-configuration/customize-indicator-types-fields-and-layouts.md): Customize indicator types, fields, and layouts in Cortex XSOAR 8.11 On-prem. - [Create an indicator type](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.11/investigate-and-respond-to-threats/threat-intel-management/indicator-configuration/customize-indicator-types-fields-and-layouts/create-an-indicator-type.md): Create indicator types in Cortex XSOAR 8.11 On-prem. - [Indicator type profile](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.11/investigate-and-respond-to-threats/threat-intel-management/indicator-configuration/customize-indicator-types-fields-and-layouts/create-an-indicator-type/indicator-type-profile.md): Configure indicator type profiles in Cortex XSOAR 8.11 On-prem. - [File indicators](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.11/investigate-and-respond-to-threats/threat-intel-management/indicator-configuration/customize-indicator-types-fields-and-layouts/create-an-indicator-type/file-indicators.md): Manage file indicators in Cortex XSOAR 8.11 On-prem. - [Formatting scripts](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.11/investigate-and-respond-to-threats/threat-intel-management/indicator-configuration/customize-indicator-types-fields-and-layouts/create-an-indicator-type/formatting-scripts.md): Use formatting scripts in Cortex XSOAR 8.11 On-prem. - [Enhancement scripts](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.11/investigate-and-respond-to-threats/threat-intel-management/indicator-configuration/customize-indicator-types-fields-and-layouts/create-an-indicator-type/enhancement-scripts.md): Use enhancement scripts in Cortex XSOAR 8.11 On-prem. - [Reputation scripts](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.11/investigate-and-respond-to-threats/threat-intel-management/indicator-configuration/customize-indicator-types-fields-and-layouts/create-an-indicator-type/reputation-scripts.md): Use reputation scripts in Cortex XSOAR 8.11 On-prem. - [Reputation commands](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.11/investigate-and-respond-to-threats/threat-intel-management/indicator-configuration/customize-indicator-types-fields-and-layouts/create-an-indicator-type/reputation-commands.md): Run reputation commands in Cortex XSOAR 8.11 On-prem. - [Map custom indicator fields](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.11/investigate-and-respond-to-threats/threat-intel-management/indicator-configuration/customize-indicator-types-fields-and-layouts/create-an-indicator-type/map-custom-indicator-fields.md): Map custom indicator fields in Cortex XSOAR 8.11 On-prem. - [Create an indicator field](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.11/investigate-and-respond-to-threats/threat-intel-management/indicator-configuration/customize-indicator-types-fields-and-layouts/create-an-indicator-field.md): Create indicator fields in Cortex XSOAR 8.11 On-prem. - [Indicator fields structure](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.11/investigate-and-respond-to-threats/threat-intel-management/indicator-configuration/customize-indicator-types-fields-and-layouts/create-an-indicator-field/indicator-fields-structure.md): Understand indicator field structures in Cortex XSOAR 8.11 On-prem. - [Indicator field trigger scripts](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.11/investigate-and-respond-to-threats/threat-intel-management/indicator-configuration/customize-indicator-types-fields-and-layouts/create-an-indicator-field/indicator-field-trigger-scripts.md): Configure indicator field trigger scripts in Cortex XSOAR 8.11 On-prem. - [Indicator layout customization](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.11/investigate-and-respond-to-threats/threat-intel-management/indicator-configuration/customize-indicator-types-fields-and-layouts/indicator-layout-customization.md): Customize indicator layouts in Cortex XSOAR 8.11 On-prem. - [Indicator classification and mapping](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.11/investigate-and-respond-to-threats/threat-intel-management/indicator-configuration/indicator-classification-and-mapping.md): Configure indicator classification and mapping in Cortex XSOAR 8.11 On-prem. - [Indicator extraction](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.11/investigate-and-respond-to-threats/threat-intel-management/indicator-configuration/indicator-extraction.md): Extract and enrich indicators in Cortex XSOAR 8.11 On-prem. - [Indicator extraction modes](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.11/investigate-and-respond-to-threats/threat-intel-management/indicator-configuration/indicator-extraction/indicator-extraction-modes.md): Configure indicator extraction modes in Cortex XSOAR 8.11 On-prem. - [Create indicator extraction rules for an incident type](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.11/investigate-and-respond-to-threats/threat-intel-management/indicator-configuration/indicator-extraction/create-indicator-extraction-rules-for-an-incident-type.md): Create indicator extraction rules in Cortex XSOAR 8.11 On-prem. - [Set the indicator extraction mode for a playbook task](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.11/investigate-and-respond-to-threats/threat-intel-management/indicator-configuration/indicator-extraction/set-the-indicator-extraction-mode-for-a-playbook-task.md): Set indicator extraction modes in Cortex XSOAR 8.11 On-prem. - [Disable indicator extraction for scripts or integrations](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.11/investigate-and-respond-to-threats/threat-intel-management/indicator-configuration/indicator-extraction/disable-indicator-extraction-for-scripts-or-integrations.md): Disable indicator extraction in Cortex XSOAR 8.11 On-prem. - [Troubleshoot indicator extraction](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.11/investigate-and-respond-to-threats/threat-intel-management/indicator-configuration/indicator-extraction/troubleshoot-indicator-extraction.md): Troubleshoot indicator extraction in Cortex XSOAR 8.11 On-prem. - [Configure the indicator timeline](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.11/investigate-and-respond-to-threats/threat-intel-management/indicator-configuration/configure-the-indicator-timeline.md): Configure the indicator timeline in Cortex XSOAR 8.11 On-prem. - [Configure indicator expiration](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.11/investigate-and-respond-to-threats/threat-intel-management/indicator-configuration/configure-indicator-expiration.md): Configure indicator expiration in Cortex XSOAR 8.11 On-prem. - [Configure Threat Intel feed integrations](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.11/investigate-and-respond-to-threats/threat-intel-management/indicator-configuration/configure-threat-intel-feed-integrations.md): Configure threat intelligence feeds in Cortex XSOAR 8.11 On-prem. - [Exclude indicators from enrichment](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.11/investigate-and-respond-to-threats/threat-intel-management/indicator-configuration/exclude-indicators-from-enrichment.md): Exclude indicators from enrichment in Cortex XSOAR 8.11 On-prem. - [Configure Threat Intelligence Management playbooks to process indicators](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.11/investigate-and-respond-to-threats/threat-intel-management/indicator-configuration/configure-threat-intelligence-management-playbooks-to-process-indicators.md): Configure Threat Intel Management playbooks in Cortex XSOAR 8.11 On-prem. - [Export indicators](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.11/investigate-and-respond-to-threats/threat-intel-management/export-indicators.md): Export indicators in Cortex XSOAR 8.11 On-prem. - [Customize Threat Intel Reports](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.11/investigate-and-respond-to-threats/threat-intel-management/customize-threat-intel-reports.md): Customize Threat Intel Reports in Cortex XSOAR 8.11 On-prem. - [Create a Threat Intel Report type](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.11/investigate-and-respond-to-threats/threat-intel-management/customize-threat-intel-reports/create-a-threat-intel-report-type.md): Create Threat Intel Report types in Cortex XSOAR 8.11 On-prem. - [Create a Threat Intel Report field](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.11/investigate-and-respond-to-threats/threat-intel-management/customize-threat-intel-reports/create-a-threat-intel-report-field.md): Create Threat Intel Report fields in Cortex XSOAR 8.11 On-prem. - [Create a Threat Intel Report layout](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.11/investigate-and-respond-to-threats/threat-intel-management/customize-threat-intel-reports/create-a-threat-intel-report-layout.md): Create Threat Intel Report layouts in Cortex XSOAR 8.11 On-prem. - [Indicator management](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.11/investigate-and-respond-to-threats/threat-intel-management/indicator-management.md): Manage and search indicators in Cortex XSOAR 8.11 On-prem. - [Query indicators](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.11/investigate-and-respond-to-threats/threat-intel-management/indicator-management/query-indicators.md): Query indicators in Cortex XSOAR 8.11 On-prem. - [Indicator investigation](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.11/investigate-and-respond-to-threats/threat-intel-management/indicator-investigation.md): Investigate indicators in Cortex XSOAR 8.11 On-prem. - [Indicator verdict](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.11/investigate-and-respond-to-threats/threat-intel-management/indicator-investigation/indicator-verdict.md): Manage indicator verdicts in Cortex XSOAR 8.11 On-prem. - [Extract and enrich an indicator](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.11/investigate-and-respond-to-threats/threat-intel-management/indicator-investigation/extract-and-enrich-an-indicator.md): Extract and enrich indicators in Cortex XSOAR 8.11 On-prem. - [Expire an indicator](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.11/investigate-and-respond-to-threats/threat-intel-management/indicator-investigation/expire-an-indicator.md): Expire indicators in Cortex XSOAR 8.11 On-prem. - [Manage indicator relationships](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.11/investigate-and-respond-to-threats/threat-intel-management/indicator-investigation/manage-indicator-relationships.md): Manage indicator relationships in Cortex XSOAR 8.11 On-prem. - [Delete and exclude indicators](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.11/investigate-and-respond-to-threats/threat-intel-management/indicator-investigation/delete-and-exclude-indicators.md): Delete and exclude indicators in Cortex XSOAR 8.11 On-prem. - [Manage Threat Intel Reports](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.11/investigate-and-respond-to-threats/threat-intel-management/manage-threat-intel-reports.md): Manage Threat Intel Reports in Cortex XSOAR 8.11 On-prem. - [Troubleshoot](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.11/troubleshoot-and-reference/troubleshoot.md): Troubleshoot errors in Cortex XSOAR 8.11 On-prem. - [View system status in the System Diagnostics page](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.11/troubleshoot-and-reference/troubleshoot/view-system-status-in-the-system-diagnostics-page.md): View System Diagnostics status in Cortex XSOAR 8.11 On-prem. - [View Guard Rails warnings and errors](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.11/troubleshoot-and-reference/troubleshoot/view-guard-rails-warnings-and-errors.md): View Guard Rails warnings and errors in Cortex XSOAR 8.11 On-prem. - [Access logs and log bundles](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.11/troubleshoot-and-reference/troubleshoot/access-logs-and-log-bundles.md): Access logs and log bundles in Cortex XSOAR 8.11 On-prem. - [Management audit logs](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.11/troubleshoot-and-reference/troubleshoot/management-audit-logs.md): Manage audit logs in Cortex XSOAR 8.11 On-prem. - [Integration logs](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.11/troubleshoot-and-reference/troubleshoot/integration-logs.md): View integration logs in Cortex XSOAR 8.11 On-prem. - [Reference](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.11/troubleshoot-and-reference/reference.md): Explore reference information in Cortex XSOAR 8.11 On-prem. - [Cortex XSOAR concepts](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.11/troubleshoot-and-reference/reference/cortex-xsoar-concepts.md): Learn common concepts in Cortex XSOAR 8.11 On-prem. - [How to search in Cortex XSOAR](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.11/troubleshoot-and-reference/reference/how-to-search-in-cortex-xsoar.md): Search in Cortex XSOAR 8.11 On-prem using queries and search tools. - [How to use markdown in Cortex XSOAR](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.11/troubleshoot-and-reference/reference/how-to-use-markdown-in-cortex-xsoar.md): Use Markdown formatting in Cortex XSOAR 8.11 On-prem. - [User details and preferences](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.11/troubleshoot-and-reference/reference/user-details-and-preferences.md): Manage user details and preferences in Cortex XSOAR 8.11 On-prem. - [Server configurations](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.11/troubleshoot-and-reference/reference/server-configurations.md): Configure server settings in Cortex XSOAR 8.11 On-prem. - [New user FAQ](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.11/troubleshoot-and-reference/reference/new-user-faq.md): Find answers for new users of Cortex XSOAR 8.11 On-prem. - [Cortex XSOAR API](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.11/troubleshoot-and-reference/reference/cortex-xsoar-api.md): Generate API keys and make API calls in Cortex XSOAR 8.11 On-prem. - [Telemetry in Cortex XSOAR](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.11/troubleshoot-and-reference/reference/telemetry-in-cortex-xsoar.md): Understand telemetry collection in Cortex XSOAR 8.11 On-prem. - [Keyboard shortcuts](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.11/troubleshoot-and-reference/reference/keyboard-shortcuts.md): Use keyboard shortcuts in Cortex XSOAR 8.11 On-prem. - [Product support lifecycle](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.11/troubleshoot-and-reference/reference/product-support-lifecycle.md): Review the product support lifecycle for Cortex XSOAR 8.11 On-prem. - [Cortex XSOAR navigation cheat sheet](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.11/troubleshoot-and-reference/reference/cortex-xsoar-navigation-cheat-sheet.md): Navigate Cortex XSOAR 8.11 On-prem with the navigation cheat sheet. - [What is Cortex XSOAR multi-tenant?](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.11/multi-tenant/what-is-cortex-xsoar-multi-tenant.md): Learn about multi-tenant deployments in Cortex XSOAR 8.11 On-prem. - [Onboard Cortex XSOAR multi-tenant](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.11/multi-tenant/onboard-cortex-xsoar-multi-tenant.md): Install, pair, and manage tenants in Cortex XSOAR 8.11 On-prem multi-tenant deployments. - [Onboarding checklist for multi-tenant deployments](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.11/multi-tenant/onboard-cortex-xsoar-multi-tenant/onboarding-checklist-for-multi-tenant-deployments.md): Follow the multi-tenant onboarding checklist in Cortex XSOAR 8.11 On-prem. - [Step 1. Install Cortex XSOAR for multi-tenant](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.11/multi-tenant/onboard-cortex-xsoar-multi-tenant/step-1.-install-cortex-xsoar-for-multi-tenant.md): Install Cortex XSOAR 8.11 On-prem for a multi-tenant deployment. - [Step 2. Pair the child tenant to main tenant](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.11/multi-tenant/onboard-cortex-xsoar-multi-tenant/step-2.-pair-child-tenant-to-main-tenant.md): Pair child tenants to the main tenant in Cortex XSOAR 8.11 On-prem. - [Step 3. Set up an engine](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.11/multi-tenant/onboard-cortex-xsoar-multi-tenant/step-3.-set-up-an-engine.md): Set up engines for multi-tenant deployments in Cortex XSOAR 8.11 On-prem. - [Step 4. Set up users and roles](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.11/multi-tenant/onboard-cortex-xsoar-multi-tenant/step-4.-set-up-users-and-roles.md): Set up users and roles for multi-tenant deployments in Cortex XSOAR 8.11 On-prem. - [Step 5. Install and configure content](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.11/multi-tenant/onboard-cortex-xsoar-multi-tenant/step-5.-install-and-configure-content.md): Install and configure content for multi-tenant deployments in Cortex XSOAR 8.11 On-prem. - [Child tenant management](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.11/multi-tenant/child-tenant-management.md): Manage child tenants and their content in Cortex XSOAR 8.11 On-prem. - [Content management in multi-tenant](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.11/multi-tenant/child-tenant-management/content-management-in-multi-tenant.md): Manage content across tenants in Cortex XSOAR 8.11 On-prem multi-tenant deployments. - [Add propagation labels to content](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.11/multi-tenant/child-tenant-management/content-management-in-multi-tenant/add-propagation-labels-to-content.md): Add propagation labels to content in Cortex XSOAR 8.11 On-prem. - [Add propagation labels to a child tenant](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.11/multi-tenant/child-tenant-management/content-management-in-multi-tenant/add-propagation-labels-to-a-child-tenant.md): Add propagation labels to child tenants in Cortex XSOAR 8.11 On-prem. - [Sync content to child tenants](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.11/multi-tenant/child-tenant-management/content-management-in-multi-tenant/sync-content-to-child-tenants.md): Sync content to child tenants in Cortex XSOAR 8.11 On-prem. - [Manage content using a remote repository](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.11/multi-tenant/child-tenant-management/content-management-in-multi-tenant/manage-content-using-a-remote-repository.md): Manage multi-tenant content with a remote repository in Cortex XSOAR 8.11 On-prem. - [Incident management on the main tenant](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.11/multi-tenant/incident-management-on-the-main-tenant.md): Manage incidents on the main tenant in Cortex XSOAR 8.11 On-prem. - [Run a command on multiple tenants](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.11/multi-tenant/incident-management-on-the-main-tenant/run-a-command-on-multiple-tenants.md): Run commands across multiple tenants in Cortex XSOAR 8.11 On-prem. - [Indicator management on the main tenant](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.11/multi-tenant/indicator-management-on-the-main-tenant.md): Manage indicators on the main tenant in Cortex XSOAR 8.11 On-prem. * [Cortex XSOAR 8.10 On-prem documentation](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.10/learn-about-cortex-xsoar/readme.md): Access Cortex XSOAR 8.10 On-prem documentation for onboarding, configuration, threat investigation, troubleshooting, and multi-tenant deployments. * [Get Started with Cortex XSOAR](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.10/learn-about-cortex-xsoar/get-started-with-cortex-xsoar.md): In Cortex XSOAR 8.10 On-prem, get started with architecture, roles, responsibilities, and licenses. * [What is Cortex XSOAR?](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.10/learn-about-cortex-xsoar/get-started-with-cortex-xsoar/what-is-cortex-xsoar.md): Learn about Cortex XSOAR 8.10 On-prem features. * [Cortex XSOAR architecture](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.10/learn-about-cortex-xsoar/get-started-with-cortex-xsoar/cortex-xsoar-architecture.md): Learn about the Cortex XSOAR 8.10 On-prem architecture. * [Cortex XSOAR use cases](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.10/learn-about-cortex-xsoar/get-started-with-cortex-xsoar/cortex-xsoar-use-cases.md): Explore SOC automation use cases in Cortex XSOAR 8.10 On-prem. * [Understand Cortex XSOAR licenses](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.10/learn-about-cortex-xsoar/get-started-with-cortex-xsoar/understand-cortex-xsoar-licenses.md): In Cortex XSOAR 8.10 On-prem, learn how licenses control components and tenant access. * [Roles and responsibilities](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.10/learn-about-cortex-xsoar/get-started-with-cortex-xsoar/roles-and-responsibilities.md): In Cortex XSOAR 8.10 On-prem, learn about the core roles in a SOC team. * [Supported web browsers](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.10/learn-about-cortex-xsoar/get-started-with-cortex-xsoar/supported-web-browsers.md): View supported web browsers for Cortex XSOAR 8.10 On-prem. * [Onboard and configure Cortex XSOAR](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.10/onboard-cortex-xsoar/onboard-and-configure-cortex-xsoar.md): In Cortex XSOAR 8.10 On-prem, follow the steps to onboard and configure your environment. * [Plan your deployment](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.10/onboard-cortex-xsoar/onboard-and-configure-cortex-xsoar/plan-your-deployment.md): In Cortex XSOAR 8.10 On-prem, review deployment considerations and onboarding steps. * [Onboarding checklist](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.10/onboard-cortex-xsoar/onboard-and-configure-cortex-xsoar/onboarding-checklist.md): In Cortex XSOAR 8.10 On-prem, activate, provision, grant access, and configure your tenant. * [Step 1. Install Cortex XSOAR](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.10/onboard-cortex-xsoar/onboard-and-configure-cortex-xsoar/step-1.-install-cortex-xsoar.md): In Cortex XSOAR 8.10 On-prem, install your environment, verify requirements, and add a license. * [Step 2. Set up an engine](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.10/onboard-cortex-xsoar/onboard-and-configure-cortex-xsoar/step-2.-set-up-an-engine.md): In Cortex XSOAR 8.10 On-prem, set up an engine on a remote machine. * [Step 3. Set up a remote repository](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.10/onboard-cortex-xsoar/onboard-and-configure-cortex-xsoar/step-3.-set-up-a-remote-repository.md): In Cortex XSOAR 8.10 On-prem, set up a remote repository for development and production content. * [Step 4. Set up users and roles](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.10/onboard-cortex-xsoar/onboard-and-configure-cortex-xsoar/step-4.-set-up-users-and-roles.md): In Cortex XSOAR 8.10 On-prem, configure users, permissions, and predefined roles. * [Step 5. Install and configure content](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.10/onboard-cortex-xsoar/onboard-and-configure-cortex-xsoar/step-5.-install-and-configure-content.md): In Cortex XSOAR 8.10 On-prem, install and configure the content for your use case. * [Install content packs](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.10/onboard-cortex-xsoar/onboard-and-configure-cortex-xsoar/step-5.-install-and-configure-content/install-content-packs.md): In Cortex XSOAR 8.10 On-prem, install content packs for your use case. * [Set up your use case with the Deployment Wizard](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.10/onboard-cortex-xsoar/onboard-and-configure-cortex-xsoar/step-5.-install-and-configure-content/set-up-your-use-case-with-the-deployment-wizard.md): In Cortex XSOAR 8.10 On-prem, use the Deployment Wizard to adopt your use case. * [Post deployment](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.10/onboard-cortex-xsoar/onboard-and-configure-cortex-xsoar/post-deployment.md): Complete post-deployment tasks in Cortex XSOAR 8.10 On-prem. * [User communication](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.10/onboard-cortex-xsoar/onboard-and-configure-cortex-xsoar/post-deployment/user-communication.md): Manage user communications after deploying Cortex XSOAR 8.10 On-prem. * [Configure system settings](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.10/onboard-cortex-xsoar/onboard-and-configure-cortex-xsoar/post-deployment/configure-system-settings.md): Configure system settings in Cortex XSOAR 8.10 On-prem. * [Configure Cortex XSOAR](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.10/onboard-cortex-xsoar/onboard-and-configure-cortex-xsoar/configure-cortex-xsoar.md): In Cortex XSOAR 8.10 On-prem, configure engines, playbooks, scripts, and dashboards. * [Cortex XSOAR Installation](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.10/onboard-cortex-xsoar/cortex-xsoar-installation.md): In Cortex XSOAR 8.10 On-prem, install, complete post-installation tasks, and upgrade your tenant. * [Installation overview](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.10/onboard-cortex-xsoar/cortex-xsoar-installation/installation-overview.md): In Cortex XSOAR 8.10 On-prem, review installation requirements and add a license. * [High Availability for Cortex XSOAR](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.10/onboard-cortex-xsoar/cortex-xsoar-installation/high-availability-for-cortex-xsoar.md): Configure High Availability for reliable Cortex XSOAR 8.10 On-prem operation. * [Load balancing for Cortex XSOAR](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.10/onboard-cortex-xsoar/cortex-xsoar-installation/load-balancing-for-cortex-xsoar.md): Configure load balancing for reliable Cortex XSOAR 8.10 On-prem operation. * [System Requirements](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.10/onboard-cortex-xsoar/cortex-xsoar-installation/system-requirements.md): Verify that Cortex XSOAR 8.10 On-prem meets the minimum system requirements. * [Hardware requirements](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.10/onboard-cortex-xsoar/cortex-xsoar-installation/system-requirements/hardware-requirements.md): View hardware requirements for Cortex XSOAR 8.10 On-prem. * [Port requirements for cluster communication](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.10/onboard-cortex-xsoar/cortex-xsoar-installation/system-requirements/port-requirements-for-cluster-communication.md): Add required cluster communication ports for Cortex XSOAR 8.10 On-prem. * [URL requirements](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.10/onboard-cortex-xsoar/cortex-xsoar-installation/system-requirements/url-requirements.md): Add required URLs for Cortex XSOAR 8.10 On-prem. * [Bandwidth and NTP requirements](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.10/onboard-cortex-xsoar/cortex-xsoar-installation/system-requirements/bandwidth-and-ntp-requirements.md): Review bandwidth and NTP requirements for Cortex XSOAR 8.10 On-prem. * [Install Cortex XSOAR on a VM deployed on AWS](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.10/onboard-cortex-xsoar/cortex-xsoar-installation/install-cortex-xsoar-on-a-vm-deployed-on-aws.md): Install Cortex XSOAR 8.10 On-prem on an AWS virtual machine. * [Task 1. Download the OVA Image and license from Cortex Gateway](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.10/onboard-cortex-xsoar/cortex-xsoar-installation/install-cortex-xsoar-on-a-vm-deployed-on-aws/task-1.-download-the-ova-image-and-license-from-cortex-gateway.md): Download the OVA image and license for Cortex XSOAR 8.10 On-prem. * [Task 2. Deploy your virtual machine on AWS](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.10/onboard-cortex-xsoar/cortex-xsoar-installation/install-cortex-xsoar-on-a-vm-deployed-on-aws/task-2.-deploy-your-virtual-machine-on-aws.md): Deploy a virtual machine on AWS for Cortex XSOAR 8.10 On-prem. * [Task 3. Validate tenant network and IP settings](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.10/onboard-cortex-xsoar/cortex-xsoar-installation/install-cortex-xsoar-on-a-vm-deployed-on-aws/task-3.-validate-tenant-nework-and-ip-settings.md): Validate tenant network and IP settings for Cortex XSOAR 8.10 On-prem. * [Task 4. Configure NTP servers](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.10/onboard-cortex-xsoar/cortex-xsoar-installation/install-cortex-xsoar-on-a-vm-deployed-on-aws/task-4.-configure-ntp-servers.md): Configure NTP servers for Cortex XSOAR 8.10 On-prem. * [Task 5. (Optional) Configure proxy settings](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.10/onboard-cortex-xsoar/cortex-xsoar-installation/install-cortex-xsoar-on-a-vm-deployed-on-aws/task-5.-optional-configure-proxy-settings.md): Configure optional proxy settings for Cortex XSOAR 8.10 On-prem. * [Task 6. Establish trust between all nodes in a cluster](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.10/onboard-cortex-xsoar/cortex-xsoar-installation/install-cortex-xsoar-on-a-vm-deployed-on-aws/task-6.-establish-trust-between-all-nodes-in-a-cluster.md): Establish cluster node trust in Cortex XSOAR 8.10 On-prem. * [Task 7. Install Cortex XSOAR on your VM](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.10/onboard-cortex-xsoar/cortex-xsoar-installation/install-cortex-xsoar-on-a-vm-deployed-on-aws/task-7.-install-cortex-xsoar-on-your-vm.md): Install Cortex XSOAR 8.10 On-prem on your virtual machine. * [Task 8. Verify you can log into Cortex XSOAR](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.10/onboard-cortex-xsoar/cortex-xsoar-installation/install-cortex-xsoar-on-a-vm-deployed-on-aws/task-8.-verify-you-can-log-into-cortex-xsoar.md): Verify access to your Cortex XSOAR 8.10 On-prem tenant. * [Install Cortex XSOAR on a VM deployed on OCI](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.10/onboard-cortex-xsoar/cortex-xsoar-installation/install-cortex-xsoar-on-a-vm-deployed-on-oci.md): Install Cortex XSOAR 8.10 On-prem on an OCI virtual machine. * [Task 1. Download the OVA image and license from Cortex Gateway](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.10/onboard-cortex-xsoar/cortex-xsoar-installation/install-cortex-xsoar-on-a-vm-deployed-on-oci/task-1.-download-the-ova-image-and-license-from-cortex-gateway.md): Download the OVA image and license for Cortex XSOAR 8.10 On-prem. * [Task 2. Deploy your virtual machine on OCI](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.10/onboard-cortex-xsoar/cortex-xsoar-installation/install-cortex-xsoar-on-a-vm-deployed-on-oci/task-2.-deploy-your-virtual-machine-on-oci.md): Deploy a virtual machine on OCI for Cortex XSOAR 8.10 On-prem. * [Task 3. Validate tenant network and IP settings](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.10/onboard-cortex-xsoar/cortex-xsoar-installation/install-cortex-xsoar-on-a-vm-deployed-on-oci/task-3.-validate-tenant-network-and-ip-settings.md): Validate tenant network and IP settings for Cortex XSOAR 8.10 On-prem. * [Task 4. Configure NTP servers](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.10/onboard-cortex-xsoar/cortex-xsoar-installation/install-cortex-xsoar-on-a-vm-deployed-on-oci/task-4.-configure-ntp-servers.md): Configure NTP servers for Cortex XSOAR 8.10 On-prem. * [Task 5. (Optional) Configure proxy settings](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.10/onboard-cortex-xsoar/cortex-xsoar-installation/install-cortex-xsoar-on-a-vm-deployed-on-oci/task-5.-optional-configure-proxy-settings.md): Configure optional proxy settings for Cortex XSOAR 8.10 On-prem. * [Task 6. Establish trust between all nodes in a cluster](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.10/onboard-cortex-xsoar/cortex-xsoar-installation/install-cortex-xsoar-on-a-vm-deployed-on-oci/task-6.-establish-trust-between-all-nodes-in-a-cluster.md): Establish cluster node trust in Cortex XSOAR 8.10 On-prem. * [Task 7. Install Cortex XSOAR on your VM](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.10/onboard-cortex-xsoar/cortex-xsoar-installation/install-cortex-xsoar-on-a-vm-deployed-on-oci/task-7.-install-cortex-xsoar-on-your-vm.md): Install Cortex XSOAR 8.10 On-prem on your virtual machine. * [Task 8. Verify you can log into Cortex XSOAR](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.10/onboard-cortex-xsoar/cortex-xsoar-installation/install-cortex-xsoar-on-a-vm-deployed-on-oci/task-8.-verify-you-can-log-into-cortex-xsoar.md): Verify access to your Cortex XSOAR 8.10 On-prem tenant. * [Install Cortex XSOAR on a VM deployed on Hyper-V](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.10/onboard-cortex-xsoar/cortex-xsoar-installation/install-cortex-xsoar-on-a-vm-deployed-on-hyper-v.md): Install Cortex XSOAR 8.10 On-prem on a Hyper-V virtual machine. * [Install Cortex XSOAR on a VM deployed on VSphere](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.10/onboard-cortex-xsoar/cortex-xsoar-installation/install-cortex-xsoar-on-a-vm-deployed-on-vsphere.md): Install Cortex XSOAR 8.10 On-prem on a vSphere virtual machine. * [Post-installation](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.10/onboard-cortex-xsoar/cortex-xsoar-installation/post-installation.md): In Cortex XSOAR 8.10 On-prem, add a license, configure certificates, and complete post-installation maintenance. * [Add the Cortex XSOAR license](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.10/onboard-cortex-xsoar/cortex-xsoar-installation/post-installation/add-the-cortex-xsoar-license.md): Download and add a Cortex XSOAR 8.10 On-prem license from Cortex Gateway. * [HTTPS with a signed certificate](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.10/onboard-cortex-xsoar/cortex-xsoar-installation/post-installation/https-with-a-signed-certificate.md): Configure HTTPS with a signed certificate in Cortex XSOAR 8.10 On-prem. * [Use a signed certificate instead of SSL verification](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.10/onboard-cortex-xsoar/cortex-xsoar-installation/post-installation/use-a-signed-certificate-instead-of-ssl-verification.md): Use a signed certificate with Cortex XSOAR 8.10 On-prem for MSSP deployments. * [Optimize performance and robustness from the textual UI](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.10/onboard-cortex-xsoar/cortex-xsoar-installation/post-installation/optimize-performance-and-robustness-from-the-textual-ui.md): In Cortex XSOAR 8.10 On-prem, optimize system performance from the textual UI. * [Manage nodes in a cluster](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.10/onboard-cortex-xsoar/cortex-xsoar-installation/post-installation/optimize-performance-and-robustness-from-the-textual-ui/manage-nodes-in-a-cluster.md): In Cortex XSOAR 8.10 On-prem, manage cluster nodes from the textual UI. * [Scale up hardware resources](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.10/onboard-cortex-xsoar/cortex-xsoar-installation/post-installation/optimize-performance-and-robustness-from-the-textual-ui/optimize-performance-and-robustness-from-the-textual-ui.md): Scale up hardware resources for Cortex XSOAR 8.10 On-prem. * [Auto expand PVC volumes](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.10/onboard-cortex-xsoar/cortex-xsoar-installation/post-installation/optimize-performance-and-robustness-from-the-textual-ui/auto-expand-pvc-volumes.md): Automatically expand PVC volumes in Cortex XSOAR 8.10 On-prem. * [Troubleshoot your installation](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.10/onboard-cortex-xsoar/cortex-xsoar-installation/troubleshoot-your-installation.md): In Cortex XSOAR 8.10 On-prem, troubleshoot installation from the textual UI. * [Common installation limitations and fixes](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.10/onboard-cortex-xsoar/cortex-xsoar-installation/troubleshoot-your-installation/common-installation-limitations-and-fixes.md): Troubleshoot common Cortex XSOAR 8.10 On-prem installation issues. * [Access logs and log bundles](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.10/onboard-cortex-xsoar/cortex-xsoar-installation/troubleshoot-your-installation/access-logs-and-log-bundles.md): In Cortex XSOAR 8.10 On-prem, access logs and log bundles for troubleshooting. * [Open a support session](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.10/onboard-cortex-xsoar/cortex-xsoar-installation/troubleshoot-your-installation/open-a-support-session.md): Open a support session from the Cortex XSOAR 8.10 On-prem textual UI. * [Upload your license to the textual UI](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.10/onboard-cortex-xsoar/cortex-xsoar-installation/troubleshoot-your-installation/upload-your-license-to-the-textual-ui.md): Upload a license through the Cortex XSOAR 8.10 On-prem textual UI. * [Shut down Cortex XSOAR](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.10/onboard-cortex-xsoar/cortex-xsoar-installation/troubleshoot-your-installation/shut-down-cortex-xsoar.md): Shut down Cortex XSOAR 8.10 On-prem from the textual UI. * [Update Cortex XSOAR](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.10/onboard-cortex-xsoar/cortex-xsoar-installation/update-cortex-xsoar.md): Upgrade your Cortex XSOAR 8.10 On-prem tenant to the latest version. * [Back up and Restore Cortex XSOAR](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.10/onboard-cortex-xsoar/back-up-and-restore-cortex-xsoar.md): In Cortex XSOAR 8.10 On-prem, back up and restore your cluster and data. * [Set up access to an external storage](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.10/onboard-cortex-xsoar/back-up-and-restore-cortex-xsoar/set-up-access-to-an-external-storage.md): In Cortex XSOAR 8.10 On-prem, set up access to external storage. * [Back up data](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.10/onboard-cortex-xsoar/back-up-and-restore-cortex-xsoar/back-up-data.md): In Cortex XSOAR 8.10 On-prem, schedule and perform on-demand data backups. * [Backup guidelines and best practices](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.10/onboard-cortex-xsoar/back-up-and-restore-cortex-xsoar/back-up-data/backup-guidelines-and-best-practices.md): Follow backup guidelines and best practices for Cortex XSOAR 8.10 On-prem. * [Restore data](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.10/onboard-cortex-xsoar/back-up-and-restore-cortex-xsoar/restore-data.md): In Cortex XSOAR 8.10 On-prem, restore data from an on-demand backup. * [End-to-end example of Cortex XSOAR cluster backup and restore](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.10/onboard-cortex-xsoar/back-up-and-restore-cortex-xsoar/end-to-end-example-of-cortex-xsoar-cluster-backup-and-restore.md): Review an end-to-end backup and restore workflow in Cortex XSOAR 8.10 On-prem. * [Common backup and restore limitations and fixes](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.10/onboard-cortex-xsoar/back-up-and-restore-cortex-xsoar/common-backup-and-restore-limitations-and-fixes.md): Troubleshoot common Cortex XSOAR 8.10 On-prem backup and restore issues. * [Engines](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.10/configure-cortex-xsoar/engines.md): In Cortex XSOAR 8.10 On-prem, install, manage, configure, and troubleshoot engines. * [What is an engine?](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.10/configure-cortex-xsoar/engines/what-is-an-engine.md): Learn about engines in Cortex XSOAR 8.10 On-prem. * [Engine requirements](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.10/configure-cortex-xsoar/engines/engine-requirements.md): Review engine hardware, operating system, and URL requirements for Cortex XSOAR 8.10 On-prem. * [Install an engine](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.10/configure-cortex-xsoar/engines/install-an-engine.md): In Cortex XSOAR 8.10 On-prem, install, deploy, and configure engines. * [Engine air gap installation](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.10/configure-cortex-xsoar/engines/install-an-engine/engine-air-gap-installation.md): Install an offline engine for Cortex XSOAR 8.10 On-prem on RHEL 8. * [Docker](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.10/configure-cortex-xsoar/engines/install-an-engine/docker.md): Configure Docker installation, security, and troubleshooting for Cortex XSOAR 8.10 On-prem. * [Install Docker](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.10/configure-cortex-xsoar/engines/install-an-engine/docker/install-docker.md): Install Docker for Cortex XSOAR 8.10 On-prem engines. * [Install Docker distribution for Red Hat on an engine server](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.10/configure-cortex-xsoar/engines/install-an-engine/docker/install-docker/install-docker-distribution-for-red-hat-on-an-engine-server.md): Install Docker for Red Hat on a Cortex XSOAR 8.10 On-prem engine server. * [Docker image security](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.10/configure-cortex-xsoar/engines/install-an-engine/docker/install-docker/docker-image-security.md): Configure Docker image security for Cortex XSOAR 8.10 On-prem. * [Use the Cortex XSOAR Container Registry](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.10/configure-cortex-xsoar/engines/install-an-engine/docker/install-docker/use-the-cortex-xsoar-container-registry.md): Use the Cortex XSOAR 8.10 On-prem Container Registry. * [Docker FAQs](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.10/configure-cortex-xsoar/engines/install-an-engine/docker/install-docker/docker-faqs.md): Find Docker answers for Cortex XSOAR 8.10 On-prem engines. * [Troubleshoot Docker issues](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.10/configure-cortex-xsoar/engines/install-an-engine/docker/install-docker/troubleshoot-docker-issues.md): Troubleshoot Docker issues in Cortex XSOAR 8.10 On-prem. * [Configure Docker pull rate limit](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.10/configure-cortex-xsoar/engines/install-an-engine/docker/install-docker/configure-docker-pull-rate-limit.md): Configure Docker pull rate limits for Cortex XSOAR 8.10 On-prem. * [Change the Docker installation folder](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.10/configure-cortex-xsoar/engines/install-an-engine/docker/install-docker/change-the-docker-installation-folder.md): Change the Docker installation folder for Cortex XSOAR 8.10 On-prem. * [Configure Docker integrations to trust custom certificates](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.10/configure-cortex-xsoar/engines/install-an-engine/docker/configure-docker-integrations-to-trust-custom-certificates.md): Configure Docker integrations to trust custom certificates in Cortex XSOAR 8.10 On-prem. * [Docker hardening guide](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.10/configure-cortex-xsoar/engines/install-an-engine/docker/docker-hardening-guide.md): Harden Docker for Cortex XSOAR 8.10 On-prem engines. * [Podman](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.10/configure-cortex-xsoar/engines/install-an-engine/podman.md): Run Podman containers for Cortex XSOAR 8.10 On-prem engines on RHEL 8. * [Install Podman](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.10/configure-cortex-xsoar/engines/install-an-engine/podman/install-podman.md): Install Podman for Cortex XSOAR 8.10 On-prem engines. * [Change container storage directory](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.10/configure-cortex-xsoar/engines/install-an-engine/podman/change-container-storage-directory.md): Change the container storage directory for Cortex XSOAR 8.10 On-prem. * [Migrate From Docker to Podman](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.10/configure-cortex-xsoar/engines/install-an-engine/podman/migrate-from-docker-to-podman.md): Migrate from Docker to Podman for Cortex XSOAR 8.10 On-prem engines. * [Troubleshoot Podman](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.10/configure-cortex-xsoar/engines/install-an-engine/podman/troubleshoot-podman.md): Troubleshoot Podman for Cortex XSOAR 8.10 On-prem engines. * [Manage engines](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.10/configure-cortex-xsoar/engines/manage-engines.md): In Cortex XSOAR 8.10 On-prem, manage engines and load-balancing groups. * [Upgrade an engine](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.10/configure-cortex-xsoar/engines/upgrade-an-engine.md): Upgrade a Cortex XSOAR 8.10 On-prem engine from the tenant or remote machine. * [Remove an engine](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.10/configure-cortex-xsoar/engines/remove-an-engine.md): Remove a Cortex XSOAR 8.10 On-prem engine using the relevant operating system command. * [Configure engines](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.10/configure-cortex-xsoar/engines/configure-engines.md): In Cortex XSOAR 8.10 On-prem, configure engines with d1.conf or the UI. * [Configure the engine to use a web proxy](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.10/configure-cortex-xsoar/engines/configure-engines/configure-the-engine-to-use-a-web-proxy.md): Configure a Cortex XSOAR 8.10 On-prem engine to use a web proxy. * [Configure the engine to call the server without using a proxy](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.10/configure-cortex-xsoar/engines/configure-engines/configure-the-engine-to-call-the-server-without-using-a-proxy.md): Configure a Cortex XSOAR 8.10 On-prem engine to call the server without a proxy. * [Use NGINX as a reverse proxy](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.10/configure-cortex-xsoar/engines/configure-engines/configure-the-engine-to-call-the-server-without-using-a-proxy/use-nginx-as-a-reverse-proxy.md): Use NGINX as a reverse proxy for Cortex XSOAR 8.10 On-prem engines. * [Configure an engine to use custom certificates](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.10/configure-cortex-xsoar/engines/configure-an-engine-to-use-custom-certificates.md): Configure custom certificates for a Cortex XSOAR 8.10 On-prem engine. * [Use an engine in an integration](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.10/configure-cortex-xsoar/engines/use-an-engine-in-an-integration.md): In Cortex XSOAR 8.10 On-prem, use engines to fetch alerts and run integration commands. * [Run a script using an engine](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.10/configure-cortex-xsoar/engines/run-a-script-using-an-engine.md): In Cortex XSOAR 8.10 On-prem, run scripts using engines and load-balancing groups. * [Troubleshoot engines](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.10/configure-cortex-xsoar/engines/troubleshoot-engines.md): Troubleshoot Cortex XSOAR 8.10 On-prem engines using logs and errors. * [Troubleshoot integrations running on engines](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.10/configure-cortex-xsoar/engines/troubleshoot-integrations-running-on-engines.md): Troubleshoot integrations running on Cortex XSOAR 8.10 On-prem engines. * [Remote Repository Management](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.10/configure-cortex-xsoar/remote-repository-management.md): In Cortex XSOAR 8.10 On-prem, configure and manage remote repositories for dev and production. * [Content management in Cortex XSOAR](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.10/configure-cortex-xsoar/remote-repository-management/content-management-in-cortex-xsoar.md): Learn how remote repositories manage content in Cortex XSOAR 8.10 On-prem. * [Set up a private remote repository](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.10/configure-cortex-xsoar/remote-repository-management/set-up-a-private-remote-repository.md): Set up a private remote repository in Cortex XSOAR 8.10 On-prem. * [How to set up a private remote repository](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.10/configure-cortex-xsoar/remote-repository-management/set-up-a-private-remote-repository/how-to-set-up-a-private-remote-repository.md): Learn how to set up a private remote repository in Cortex XSOAR 8.10 On-prem. * [Push content from a development tenant](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.10/configure-cortex-xsoar/remote-repository-management/push-content-from-a-development-tenant.md): In Cortex XSOAR 8.10 On-prem, push development content to a remote repository. * [Install content on a production tenant](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.10/configure-cortex-xsoar/remote-repository-management/install-content-on-a-production-tenant.md): In Cortex XSOAR 8.10 On-prem, install remote repository content on a production tenant. * [Remote repository troubleshooting](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.10/configure-cortex-xsoar/remote-repository-management/remote-repository-troubleshooting.md): Troubleshoot remote repository content management in Cortex XSOAR 8.10 On-prem. * [Users and Roles Management](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.10/configure-cortex-xsoar/users-and-roles-management.md): In Cortex XSOAR 8.10 On-prem, manage users, roles, groups, and authentication. * [Users and roles in Cortex XSOAR](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.10/configure-cortex-xsoar/users-and-roles-management/users-and-roles-in-cortex-xsoar.md): In Cortex XSOAR 8.10 On-prem, configure roles, groups, authentication, and users. * [Roles management](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.10/configure-cortex-xsoar/users-and-roles-management/roles-management.md): Configure roles in a Cortex XSOAR 8.10 On-prem tenant. * [Role-based permissions](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.10/configure-cortex-xsoar/users-and-roles-management/roles-management/role-based-permissions.md): Review role-based permissions in Cortex XSOAR 8.10 On-prem. * [Manage roles in the Cortex XSOAR tenant](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.10/configure-cortex-xsoar/users-and-roles-management/roles-management/manage-roles-in-the-cortex-xsoar-tenant.md): Manage roles in a Cortex XSOAR 8.10 On-prem tenant. * [User group management](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.10/configure-cortex-xsoar/users-and-roles-management/user-group-management.md): Create user groups and assign roles and users in Cortex XSOAR 8.10 On-prem. * [Set up authentication](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.10/configure-cortex-xsoar/users-and-roles-management/set-up-authentication.md): In Cortex XSOAR 8.10 On-prem, configure local or SSO authentication. * [Create users in Cortex XSOAR](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.10/configure-cortex-xsoar/users-and-roles-management/set-up-authentication/create-users-in-cortex-xsoar.md): In Cortex XSOAR 8.10 On-prem, create users with username and password access. * [Authenticate users using SSO](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.10/configure-cortex-xsoar/users-and-roles-management/set-up-authentication/authenticate-users-using-sso.md): Set up SSO authentication in a Cortex XSOAR 8.10 On-prem tenant. * [Set up Okta as the Identity Provider Using SAML 2.0](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.10/configure-cortex-xsoar/users-and-roles-management/set-up-authentication/set-up-okta-as-the-identity-provider-using-saml-2.0.md): Set up Okta SAML 2.0 authentication for Cortex XSOAR 8.10 On-prem. * [Set up Microsoft Entra ID as the Identity Provider Using SAML 2.0](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.10/configure-cortex-xsoar/users-and-roles-management/set-up-authentication/set-up-microsoft-entra-id-as-the-identity-provider-using-saml-2.0.md): Set up Microsoft Entra ID SAML 2.0 authentication for Cortex XSOAR 8.10 On-prem. * [User management](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.10/configure-cortex-xsoar/users-and-roles-management/user-management.md): In Cortex XSOAR 8.10 On-prem, invite users and assign roles and groups. * [Configure a password policy](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.10/configure-cortex-xsoar/users-and-roles-management/configure-a-password-policy.md): Configure and edit the password policy in Cortex XSOAR 8.10 On-prem. * [Marketplace](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.10/configure-cortex-xsoar/marketplace.md): In Cortex XSOAR 8.10 On-prem, use Marketplace content packs for your use case. * [Cortex Marketplace](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.10/configure-cortex-xsoar/marketplace/cortex-marketplace.md): Search Cortex Marketplace content for Cortex XSOAR 8.10 On-prem use cases and integrations. * [Content packs](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.10/configure-cortex-xsoar/marketplace/content-packs.md): Download Marketplace content packs for your Cortex XSOAR 8.10 On-prem use case. * [Content Pack Support Types](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.10/configure-cortex-xsoar/marketplace/content-pack-support-types.md): Learn content pack support types for Cortex XSOAR 8.10 On-prem. * [Manage content packs](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.10/configure-cortex-xsoar/marketplace/manage-content-packs.md): Manage content packs in Cortex XSOAR 8.10 On-prem. * [Set up your use case with the Deployment Wizard](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.10/configure-cortex-xsoar/marketplace/set-up-your-use-case-with-the-deployment-wizard.md): In Cortex XSOAR 8.10 On-prem, use the Deployment Wizard to adopt your use case. * [Marketplace FAQs](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.10/configure-cortex-xsoar/marketplace/marketplace-faqs.md): Find Marketplace content answers for Cortex XSOAR 8.10 On-prem. * [Content pack update notifications](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.10/configure-cortex-xsoar/marketplace/content-pack-update-notifications.md): Enable content pack update notifications in Cortex XSOAR 8.10 On-prem. * [Customize content pack notifications](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.10/configure-cortex-xsoar/marketplace/content-pack-update-notifications/customize-content-pack-notifications.md): Customize content pack update notifications in Cortex XSOAR 8.10 On-prem. * [Content pack contributions](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.10/configure-cortex-xsoar/marketplace/content-pack-contributions.md): Create content packs for the Cortex XSOAR 8.10 On-prem Marketplace. * [Create a content pack](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.10/configure-cortex-xsoar/marketplace/content-pack-contributions/create-a-content-pack.md): Create and submit a content pack for Cortex XSOAR 8.10 On-prem Marketplace. * [Resubmit a content pack](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.10/configure-cortex-xsoar/marketplace/content-pack-contributions/resubmit-a-content-pack.md): Resubmit an updated content pack from Cortex XSOAR 8.10 On-prem. * [Integrations](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.10/configure-cortex-xsoar/integrations.md): In Cortex XSOAR 8.10 On-prem, configure integrations, manage credentials, run commands, and troubleshoot. * [Integration use cases](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.10/configure-cortex-xsoar/integrations/integration-use-cases.md): Explore common integration use cases in Cortex XSOAR 8.10 On-prem. * [Configure integrations](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.10/configure-cortex-xsoar/integrations/configure-integrations.md): Configure or create an integration in Cortex XSOAR 8.10 On-prem. * [Change the Docker image in an integration or script](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.10/configure-cortex-xsoar/integrations/change-the-docker-image-in-an-integration-or-script.md): Change Docker images for integrations and scripts in Cortex XSOAR 8.10 On-prem. * [Connect your engine to an image registry](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.10/configure-cortex-xsoar/integrations/change-the-docker-image-in-an-integration-or-script/connect-your-engine-to-an-image-registry.md): Connect an engine to an authenticated image registry in Cortex XSOAR 8.10 On-prem. * [Pull images from a private image registry](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.10/configure-cortex-xsoar/integrations/change-the-docker-image-in-an-integration-or-script/pull-images-from-a-private-image-registry.md): Pull images from a private registry for Cortex XSOAR 8.10 On-prem. * [Manage credentials](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.10/configure-cortex-xsoar/integrations/manage-credentials.md): Manage integration credentials in Cortex XSOAR 8.10 On-prem. * [Configure an external credentials vault](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.10/configure-cortex-xsoar/integrations/manage-credentials/configure-an-external-credentials-vault.md): Configure an external credentials vault in Cortex XSOAR 8.10 On-prem. * [Add an integration instance](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.10/configure-cortex-xsoar/integrations/add-an-integration-instance.md): Set up an integration instance in Cortex XSOAR 8.10 On-prem and ingest incidents or indicators. * [Fetch incidents from an integration instance](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.10/configure-cortex-xsoar/integrations/add-an-integration-instance/fetch-incidents-from-an-integration-instance.md): Fetch incidents from an integration instance into Cortex XSOAR 8.10 On-prem. * [Receive notifications on an incident fetch error](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.10/configure-cortex-xsoar/integrations/add-an-integration-instance/receive-notifications-on-an-incident-fetch-error.md): Configure notifications for integration fetch errors in Cortex XSOAR 8.10 On-prem. * [Configure integration permissions](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.10/configure-cortex-xsoar/integrations/add-an-integration-instance/configure-integration-permissions.md): Restrict integration commands by role in Cortex XSOAR 8.10 On-prem. * [Troubleshoot integrations](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.10/configure-cortex-xsoar/integrations/add-an-integration-instance/troubleshoot-integrations.md): Troubleshoot integrations in Cortex XSOAR 8.10 On-prem. * [Integration commands in the CLI](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.10/configure-cortex-xsoar/integrations/integration-commands-in-the-cli.md): Run integration commands from the Cortex XSOAR 8.10 On-prem CLI. * [Forward requests to long-running integrations](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.10/configure-cortex-xsoar/integrations/forward-requests-to-long-running-integrations.md): Forward requests to long-running integrations in Cortex XSOAR 8.10 On-prem. * [Incident configuration](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.10/configure-cortex-xsoar/incident-configuration.md): In Cortex XSOAR 8.10 On-prem, customize incidents, rules, workflows, and exports. * [Incident lifecycle](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.10/configure-cortex-xsoar/incident-configuration/incident-lifecycle.md): Learn the incident lifecycle in Cortex XSOAR 8.10 On-prem. * [Incident Customization](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.10/configure-cortex-xsoar/incident-configuration/incident-customization.md): Create and edit incident types, fields, and layouts in Cortex XSOAR 8.10 On-prem. * [Use incident context data](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.10/configure-cortex-xsoar/incident-configuration/incident-customization/use-incident-context-data.md): Use context data to populate and customize incidents in Cortex XSOAR 8.10 On-prem. * [Create an incident type](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.10/configure-cortex-xsoar/incident-configuration/incident-customization/create-an-incident-type.md): Create and edit incident types in Cortex XSOAR 8.10 On-prem. * [Create an incident field](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.10/configure-cortex-xsoar/incident-configuration/incident-customization/create-an-incident-field.md): Create custom incident fields in Cortex XSOAR 8.10 On-prem. * [Incident layout customization](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.10/configure-cortex-xsoar/incident-configuration/incident-customization/incident-layout-customization.md): Customize incident layouts in Cortex XSOAR 8.10 On-prem. * [Classification and mapping](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.10/configure-cortex-xsoar/incident-configuration/classification-and-mapping.md): Classify and map integration instances in Cortex XSOAR 8.10 On-prem. * [Create an incident classifier](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.10/configure-cortex-xsoar/incident-configuration/classification-and-mapping/create-an-incident-classifier.md): Create incident classifiers for integration ingestion in Cortex XSOAR 8.10 On-prem. * [Create an incident mapper](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.10/configure-cortex-xsoar/incident-configuration/classification-and-mapping/create-an-incident-mapper.md): Create and apply incident mappers in Cortex XSOAR 8.10 On-prem. * [Set up incident mirroring](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.10/configure-cortex-xsoar/incident-configuration/set-up-incident-mirroring.md): Set up incident mirroring with integrations in Cortex XSOAR 8.10 On-prem. * [Incident deduplication in Cortex XSOAR](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.10/configure-cortex-xsoar/incident-configuration/incident-deduplication-in-cortex-xsoar.md): Deduplicate incidents using rules or playbooks in Cortex XSOAR 8.10 On-prem. * [Pre-process rules](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.10/configure-cortex-xsoar/incident-configuration/pre-process-rules.md): Create pre-process rules for incoming incidents in Cortex XSOAR 8.10 On-prem. * [Use post-processing scripts in an incident](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.10/configure-cortex-xsoar/incident-configuration/use-post-processing-scripts-in-an-incident.md): Use post-processing scripts for incidents in Cortex XSOAR 8.10 On-prem. * [Create a post-processing script](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.10/configure-cortex-xsoar/incident-configuration/use-post-processing-scripts-in-an-incident/create-a-post-processing-script.md): Create post-processing scripts for incidents in Cortex XSOAR 8.10 On-prem. * [Customize incident close reasons](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.10/configure-cortex-xsoar/incident-configuration/customize-incident-close-reasons.md): Customize incident close reasons in Cortex XSOAR 8.10 On-prem. * [Configure inline value fields](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.10/configure-cortex-xsoar/incident-configuration/configure-inline-value-fields.md): Configure inline value fields in Cortex XSOAR 8.10 On-prem incident layouts. * [Configure incident export and delete](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.10/configure-cortex-xsoar/incident-configuration/configure-incident-export-and-delete.md): Configure incident export and deletion in Cortex XSOAR 8.10 On-prem. * [Configure access to external storage](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.10/configure-cortex-xsoar/incident-configuration/configure-incident-export-and-delete/configure-access-to-external-storage.md): Configure external storage access for Cortex XSOAR 8.10 On-prem incident exports. * [Schedule incident export and delete](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.10/configure-cortex-xsoar/incident-configuration/configure-incident-export-and-delete/schedule-incident-export-and-delete.md): Schedule incident exports and deletions to external storage in Cortex XSOAR 8.10 On-prem. * [Export an incident to CSV using the UTF8-BOM format](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.10/configure-cortex-xsoar/incident-configuration/export-an-incident-to-csv-using-the-utf8-bom-format.md): Export incidents to UTF8-BOM CSV in Cortex XSOAR 8.10 On-prem. * [Amazon S3 configuration example](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.10/configure-cortex-xsoar/incident-configuration/amazon-s3-configuration-example.md): Configure Amazon S3 storage for Cortex XSOAR 8.10 On-prem backups and exports. * [Playbooks](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.10/configure-cortex-xsoar/playbooks.md): In Cortex XSOAR 8.10 On-prem, use playbooks to automate security workflows. * [What is a playbook?](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.10/configure-cortex-xsoar/playbooks/what-is-a-playbook.md): Learn how playbooks automate security processes in Cortex XSOAR 8.10 On-prem. * [Playbook development checklist](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.10/configure-cortex-xsoar/playbooks/playbook-development-checklist.md): Follow the playbook development flow in Cortex XSOAR 8.10 On-prem. * [Plan your playbook](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.10/configure-cortex-xsoar/playbooks/plan-your-playbook.md): Plan a playbook for Cortex XSOAR 8.10 On-prem. * [Develop your playbook](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.10/configure-cortex-xsoar/playbooks/develop-your-playbook.md): Create or customize playbooks in Cortex XSOAR 8.10 On-prem. * [Task 1. Choose from out-of-the-box playbooks or customize your own](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.10/configure-cortex-xsoar/playbooks/develop-your-playbook/task-1.-choose-from-out-of-the-box-playbooks-or-customize-your-own.md): Choose or customize a playbook in Cortex XSOAR 8.10 On-prem. * [Task 2. Configure playbook settings](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.10/configure-cortex-xsoar/playbooks/develop-your-playbook/task-2.-configure-playbook-settings.md): Configure playbook settings in Cortex XSOAR 8.10 On-prem. * [Task 3. Add tasks](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.10/configure-cortex-xsoar/playbooks/develop-your-playbook/task-3.-add-tasks.md): Add tasks to a playbook in Cortex XSOAR 8.10 On-prem. * [Task 4. Add custom playbook features](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.10/configure-cortex-xsoar/playbooks/develop-your-playbook/task-4.-add-custom-playbook-features.md): Add custom playbook features in Cortex XSOAR 8.10 On-prem. * [Task 5. Test and debug the playbook](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.10/configure-cortex-xsoar/playbooks/develop-your-playbook/task-5.-test-and-debug-the-playbook.md): Test and debug playbooks in Cortex XSOAR 8.10 On-prem. * [Task 6. Manage playbook content](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.10/configure-cortex-xsoar/playbooks/develop-your-playbook/task-6.-manage-playbook-content.md): Manage playbook content in Cortex XSOAR 8.10 On-prem. * [Customize a playbook for a phishing use case example](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.10/configure-cortex-xsoar/playbooks/develop-your-playbook/customize-a-playbook-for-a-phishing-use-case-example.md): Customize a phishing response playbook in Cortex XSOAR 8.10 On-prem. * [Customize your playbook](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.10/configure-cortex-xsoar/playbooks/customize-your-playbook.md): In Cortex XSOAR 8.10 On-prem, customize playbooks with indicators, context, fields, and polling. * [Customize the SOC name](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.10/configure-cortex-xsoar/playbooks/customize-your-playbook/customize-the-soc-name.md): Customize the SOC name for communication tasks in Cortex XSOAR 8.10 On-prem. * [Configure a sub-playbook](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.10/configure-cortex-xsoar/playbooks/customize-your-playbook/configure-a-sub-playbook.md): Configure and loop sub-playbooks in Cortex XSOAR 8.10 On-prem. * [Filter and transform data](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.10/configure-cortex-xsoar/playbooks/customize-your-playbook/filter-and-transform-data.md): Filter and transform data in Cortex XSOAR 8.10 On-prem playbooks. * [Extract indicators](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.10/configure-cortex-xsoar/playbooks/customize-your-playbook/extract-indicators.md): Extract and enrich indicators in Cortex XSOAR 8.10 On-prem playbooks. * [Extend context](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.10/configure-cortex-xsoar/playbooks/customize-your-playbook/extend-context.md): Extend context with integration and command data in Cortex XSOAR 8.10 On-prem. * [Set and update incident fields](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.10/configure-cortex-xsoar/playbooks/customize-your-playbook/set-and-update-incident-fields.md): Set and update incident fields in Cortex XSOAR 8.10 On-prem playbooks. * [Playbook polling](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.10/configure-cortex-xsoar/playbooks/customize-your-playbook/playbook-polling.md): Use playbook polling in Cortex XSOAR 8.10 On-prem. * [Scripts](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.10/configure-cortex-xsoar/playbooks/scripts.md): Create and manage scripts in Cortex XSOAR 8.10 On-prem. * [Configure existing scripts](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.10/configure-cortex-xsoar/playbooks/scripts/common-scripts.md): Configure existing scripts in Cortex XSOAR 8.10 On-prem. * [Create a script](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.10/configure-cortex-xsoar/playbooks/scripts/create-a-script.md): Create or edit scripts in Cortex XSOAR 8.10 On-prem. * [Debug your playbook](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.10/configure-cortex-xsoar/playbooks/debug-your-playbook.md): Debug playbooks using breakpoints and overrides in Cortex XSOAR 8.10 On-prem. * [Troubleshoot playbook performance](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.10/configure-cortex-xsoar/playbooks/debug-your-playbook/troubleshoot-playbook-performance.md): Troubleshoot playbook performance in Cortex XSOAR 8.10 On-prem. * [Manage playbook content](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.10/configure-cortex-xsoar/playbooks/manage-playbook-content.md): Manage playbook content with repositories or versions in Cortex XSOAR 8.10 On-prem. * [Best practices](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.10/configure-cortex-xsoar/playbooks/best-practices.md): Follow playbook best practices in Cortex XSOAR 8.10 On-prem. * [Lists](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.10/configure-cortex-xsoar/lists.md): In Cortex XSOAR 8.10 On-prem, create and manage lists for playbooks and scripts. * [What is a list?](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.10/configure-cortex-xsoar/lists/what-is-a-list.md): Learn how lists store data in Cortex XSOAR 8.10 On-prem. * [Use cases](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.10/configure-cortex-xsoar/lists/what-is-a-list/use-cases.md): Explore list use cases in Cortex XSOAR 8.10 On-prem. * [Create a list](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.10/configure-cortex-xsoar/lists/create-a-list.md): Create and manage lists in Cortex XSOAR 8.10 On-prem. * [List commands](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.10/configure-cortex-xsoar/lists/list-commands.md): Use list commands in Cortex XSOAR 8.10 On-prem CLI, playbooks, and scripts. * [Use cases: JSON lists](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.10/configure-cortex-xsoar/lists/use-cases-json-lists.md): Manage JSON lists for automation and playbooks in Cortex XSOAR 8.10 On-prem. * [Transform a list into an array](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.10/configure-cortex-xsoar/lists/transform-a-list-into-an-array.md): Transform a list into an array in Cortex XSOAR 8.10 On-prem. * [Jobs](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.10/configure-cortex-xsoar/jobs.md): In Cortex XSOAR 8.10 On-prem, create jobs that automatically run playbooks. * [Manage jobs](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.10/configure-cortex-xsoar/jobs/manage-jobs.md): Manage time-triggered and event-triggered jobs in Cortex XSOAR 8.10 On-prem. * [Create a time triggered job](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.10/configure-cortex-xsoar/jobs/create-a-time-triggered-job.md): Create time-triggered jobs that run playbooks in Cortex XSOAR 8.10 On-prem. * [Create a job triggered by a delta in a feed](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.10/configure-cortex-xsoar/jobs/create-a-job-triggered-by-a-delta-in-a-feed.md): Create feed-triggered jobs in Cortex XSOAR 8.10 On-prem. * [Create jobs to process indicators example](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.10/configure-cortex-xsoar/jobs/create-jobs-to-process-indicators-example.md): Process and send indicators to a SIEM with jobs in Cortex XSOAR 8.10 On-prem. * [SLAs](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.10/configure-cortex-xsoar/slas.md): In Cortex XSOAR 8.10 On-prem, configure SLAs and timers to track incident response. * [SLAs in Cortex XSOAR](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.10/configure-cortex-xsoar/slas/slas-in-cortex-xsoar.md): Use SLAs and timer fields to track incidents in Cortex XSOAR 8.10 On-prem. * [Configure an SLA in an incident type](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.10/configure-cortex-xsoar/slas/configure-an-sla-in-an-incident-type.md): Configure SLA due dates for incident types in Cortex XSOAR 8.10 On-prem. * [Configure Timer/SLA fields](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.10/configure-cortex-xsoar/slas/configure-timersla-fields.md): Configure Timer/SLA fields and breach scripts in Cortex XSOAR 8.10 On-prem. * [Configure a playbook to run Timers/SLAs](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.10/configure-cortex-xsoar/slas/configure-a-playbook-to-run-timersslas.md): Configure playbooks to run SLA timers in Cortex XSOAR 8.10 On-prem. * [Automate changes to incident fields using SLA scripts](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.10/configure-cortex-xsoar/slas/automate-changes-to-incident-fields-using-sla-scripts.md): Automate incident field changes with SLA scripts in Cortex XSOAR 8.10 On-prem. * [Create SLA scripts](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.10/configure-cortex-xsoar/slas/create-sla-scripts.md): Create SLA breach scripts in Cortex XSOAR 8.10 On-prem. * [Use SLA and Timer field commands manually in the CLI](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.10/configure-cortex-xsoar/slas/use-sla-and-timer-field-commands-manually-in-the-cli.md): Manage SLA and Timer fields with CLI commands in Cortex XSOAR 8.10 On-prem. * [Configure the Global Risk Threshold](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.10/configure-cortex-xsoar/slas/configure-the-global-risk-threshold.md): Configure global SLA risk thresholds in Cortex XSOAR 8.10 On-prem. * [Search incidents for Timer/SLAs](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.10/configure-cortex-xsoar/slas/search-incidents-for-timerslas.md): Search incidents by SLA and timer fields in Cortex XSOAR 8.10 On-prem. * [Dashboards and Reports](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.10/configure-cortex-xsoar/dashboards-and-reports.md): In Cortex XSOAR 8.10 On-prem, create and manage dashboards, reports, and widgets. * [Dashboards](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.10/configure-cortex-xsoar/dashboards-and-reports/dashboards.md): Create and manage dashboards in Cortex XSOAR 8.10 On-prem. * [Default dashboards](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.10/configure-cortex-xsoar/dashboards-and-reports/dashboards/default-dashboards.md): Configure default dashboards in Cortex XSOAR 8.10 On-prem. * [Dashboard actions](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.10/configure-cortex-xsoar/dashboards-and-reports/dashboards/dashboard-actions.md): Create, import, share, and manage dashboards in Cortex XSOAR 8.10 On-prem. * [Manage dashboards](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.10/configure-cortex-xsoar/dashboards-and-reports/dashboards/manage-dashboards.md): Create, customize, and share dashboards in Cortex XSOAR 8.10 On-prem. * [Reports](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.10/configure-cortex-xsoar/dashboards-and-reports/reports.md): Create, schedule, and manage reports in Cortex XSOAR 8.10 On-prem. * [Manage reports](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.10/configure-cortex-xsoar/dashboards-and-reports/reports/manage-reports.md): Create, customize, schedule, and generate reports in Cortex XSOAR 8.10 On-prem. * [Configure the timezone in a report](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.10/configure-cortex-xsoar/dashboards-and-reports/reports/configure-the-timezone-in-a-report.md): Configure report time zones and time formats in Cortex XSOAR 8.10 On-prem. * [Troubleshoot script timeout for reports](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.10/configure-cortex-xsoar/dashboards-and-reports/reports/troubleshoot-script-timeout-for-reports.md): Configure report script timeouts in Cortex XSOAR 8.10 On-prem. * [Troubleshoot overlapping text and extra pages](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.10/configure-cortex-xsoar/dashboards-and-reports/reports/troubleshoot-overlapping-text-and-extra-pages.md): Fix overlapping text and extra pages in Cortex XSOAR 8.10 On-prem PDF reports. * [Widgets](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.10/configure-cortex-xsoar/dashboards-and-reports/widgets.md): Create and manage dashboard and report widgets in Cortex XSOAR 8.10 On-prem. * [Widget customization](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.10/configure-cortex-xsoar/dashboards-and-reports/widgets/widget-customization.md): Create and customize widgets for dashboards and reports in Cortex XSOAR 8.10 On-prem. * [Create a widget using the widget builder](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.10/configure-cortex-xsoar/dashboards-and-reports/widgets/create-a-widget-using-the-widget-builder.md): Create widgets with the Widget Builder in Cortex XSOAR 8.10 On-prem. * [Create a custom widget using a JSON file](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.10/configure-cortex-xsoar/dashboards-and-reports/widgets/create-a-custom-widget-using-a-json-file.md): Create custom JSON widgets in Cortex XSOAR 8.10 On-prem. * [Create a custom widget using a script](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.10/configure-cortex-xsoar/dashboards-and-reports/widgets/create-a-custom-widget-using-a-script.md): Create custom script-based widgets in Cortex XSOAR 8.10 On-prem. * [Create a widget from an incident](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.10/configure-cortex-xsoar/dashboards-and-reports/widgets/create-a-widget-from-an-incident.md): Create widgets from incident searches in Cortex XSOAR 8.10 On-prem. * [Create a widget from an indicator](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.10/configure-cortex-xsoar/dashboards-and-reports/widgets/create-a-widget-from-an-indicator.md): Create widgets from indicators in Cortex XSOAR 8.10 On-prem. * [Edit a widget](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.10/configure-cortex-xsoar/dashboards-and-reports/widgets/edit-a-widget.md): Edit widgets in Cortex XSOAR 8.10 On-prem. * [Add a widget in the War Room](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.10/configure-cortex-xsoar/dashboards-and-reports/widgets/add-a-widget-in-the-war-room.md): Add script-based War Room widgets in Cortex XSOAR 8.10 On-prem. * [Saved By Dbot (ROI) Widget](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.10/configure-cortex-xsoar/dashboards-and-reports/widgets/saved-by-dbot-roi-widget.md): Customize the Saved by Dbot ROI widget in Cortex XSOAR 8.10 On-prem. * [Incidents and indicators investigation](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.10/investigate-and-respond-to-threats/incidents-and-indicators-investigation.md): Investigate incidents and indicators in Cortex XSOAR 8.10 On-prem. * [Incidents](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.10/investigate-and-respond-to-threats/incidents-and-indicators-investigation/incidents.md): Investigate and remediate security incidents in Cortex XSOAR 8.10 On-prem. * [Incident management](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.10/investigate-and-respond-to-threats/incidents-and-indicators-investigation/incident-management.md): View and manage incidents in Cortex XSOAR 8.10 On-prem. * [Search for incidents](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.10/investigate-and-respond-to-threats/incidents-and-indicators-investigation/incident-management/search-for-incidents.md): Search and save incident queries in Cortex XSOAR 8.10 On-prem. * [Create an incident](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.10/investigate-and-respond-to-threats/incidents-and-indicators-investigation/incident-management/create-an-incident.md): Create, ingest, or import incidents in Cortex XSOAR 8.10 On-prem. * [Export incidents](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.10/investigate-and-respond-to-threats/incidents-and-indicators-investigation/incident-management/export-incidents.md): Export incidents on demand or on a schedule in Cortex XSOAR 8.10 On-prem. * [Export incidents from the Incidents table](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.10/investigate-and-respond-to-threats/incidents-and-indicators-investigation/incident-management/export-incidents/export-incidents-from-the-incidents-table.md): Export incidents from the Incidents table as Excel, CSV, or JSON files in Cortex XSOAR 8.10 On-prem. * [Export incidents on demand](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.10/investigate-and-respond-to-threats/incidents-and-indicators-investigation/incident-management/export-incidents/export-incidents-on-demand.md): Export incidents on demand to external storage in Cortex XSOAR 8.10 On-prem. * [Investigate an incident](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.10/investigate-and-respond-to-threats/incidents-and-indicators-investigation/investigate-an-incident.md): Investigate incidents and take remediation steps in Cortex XSOAR 8.10 On-prem. * [Retain incidents](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.10/investigate-and-respond-to-threats/incidents-and-indicators-investigation/investigate-an-incident/retain-incidents.md): Retain incidents in Cortex XSOAR 8.10 On-prem. * [Limit access to investigations using access control](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.10/investigate-and-respond-to-threats/incidents-and-indicators-investigation/investigate-an-incident/limit-access-to-investigations-using-access-control.md): Limit access to incidents and investigations in Cortex XSOAR 8.10 On-prem. * [Incident Tasks](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.10/investigate-and-respond-to-threats/incidents-and-indicators-investigation/investigate-an-incident/incident-tasks.md): Manage playbook and to-do incident tasks in Cortex XSOAR 8.10 On-prem. * [Use the War Room in an investigation](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.10/investigate-and-respond-to-threats/incidents-and-indicators-investigation/investigate-an-incident/use-the-war-room-in-an-investigation.md): Use the War Room for real-time investigations in Cortex XSOAR 8.10 On-prem. * [Schedule a command in the War Room](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.10/investigate-and-respond-to-threats/incidents-and-indicators-investigation/investigate-an-incident/schedule-a-command-in-the-war-room.md): Schedule War Room commands in Cortex XSOAR 8.10 On-prem. * [Run commands in the CLI](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.10/investigate-and-respond-to-threats/incidents-and-indicators-investigation/investigate-an-incident/run-commands-in-the-cli.md): Run system, integration, and script commands in Cortex XSOAR 8.10 On-prem. * [Evidence Handling](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.10/investigate-and-respond-to-threats/incidents-and-indicators-investigation/investigate-an-incident/evidence-handling.md): Add and manage investigation evidence in Cortex XSOAR 8.10 On-prem. * [Use the Work Plan in an investigation](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.10/investigate-and-respond-to-threats/incidents-and-indicators-investigation/investigate-an-incident/use-the-work-plan-in-an-investigation.md): Monitor and manage incident playbook workflows in Cortex XSOAR 8.10 On-prem. * [Investigate an incident using the canvas](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.10/investigate-and-respond-to-threats/incidents-and-indicators-investigation/investigate-an-incident/investigate-an-incident-using-the-canvas.md): Visually map incidents with the investigation canvas in Cortex XSOAR 8.10 On-prem. * [Link incidents](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.10/investigate-and-respond-to-threats/incidents-and-indicators-investigation/investigate-an-incident/link-incidents.md): Link incidents from the interface or CLI in Cortex XSOAR 8.10 On-prem. * [Create an incident summary report](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.10/investigate-and-respond-to-threats/incidents-and-indicators-investigation/investigate-an-incident/create-an-incident-summary-report.md): Create incident summary reports in Cortex XSOAR 8.10 On-prem. * [Manage indicators](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.10/investigate-and-respond-to-threats/incidents-and-indicators-investigation/manage-indicators.md): Create, manage, and search indicators in Cortex XSOAR 8.10 On-prem. * [Query indicators](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.10/investigate-and-respond-to-threats/incidents-and-indicators-investigation/manage-indicators/query-indicators.md): Query indicators in Cortex XSOAR 8.10 On-prem without a TIM license. * [View indicator relationships in an investigation](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.10/investigate-and-respond-to-threats/incidents-and-indicators-investigation/manage-indicators/view-indicator-relationships-in-an-investigation.md): Create and investigate indicator relationships in Cortex XSOAR 8.10 On-prem. * [Threat Intel Management](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.10/investigate-and-respond-to-threats/threat-intel-management.md): Manage threat intelligence, indicators, and TIM reports in Cortex XSOAR 8.10 On-prem. * [Get started with Threat Intel Management](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.10/investigate-and-respond-to-threats/threat-intel-management/get-started-with-threat-intel-management.md): Get started with Threat Intel Management in Cortex XSOAR 8.10 On-prem. * [Licenses](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.10/investigate-and-respond-to-threats/threat-intel-management/get-started-with-threat-intel-management/licenses.md): Learn about Threat Intel Management licenses in Cortex XSOAR 8.10 On-prem. * [What is Threat Intel Management?](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.10/investigate-and-respond-to-threats/threat-intel-management/get-started-with-threat-intel-management/what-is-threat-intel-management.md): Learn about Threat Intel Management use cases in Cortex XSOAR 8.10 On-prem. * [Threat Intel Management use cases](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.10/investigate-and-respond-to-threats/threat-intel-management/get-started-with-threat-intel-management/threat-intel-management-use-cases.md): Explore Threat Intel Management use cases in Cortex XSOAR 8.10 On-prem. * [Indicator concepts](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.10/investigate-and-respond-to-threats/threat-intel-management/get-started-with-threat-intel-management/indicator-concepts.md): Learn core indicator concepts in Cortex XSOAR 8.10 On-prem. * [Indicator lifecycle](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.10/investigate-and-respond-to-threats/threat-intel-management/get-started-with-threat-intel-management/indicator-lifecycle.md): Learn the indicator lifecycle in Cortex XSOAR 8.10 On-prem. * [Roles and responsibilities in Threat Intel Management](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.10/investigate-and-respond-to-threats/threat-intel-management/get-started-with-threat-intel-management/roles-and-responsibilities-in-threat-intel-management.md): Learn Threat Intel Management roles in Cortex XSOAR 8.10 On-prem. * [Indicator configuration](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.10/investigate-and-respond-to-threats/threat-intel-management/indicator-configuration.md): Configure indicator types, fields, layouts, and enrichment in Cortex XSOAR 8.10 On-prem. * [Customize indicator types, fields, and layouts](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.10/investigate-and-respond-to-threats/threat-intel-management/indicator-configuration/customize-indicator-types-fields-and-layouts.md): Customize indicator types, fields, and layouts in Cortex XSOAR 8.10 On-prem. * [Indicator classification and mapping](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.10/investigate-and-respond-to-threats/threat-intel-management/indicator-configuration/indicator-classification-and-mapping.md): Configure indicator classification and mapping in Cortex XSOAR 8.10 On-prem. * [Indicator extraction](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.10/investigate-and-respond-to-threats/threat-intel-management/indicator-configuration/indicator-extraction.md): Extract and enrich indicators in Cortex XSOAR 8.10 On-prem. * [Configure the indicator timeline](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.10/investigate-and-respond-to-threats/threat-intel-management/indicator-configuration/configure-the-indicator-timeline.md): Configure the indicator timeline in Cortex XSOAR 8.10 On-prem. * [Configure indicator expiration](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.10/investigate-and-respond-to-threats/threat-intel-management/indicator-configuration/configure-indicator-expiration.md): Configure indicator expiration in Cortex XSOAR 8.10 On-prem. * [Configure Threat Intel feed integrations](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.10/investigate-and-respond-to-threats/threat-intel-management/indicator-configuration/configure-threat-intel-feed-integrations.md): Configure Threat Intel feed integrations in Cortex XSOAR 8.10 On-prem. * [Exclude indicators from enrichment](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.10/investigate-and-respond-to-threats/threat-intel-management/indicator-configuration/exclude-indicators-from-enrichment.md): Exclude indicators from enrichment in Cortex XSOAR 8.10 On-prem. * [Configure Threat Intelligence Management playbooks to process indicators](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.10/investigate-and-respond-to-threats/threat-intel-management/indicator-configuration/configure-threat-intelligence-management-playbooks-to-process-indicators.md): Configure Threat Intel Management playbooks in Cortex XSOAR 8.10 On-prem. * [Export indicators](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.10/investigate-and-respond-to-threats/threat-intel-management/export-indicators.md): Export indicators and configure external dynamic lists in Cortex XSOAR 8.10 On-prem. * [Customize Threat Intel Reports](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.10/investigate-and-respond-to-threats/threat-intel-management/customize-threat-intel-reports.md): Create and customize Threat Intel Reports in Cortex XSOAR 8.10 On-prem. * [Create a Threat Intel Report type](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.10/investigate-and-respond-to-threats/threat-intel-management/customize-threat-intel-reports/create-a-threat-intel-report-type.md): Create or detach Threat Intel Report types in Cortex XSOAR 8.10 On-prem. * [Create a Threat Intel Report field](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.10/investigate-and-respond-to-threats/threat-intel-management/customize-threat-intel-reports/create-a-threat-intel-report-field.md): Create Threat Intel Report fields in Cortex XSOAR 8.10 On-prem. * [Create a Threat Intel Report layout](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.10/investigate-and-respond-to-threats/threat-intel-management/customize-threat-intel-reports/create-a-threat-intel-report-layout.md): Configure Threat Intel Report layouts in Cortex XSOAR 8.10 On-prem. * [Indicator management](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.10/investigate-and-respond-to-threats/threat-intel-management/indicator-management.md): Create, manage, and search indicators in Cortex XSOAR 8.10 On-prem. * [Indicator investigation](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.10/investigate-and-respond-to-threats/threat-intel-management/indicator-investigation.md): Investigate indicators and relationships in Cortex XSOAR 8.10 On-prem. * [Indicator verdict](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.10/investigate-and-respond-to-threats/threat-intel-management/indicator-investigation/indicator-verdict.md): Configure indicator verdicts in Cortex XSOAR 8.10 On-prem. * [Extract and enrich an indicator](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.10/investigate-and-respond-to-threats/threat-intel-management/indicator-investigation/extract-and-enrich-an-indicator.md): Extract and enrich an indicator in Cortex XSOAR 8.10 On-prem. * [Expire an indicator](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.10/investigate-and-respond-to-threats/threat-intel-management/indicator-investigation/expire-an-indicator.md): Expire indicators from the CLI or UI in Cortex XSOAR 8.10 On-prem. * [Manage indicator relationships](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.10/investigate-and-respond-to-threats/threat-intel-management/indicator-investigation/manage-indicator-relationships.md): Create and manage indicator relationships in Cortex XSOAR 8.10 On-prem. * [Delete and exclude indicators](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.10/investigate-and-respond-to-threats/threat-intel-management/indicator-investigation/delete-and-exclude-indicators.md): Delete and exclude indicators in Cortex XSOAR 8.10 On-prem. * [Manage Threat Intel Reports](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.10/investigate-and-respond-to-threats/threat-intel-management/manage-threat-intel-reports.md): Manage Threat Intel Reports in Cortex XSOAR 8.10 On-prem. * [Troubleshoot](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.10/troubleshoot-and-reference/troubleshoot.md): Troubleshoot errors in Cortex XSOAR 8.10 On-prem. * [View system status in the System Diagnostics page](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.10/troubleshoot-and-reference/troubleshoot/view-system-status-in-the-system-diagnostics-page.md): View System Diagnostics errors in Cortex XSOAR 8.10 On-prem. * [View Guard Rails warnings and errors](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.10/troubleshoot-and-reference/troubleshoot/view-guard-rails-warnings-and-errors.md): Review Guard Rails warnings and errors in Cortex XSOAR 8.10 On-prem. * [Access logs and log bundles](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.10/troubleshoot-and-reference/troubleshoot/access-logs-and-log-bundles.md): Access logs and log bundles for troubleshooting in Cortex XSOAR 8.10 On-prem. * [Management audit logs](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.10/troubleshoot-and-reference/troubleshoot/management-audit-logs.md): Manage audit logs in Cortex XSOAR 8.10 On-prem. * [Integration logs](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.10/troubleshoot-and-reference/troubleshoot/integration-logs.md): View and export integration logs in Cortex XSOAR 8.10 On-prem. * [Reference](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.10/troubleshoot-and-reference/reference.md): Access product reference topics for Cortex XSOAR 8.10 On-prem. * [Cortex XSOAR concepts](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.10/troubleshoot-and-reference/reference/cortex-xsoar-concepts.md): Learn core concepts in Cortex XSOAR 8.10 On-prem. * [How to search in Cortex XSOAR](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.10/troubleshoot-and-reference/reference/how-to-search-in-cortex-xsoar.md): Search data using queries and search tools in Cortex XSOAR 8.10 On-prem. * [How to use markdown in Cortex XSOAR](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.10/troubleshoot-and-reference/reference/how-to-use-markdown-in-cortex-xsoar.md): Use markdown formatting in Cortex XSOAR 8.10 On-prem. * [User details and preferences](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.10/troubleshoot-and-reference/reference/user-details-and-preferences.md): Manage user details, preferences, and notifications in Cortex XSOAR 8.10 On-prem. * [Server configurations](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.10/troubleshoot-and-reference/reference/server-configurations.md): Configure and troubleshoot server settings in Cortex XSOAR 8.10 On-prem. * [New user FAQ](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.10/troubleshoot-and-reference/reference/new-user-faq.md): Find answers for new users of Cortex XSOAR 8.10 On-prem. * [Cortex XSOAR API](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.10/troubleshoot-and-reference/reference/cortex-xsoar-api.md): Generate an API key and make API calls in Cortex XSOAR 8.10 On-prem. * [Telemetry in Cortex XSOAR](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.10/troubleshoot-and-reference/reference/telemetry-in-cortex-xsoar.md): Learn how telemetry collects usage data in Cortex XSOAR 8.10 On-prem. * [Keyboard shortcuts](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.10/troubleshoot-and-reference/reference/keyboard-shortcuts.md): Use keyboard shortcuts in Cortex XSOAR 8.10 On-prem. * [Product support lifecycle](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.10/troubleshoot-and-reference/reference/product-support-lifecycle.md): Review the product support lifecycle for Cortex XSOAR 8.10 On-prem. * [Cortex XSOAR navigation cheat sheet](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.10/troubleshoot-and-reference/reference/cortex-xsoar-navigation-cheat-sheet.md): Navigate commonly used features in Cortex XSOAR 8.10 On-prem. * [Multi-tenant](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.10/multi-tenant/multi-tenant.md): Configure multi-tenant deployments in Cortex XSOAR 8.10 On-prem. * [What is Cortex XSOAR multi-tenant?](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.10/multi-tenant/multi-tenant/what-is-cortex-xsoar-multi-tenant.md): Learn about multi-tenant deployments in Cortex XSOAR 8.10 On-prem. * [Onboard Cortex XSOAR multi-tenant](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.10/multi-tenant/multi-tenant/onboard-cortex-xsoar-multi-tenant.md): Onboard main and child tenants in Cortex XSOAR 8.10 On-prem. * [Onboarding checklist for multi-tenant deployments](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.10/multi-tenant/multi-tenant/onboard-cortex-xsoar-multi-tenant/onboarding-checklist-for-multi-tenant-deployments.md): Follow the multi-tenant onboarding checklist in Cortex XSOAR 8.10 On-prem. * [Step 1. Install Cortex XSOAR for multi-tenant](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.10/multi-tenant/multi-tenant/onboard-cortex-xsoar-multi-tenant/step-1.-install-cortex-xsoar-for-multi-tenant.md): Install multi-tenant deployments in Cortex XSOAR 8.10 On-prem. * [Step 2. Pair child tenant to main tenant](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.10/multi-tenant/multi-tenant/onboard-cortex-xsoar-multi-tenant/step-2.-pair-child-tenant-to-main-tenant.md): Pair a child tenant with a main tenant in Cortex XSOAR 8.10 On-prem. * [Step 3. Set up an engine](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.10/multi-tenant/multi-tenant/onboard-cortex-xsoar-multi-tenant/step-3.-set-up-an-engine.md): Set up tenant engines in Cortex XSOAR 8.10 On-prem multi-tenant deployments. * [Step 4. Set up users and roles](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.10/multi-tenant/multi-tenant/onboard-cortex-xsoar-multi-tenant/step-4.-set-up-users-and-roles.md): Configure users and roles for multi-tenant Cortex XSOAR 8.10 On-prem. * [Step 5. Install and configure content](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.10/multi-tenant/multi-tenant/onboard-cortex-xsoar-multi-tenant/step-5.-install-and-configure-content.md): Install content for multi-tenant deployments in Cortex XSOAR 8.10 On-prem. * [Child tenant management](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.10/multi-tenant/multi-tenant/child-tenant-management.md): Manage child tenants and content in Cortex XSOAR 8.10 On-prem. * [Content management in multi-tenant](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.10/multi-tenant/multi-tenant/child-tenant-management/content-management-in-multi-tenant.md): Manage multi-tenant content in Cortex XSOAR 8.10 On-prem. * [Incident management on the main tenant](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.10/multi-tenant/multi-tenant/incident-management-on-the-main-tenant.md): Manage child-tenant incidents in Cortex XSOAR 8.10 On-prem. * [Manage main tenant users in an investigation](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.10/multi-tenant/multi-tenant/incident-management-on-the-main-tenant/manage-main-tenant-users-in-an-investigation.md): Manage main tenant users during investigations in Cortex XSOAR 8.10 On-prem. * [Run a command on multiple tenants](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.10/multi-tenant/multi-tenant/incident-management-on-the-main-tenant/run-a-command-on-multiple-tenants.md): Run commands across tenants in Cortex XSOAR 8.10 On-prem. * [Indicator management on the main tenant](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.10/multi-tenant/multi-tenant/indicator-management-on-the-main-tenant.md): Manage indicators from the main tenant in Cortex XSOAR 8.10 On-prem. * [Navigate the Cortex XSOAR 8.8 On-prem docs](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.8/learn-about-cortex-xsoar/readme.md): Start here for a visual overview of Cortex XSOAR On-prem 8.8 (EoL) documentation areas. ## Cortex XSOAR 8 FAQs - [Cortex XSOAR 8 FAQs](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-faqs/cortex-xsoar-8-faqs.md): Frequently asked questions for Cortex XSOAR 8 SaaS and Cortex XSOAR 8x On-prem. - [General information](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-faqs/cortex-xsoar-8-faqs/general-information.md): FAQ general information about Cortex XSOAR 8 SaaS and Cortex XSOAR 8 On-prem. - [Content Feature Requests](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-faqs/cortex-xsoar-8-faqs/content-feature-requests.md): How to submit content feature requests for Cortex XSOAR 8 SaaS and Cortex XSOAR 8 On-prem. - [Cortex XSOAR 8 SaaS FAQs](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-faqs/cortex-xsoar-8-faqs/cortex-xsoar-8-saas-faqs.md): Find answers about Cortex XSOAR 8 SaaS support, updates, security, licensing, access, and tenant operations. - [Customer Support Portal FAQs](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-faqs/cortex-xsoar-8-faqs/cortex-xsoar-8-saas-faqs/customer-support-portal-faqs.md): Find Cortex Customer Support Portal FAQs, including access, account, and support guidance. - [Cortex XSOAR 8 Updates](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-faqs/cortex-xsoar-8-faqs/cortex-xsoar-8-saas-faqs/cortex-xsoar-8-updates.md): Learn how Cortex XSOAR 8 SaaS updates work, including the upgrade process and release guidance. - [Remote Content Repository (Dev/Prod)](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-faqs/cortex-xsoar-8-faqs/cortex-xsoar-8-saas-faqs/remote-content-repository-dev-prod.md): Find Cortex XSOAR 8 SaaS FAQs for Dev and Prod remote content repositories. - [Upgrade from Cortex XSOAR 6](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-faqs/cortex-xsoar-8-faqs/cortex-xsoar-8-saas-faqs/upgrade-from-cortex-xsoar-6.md): Learn how to upgrade from Cortex XSOAR 6 to Cortex XSOAR 8 SaaS, including migration FAQs. - [MSSP and Multi-Tenancy Deployment](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-faqs/cortex-xsoar-8-faqs/cortex-xsoar-8-saas-faqs/mssp-and-multi-tenancy-deployment.md): Find Cortex XSOAR 8 SaaS FAQs for MSSP and multi-tenancy deployments. - [Licensing & Pricing](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-faqs/cortex-xsoar-8-faqs/cortex-xsoar-8-saas-faqs/licensing-and-pricing.md): Find Cortex XSOAR 8 SaaS FAQs for licensing, subscriptions, and pricing. - [Security](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-faqs/cortex-xsoar-8-faqs/cortex-xsoar-8-saas-faqs/security.md): Find Cortex XSOAR 8 SaaS FAQs for security, data protection, and platform controls. - [Backup and High Availability](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-faqs/cortex-xsoar-8-faqs/cortex-xsoar-8-saas-faqs/backup-and-high-availability.md): Find Cortex XSOAR 8 SaaS FAQs for backup, recovery, and high availability. - [Regions and Locations](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-faqs/cortex-xsoar-8-faqs/cortex-xsoar-8-saas-faqs/regions-and-locations.md): Find Cortex XSOAR 8 SaaS FAQs for available regions, data locations, and deployment options. - [Cortex XSOAR Tenant Health and Troubleshooting](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-faqs/cortex-xsoar-8-faqs/cortex-xsoar-8-saas-faqs/cortex-xsoar-tenant-health-and-troubleshooting.md): Monitor and troubleshoot Cortex XSOAR 8 SaaS tenant health with these FAQs. - [Access Management](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-faqs/cortex-xsoar-8-faqs/cortex-xsoar-8-saas-faqs/access-management.md): Find Cortex XSOAR 8 SaaS FAQs for user access, permissions, and identity management. - [Cortex XSOAR Offboarding](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-faqs/cortex-xsoar-8-faqs/cortex-xsoar-8-saas-faqs/cortex-xsoar-offboarding.md): Find Cortex XSOAR 8 SaaS FAQs for tenant offboarding and related processes. - [Cortex XSOAR 8 On-Prem FAQs](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-faqs/cortex-xsoar-8-faqs/cortex-xsoar-8-on-prem-faqs.md): FAQs for Cortex XSOAR 8x on-prem. - [Hardware Requirements](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-faqs/cortex-xsoar-8-faqs/cortex-xsoar-8-on-prem-faqs/hardware-requirements.md): Review VM hardware requirements for Cortex XSOAR 8x On-prem standalone and cluster deployments. - [Port requirements for cluster communication](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-faqs/cortex-xsoar-8-faqs/cortex-xsoar-8-on-prem-faqs/port-requirements-for-cluster-communication.md): Review required cluster communication ports for Cortex XSOAR 8x On-prem standalone and multi-node deployments. - [URL Requirements](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-faqs/cortex-xsoar-8-faqs/cortex-xsoar-8-on-prem-faqs/url-requirements.md): Configure required URLs, endpoints, and DNS records for Cortex XSOAR 8x On-prem. - [Bandwidth and NTP Requirements](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-faqs/cortex-xsoar-8-faqs/cortex-xsoar-8-on-prem-faqs/bandwidth-and-ntp-requirements.md): Review bandwidth and NTP synchronization requirements for Cortex XSOAR 8x On-prem. ## Cortex XSOAR 8 Feature Changes - [Cortex XSOAR 8 Feature Changes](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-feature-changes/cortex-xsoar-8-feature-changes/readme.md): Explore feature changes in Cortex XSOAR 8 SaaS and Cortex XSOAR 8x On-prem. - [Comparison between Cortex XSOAR 6 and Cortex XSOAR 8](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-feature-changes/cortex-xsoar-8-feature-changes/comparison-between-cortex-xsoar-6-and-cortex-xsoar-8.md): Compare Cortex XSOAR 6 with Cortex XSOAR 8 SaaS and Cortex XSOAR 8x On-prem. - [New Features for Users and Roles in Cortex XSOAR 8](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-feature-changes/cortex-xsoar-8-feature-changes/new-features-for-users-and-roles-in-cortex-xsoar-8.md): Review user and role features in Cortex XSOAR 8 SaaS and Cortex XSOAR 8x On-prem. - [Integration Instance Changes in Cortex XSOAR 8](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-feature-changes/cortex-xsoar-8-feature-changes/integration-instance-changes-in-cortex-xsoar-8.md): Review integration changes for Cortex XSOAR 8 SaaS and Cortex XSOAR 8x On-prem. - [Cortex XSOAR 8 API Changes](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-feature-changes/cortex-xsoar-8-feature-changes/cortex-xsoar-8-api-changes.md): Review API changes for Cortex XSOAR 8 SaaS and Cortex XSOAR 8x On-prem. ## FS-ISAC STIX/TAXII Guide for Cortex XSOAR - [FS-ISAC STIX/TAXII Guide for Cortex XSOAR](https://cortex-docs.paloaltonetworks.com/fs-isac-stix-taxii-guide-for-cortex-xsoar/fs-isac-stix-taxii-guide-for-cortex-xsoar.md): Configure Cortex XSOAR 8 SaaS or Cortex XSOAR 8x On-prem to connect to the FS-ISAC IntelX Repo through a STIX/TAXII feed integration. - [Connect to the FS-ISAC IntelX Exchange in Cortex XSOAR](https://cortex-docs.paloaltonetworks.com/fs-isac-stix-taxii-guide-for-cortex-xsoar/fs-isac-stix-taxii-guide-for-cortex-xsoar/connect-to-the-fs-isac-intelx-exchange-in-cortex-xsoar.md): Learn how to connect to the FS-ISAC IntexX Exchange in Cortex XSOAR 8 SaaS or Cortex XSOAR 8x On-prem. ## Demisto SDK Development Guide - [Introduction to Demisto SDK](https://cortex-docs.paloaltonetworks.com/demisto-sdk-development-guide/demisto-sdk-guide/readme.md): Introduction to the Demisto SDK Python library that assists with your content development needs. - [Install Demisto SDK](https://cortex-docs.paloaltonetworks.com/demisto-sdk-development-guide/demisto-sdk-guide/install-demisto-sdk.md): How to install the Demisto SDK or upgrade it if it is already installed. - [Environment variables setup](https://cortex-docs.paloaltonetworks.com/demisto-sdk-development-guide/demisto-sdk-guide/install-demisto-sdk/environment-variables-setup.md): Add environment variables for Cortex XSOAR and Cortex XSIAM. - [Create a preset custom command configuration](https://cortex-docs.paloaltonetworks.com/demisto-sdk-development-guide/demisto-sdk-guide/install-demisto-sdk/create-a-preset-custom-command-configuration.md): Create a custom configuration for demisto-sdk commands. - [Demisto SDK usage and configuration](https://cortex-docs.paloaltonetworks.com/demisto-sdk-development-guide/demisto-sdk-guide/demisto-sdk-usage-and-configuration.md): Configure and use the Demisto SDK, including content paths, logging, GitHub tokens, CLI commands, Docker, and offline environments. - [Run the Demisto SDK in a Docker container](https://cortex-docs.paloaltonetworks.com/demisto-sdk-development-guide/demisto-sdk-guide/demisto-sdk-usage-and-configuration/run-the-demisto-sdk-in-a-docker-container.md): Run Demisto SDK validations from within a Docker container. - [Using Docker](https://cortex-docs.paloaltonetworks.com/demisto-sdk-development-guide/demisto-sdk-guide/demisto-sdk-usage-and-configuration/using-docker.md): Use Docker to run Python scripts and integrations in a controlled environment. - [Demisto SDK commands](https://cortex-docs.paloaltonetworks.com/demisto-sdk-development-guide/demisto-sdk-guide/demisto-sdk-commands.md): Learn about the arguments and usage of Demisto SDK commands to manage your content. - [doc-review](https://cortex-docs.paloaltonetworks.com/demisto-sdk-development-guide/demisto-sdk-guide/demisto-sdk-commands/doc-review.md): Check spelling in Markdown and YAML files, and validate release notes against Cortex content standards. - [download](https://cortex-docs.paloaltonetworks.com/demisto-sdk-development-guide/demisto-sdk-guide/demisto-sdk-commands/download.md): Download and merge custom content from Cortex XSOAR or Cortex XSIAM into a local repository. - [format](https://cortex-docs.paloaltonetworks.com/demisto-sdk-development-guide/demisto-sdk-guide/demisto-sdk-commands/format.md): Format Cortex content files to meet standards and validate new or modified content. - [generate-docs](https://cortex-docs.paloaltonetworks.com/demisto-sdk-development-guide/demisto-sdk-guide/demisto-sdk-commands/generate-docs.md): Generate README documentation for Cortex XSOAR integrations, scripts, and playbooks. - [generate-integration](https://cortex-docs.paloaltonetworks.com/demisto-sdk-development-guide/demisto-sdk-guide/demisto-sdk-commands/generate-integration.md): Generate a Cortex XSOAR or Cortex XSIAM integration from an integration configuration JSON file. - [generate-outputs](https://cortex-docs.paloaltonetworks.com/demisto-sdk-development-guide/demisto-sdk-guide/demisto-sdk-commands/generate-outputs.md): Generate integration context outputs from JSON responses or command examples. - [generate-test-playbook](https://cortex-docs.paloaltonetworks.com/demisto-sdk-development-guide/demisto-sdk-guide/demisto-sdk-commands/generate-test-playbook.md): Generate Cortex XSOAR or Cortex XSIAM test playbooks from integration or script YAML files. - [generate-unit-tests](https://cortex-docs.paloaltonetworks.com/demisto-sdk-development-guide/demisto-sdk-guide/demisto-sdk-commands/generate-unit-tests.md): Generate unit test scaffolding from Cortex integration Python code and command examples. - [generate-yml-from-python](https://cortex-docs.paloaltonetworks.com/demisto-sdk-development-guide/demisto-sdk-guide/demisto-sdk-commands/generate-yml-from-python.md): Generate integration YAML metadata from Python code using the Demisto SDK metadata collector. - [graph commands](https://cortex-docs.paloaltonetworks.com/demisto-sdk-development-guide/demisto-sdk-guide/demisto-sdk-commands/graph-commands.md): Use Demisto SDK graph commands to build, inspect, and manage Cortex content relationships. - [init](https://cortex-docs.paloaltonetworks.com/demisto-sdk-development-guide/demisto-sdk-guide/demisto-sdk-commands/init.md): Initialize a new Cortex content pack structure with Demisto SDK. - [openapi-codegen](https://cortex-docs.paloaltonetworks.com/demisto-sdk-development-guide/demisto-sdk-guide/demisto-sdk-commands/openapi-codegen.md): Generate Cortex XSOAR integration code and configuration from an OpenAPI specification. - [postman-codegen](https://cortex-docs.paloaltonetworks.com/demisto-sdk-development-guide/demisto-sdk-guide/demisto-sdk-commands/postman-codegen.md): The postman-codegen command generates an integration file (YAML) from a Postman Collection. - [pre-commit](https://cortex-docs.paloaltonetworks.com/demisto-sdk-development-guide/demisto-sdk-guide/demisto-sdk-commands/pre-commit.md): Run Demisto SDK checks and validations on changed Cortex content before committing. - [prepare-content](https://cortex-docs.paloaltonetworks.com/demisto-sdk-development-guide/demisto-sdk-guide/demisto-sdk-commands/prepare-content.md): Prepare Cortex content files and packs for development, validation, or release workflows. - [run](https://cortex-docs.paloaltonetworks.com/demisto-sdk-development-guide/demisto-sdk-guide/demisto-sdk-commands/run.md): Run Cortex XSOAR integrations and scripts locally with the Demisto SDK. - [run-playbook](https://cortex-docs.paloaltonetworks.com/demisto-sdk-development-guide/demisto-sdk-guide/demisto-sdk-commands/run-playbook.md): Run Cortex XSOAR playbooks locally using the Demisto SDK command-line interface. - [secrets](https://cortex-docs.paloaltonetworks.com/demisto-sdk-development-guide/demisto-sdk-guide/demisto-sdk-commands/secrets.md): Detect and manage secrets in Cortex content with the Demisto SDK. - [setup-env](https://cortex-docs.paloaltonetworks.com/demisto-sdk-development-guide/demisto-sdk-guide/demisto-sdk-commands/setup-env.md): Configure the local environment for Demisto SDK and Cortex content development. - [split](https://cortex-docs.paloaltonetworks.com/demisto-sdk-development-guide/demisto-sdk-guide/demisto-sdk-commands/split.md): Split Cortex content files into the standard pack directory structure. - [update-release-notes](https://cortex-docs.paloaltonetworks.com/demisto-sdk-development-guide/demisto-sdk-guide/demisto-sdk-commands/update-release-notes.md): Create and update Cortex content release notes with the Demisto SDK. - [upload](https://cortex-docs.paloaltonetworks.com/demisto-sdk-development-guide/demisto-sdk-guide/demisto-sdk-commands/upload.md): Upload local custom content from a repository to Cortex XSOAR or Cortex XSIAM. - [validate](https://cortex-docs.paloaltonetworks.com/demisto-sdk-development-guide/demisto-sdk-guide/demisto-sdk-commands/validate.md): Validate Cortex content files and packs against Demisto SDK standards and checks. - [Validation checks](https://cortex-docs.paloaltonetworks.com/demisto-sdk-development-guide/demisto-sdk-guide/demisto-sdk-commands/validate/validation-checks.md): Reference the validation checks performed by the Demisto SDK validate command. - [zip-packs](https://cortex-docs.paloaltonetworks.com/demisto-sdk-development-guide/demisto-sdk-guide/demisto-sdk-commands/zip-packs.md): Package Cortex content packs into ZIP archives for distribution or upload. - [Contribute to the Demisto SDK](https://cortex-docs.paloaltonetworks.com/demisto-sdk-development-guide/demisto-sdk-guide/contribute-to-demisto-sdk.md): Set up your environment, develop and test SDK changes, submit pull requests, and document releases. ## Cortex XSOAR Migration Guide ## Cortex XSOAR 8 Retention Policy - [Retention Policy and Enforcement](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-retention-policy/cortex-xsoar-8-retention-policy-faqs/readme.md): Retention policy for Cortex XSOAR 8 SaaS. ## Cortex XSOAR 8 On-prem OSS Listings - [Cortex XSOAR On-prem OSS listings](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem-oss-listings/cortex-xdr-oss-listings.md): Open-Source Software (OSS) licensing for Cortex XSOAR 8x On-prem. - [Cortex XSOAR on-prem 8.14 OSS listings](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem-oss-listings/cortex-xdr-oss-listings/cortex-xdr-agent-9.2-oss-listing.md): Open source software components, versions, licenses, and required notices for Cortex XSOAR 8.14 on-prem. ## Cortex XSOAR 8 SaaS Releases - [Cortex XSOAR 8 SaaS Releases](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-saas-releases/cortex-xsoar-8-saas-releases.md): Major general availability releases for Cortex XSOAR 8 SaaS. ## Cortex XSOAR 6 Administrator Guides - [Cortex XSOAR 6 Administrator Guides](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/cortex-xsoar-6-administrator-guides.md): Start here to choose the right Cortex XSOAR 6 version. * [Navigate the Cortex XSOAR 6.15 Administrator Guide](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.15/learn-about-cortex-xsoar/readme.md): Start here for a visual overview of the main Cortex XSOAR 6.15 documentation areas. * [Overview](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.15/learn-about-cortex-xsoar/overview.md): Cortex XSOAR provides security orchestration, incident management, and interactive investigation. Overview of Cortex XSOAR 6.15 features and concepts. * [Get Started in Cortex XSOAR](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.15/learn-about-cortex-xsoar/get-started-in-cortex-xsoar.md): Get started with Cortex XSOAR 6.15. Learn core concepts, licenses, lifecycle support, API keys, search, CLI commands, and Markdown. * [Licenses](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.15/learn-about-cortex-xsoar/get-started-in-cortex-xsoar/licenses.md): Learn about Cortex XSOAR 6.15 licenses, editions, user types, license quotas, and multi-tenant licensing. * [FIPS Version](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.15/learn-about-cortex-xsoar/get-started-in-cortex-xsoar/fips-version.md): Learn about the vendor-affirmed Cortex XSOAR 6.15 FIPS version, its FIPS 140-3 cryptography, supported deployments, and limitations. * [Concepts](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.15/learn-about-cortex-xsoar/get-started-in-cortex-xsoar/concepts.md): Learn Cortex XSOAR 6.15 concepts, including incidents, integrations, playbooks, automations, commands, War Room, indicators, and Playground. * [Product Support Lifecycle](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.15/learn-about-cortex-xsoar/get-started-in-cortex-xsoar/product-support-lifecycle.md): Review Cortex XSOAR 6.15 release versioning, supported releases, end-of-life dates, and product support lifecycle guidance. * [API Keys](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.15/learn-about-cortex-xsoar/get-started-in-cortex-xsoar/api-keys.md): Generate, manage, revoke, and secure API keys for Cortex XSOAR 6.15 REST API access. * [Use the Command Line Interface](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.15/learn-about-cortex-xsoar/get-started-in-cortex-xsoar/use-the-command-line-interface.md): Use the CLI to run system and integration commands, automations, scripts, and user notifications in Cortex XSOAR 6.15. * [How to Search](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.15/learn-about-cortex-xsoar/get-started-in-cortex-xsoar/how-to-search.md): Search Cortex XSOAR 6.15 with Bleve query syntax, the search box, general search, filters, wildcards, and regular expressions. * [How to Use Markdown](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.15/learn-about-cortex-xsoar/get-started-in-cortex-xsoar/how-to-use-markdown.md): Use Markdown in Cortex XSOAR 6.15 to format text, add links, tables, images, and XSOAR-specific content elements. * [New User FAQ](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.15/learn-about-cortex-xsoar/get-started-in-cortex-xsoar/new-user-faq.md): Find answers to common Cortex XSOAR 6.15 new-user questions about content, log bundles, commands, notifications, dashboards, and search. * [Onboarding in Cortex XSOAR](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.15/onboard-cortex-xsoar/onboarding-in-cortex-xsoar.md): Onboarding process for Cortex XSOAR 6.15. * [Deployment Checklist - Best Practices](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.15/onboard-cortex-xsoar/deployment-checklist-best-practices.md): Overview of the deployment process, including best practices for Cortex XSOAR 6.15 installation and maintenance. * [Single Server Deployment](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.15/onboard-cortex-xsoar/single-server-deployment.md): Install, configure, upgrade, and maintain a Cortex XSOAR 6.15 single-server deployment. * [System Requirements](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.15/onboard-cortex-xsoar/single-server-deployment/system-requirements.md): Verify operating system, hardware, network, and software requirements for a Cortex XSOAR 6.15 single-server deployment. * [Deployment Guidelines](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.15/onboard-cortex-xsoar/single-server-deployment/deployment-guidelines.md): Review Cortex XSOAR 6.15 single-server deployment guidelines for AWS EC2, Microsoft Azure, and Google Cloud Platform. * [Install the Server for a Single Server Deployment](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.15/onboard-cortex-xsoar/single-server-deployment/install-the-server-for-a-single-server-deployment.md): Install Cortex XSOAR 6.15 on a single server with the application and database services on one host. * [Installer Flags](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.15/onboard-cortex-xsoar/single-server-deployment/install-the-server-for-a-single-server-deployment/installer-flags.md): Reference the Cortex XSOAR 6.15 installer flags for installation, upgrades, Elasticsearch, backups, and system configuration. * [Install the Server with Elasticsearch](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.15/onboard-cortex-xsoar/single-server-deployment/install-the-server-with-elasticsearch.md): Install Cortex XSOAR 6.15 with Elasticsearch. Review prerequisites and deployment steps for a new Elasticsearch-backed environment. * [Install the Server Offline](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.15/onboard-cortex-xsoar/single-server-deployment/install-the-server-offline.md): Install Cortex XSOAR 6.15 in an offline or air-gapped environment without internet access. * [Dependencies for Offline Installation](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.15/onboard-cortex-xsoar/single-server-deployment/install-the-server-offline/dependencies-for-offline-installation.md): Review required RPM and Ubuntu dependencies for an offline Cortex XSOAR 6.14 server or engine installation. * [Add a License](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.15/onboard-cortex-xsoar/single-server-deployment/add-a-license.md): Add a Cortex XSOAR 6.15 license file through the user interface or directly on the server. * [Post-Installation Checklist](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.15/onboard-cortex-xsoar/single-server-deployment/post-installation-checklist.md): Complete the Cortex XSOAR 6.15 post-installation checklist for monitoring, certificates, HTTP configuration, and troubleshooting. * [Monitor Components](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.15/onboard-cortex-xsoar/single-server-deployment/post-installation-checklist/monitor-components.md): Monitor Cortex XSOAR 6.15 server, engine, and Elasticsearch health with system checks, alerts, and health monitoring tools. * [HTTPS with a Signed Certificate](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.15/onboard-cortex-xsoar/single-server-deployment/post-installation-checklist/https-with-a-signed-certificate.md): Configure HTTPS for Cortex XSOAR 6.15 with a signed X.509 certificate and supported TLS versions. * [Create a Self-Signed Certificate](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.15/onboard-cortex-xsoar/single-server-deployment/post-installation-checklist/create-a-self-signed-certificate.md): Create and apply a self-signed certificate for a Cortex XSOAR 6.15 development environment. * [Install or Renew a Custom Certificate](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.15/onboard-cortex-xsoar/single-server-deployment/post-installation-checklist/install-or-renew-a-custom-certificate.md): Install or renew a CA-signed certificate for secure Cortex XSOAR 6.15 production deployments. * [Configure the Server to Listen on HTTP](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.15/onboard-cortex-xsoar/single-server-deployment/post-installation-checklist/configure-the-server-to-listen-on-http.md): Configure a Cortex XSOAR 6.15 server HTTP endpoint for deployments using HTTPS termination. * [Troubleshoot WebSockets](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.15/onboard-cortex-xsoar/single-server-deployment/post-installation-checklist/troubleshoot-websockets.md): Troubleshoot Cortex XSOAR 6.15 WebSocket disconnects, slow responses, and missing real-time browser updates. * [Upgrade the Cortex XSOAR Server](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.15/onboard-cortex-xsoar/single-server-deployment/upgrade-the-cortex-xsoar-server.md): Upgrade a Cortex XSOAR 6.15 server with preparation, installation, and post-upgrade validation steps. * [Uninstall the Server](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.15/onboard-cortex-xsoar/single-server-deployment/uninstall-the-server.md): Uninstall a Cortex XSOAR 6.15 server while retaining configuration files and engine-created files. * [Elasticsearch](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.15/onboard-cortex-xsoar/elasticsearch.md): Deploy and manage Cortex XSOAR 6.15 with Elasticsearch, including setup, security, migration, backups, and troubleshooting. * [Elasticsearch Overview](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.15/onboard-cortex-xsoar/elasticsearch/elasticsearch-overview.md): Understand Cortex XSOAR 6.15 Elasticsearch deployments and how XSOAR data is migrated to Elasticsearch indices. * [Elasticsearch Setup](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.15/onboard-cortex-xsoar/elasticsearch/elasticsearch-setup.md): Configure Elasticsearch for Cortex XSOAR 6.15 with best practices, sizing guidance, and data management settings. * [Elasticsearch System Requirements](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.15/onboard-cortex-xsoar/elasticsearch/elasticsearch-setup/elasticsearch-system-requirements.md): Review Elasticsearch system requirements for a supported and scalable Cortex XSOAR 6.15 deployment. * [Elasticsearch Configurations](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.15/onboard-cortex-xsoar/elasticsearch/elasticsearch-setup/elasticsearch-configurations.md): Configure Elasticsearch connection, indexing, shards, replicas, and performance settings for Cortex XSOAR 6.15. * [Elasticsearch Data Management](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.15/onboard-cortex-xsoar/elasticsearch/elasticsearch-setup/elasticsearch-data-management.md): Manage Cortex XSOAR 6.15 data in Elasticsearch, including index operations, data retention, and storage considerations. * [Elasticsearch Security](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.15/onboard-cortex-xsoar/elasticsearch/elasticsearch-security.md): Apply Elasticsearch security guidance and best practices to Cortex XSOAR 6.15 single-server and multi-tenant deployments. * [Elasticsearch General Security Guidelines](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.15/onboard-cortex-xsoar/elasticsearch/elasticsearch-security/elasticsearch-general-security-guidelines.md): Follow general Elasticsearch security guidelines for protecting a Cortex XSOAR 6.15 deployment. * [Elasticsearch Security Guidelines - Multi-tenant Deployments](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.15/onboard-cortex-xsoar/elasticsearch/elasticsearch-security/elasticsearch-security-guidelines-multi-tenant-deployments.md): Apply Elasticsearch security guidelines for Cortex XSOAR 6.15 multi-tenant deployments and tenant data isolation. * [Migration](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.15/onboard-cortex-xsoar/elasticsearch/migration.md): Migrate Cortex XSOAR 6.15 data to Elasticsearch for single-server and multi-tenant environments. * [Elasticsearch Migration Overview](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.15/onboard-cortex-xsoar/elasticsearch/migration/elasticsearch-migration-overview.md): Understand the Cortex XSOAR 6.15 Elasticsearch migration process, prerequisites, sequencing, and migration tool options. * [Migrate Objects to Elasticsearch for a Single Server](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.15/onboard-cortex-xsoar/elasticsearch/migration/migrate-objects-to-elasticsearch-for-a-single-server.md): Migrate Cortex XSOAR 6.15 objects and data to Elasticsearch in a single-server deployment. * [Migrate Objects to Elasticsearch for Multi-Tenant](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.15/onboard-cortex-xsoar/elasticsearch/migration/migrate-objects-to-elasticsearch-for-multi-tenant.md): Migrate Cortex XSOAR 6.15 objects and tenant data to Elasticsearch in a multi-tenant deployment. * [Migrate an Existing Elasticsearch Deployment](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.15/onboard-cortex-xsoar/elasticsearch/migration/migrate-an-existing-elasticsearch-deployment.md): Migrate an existing Cortex XSOAR 6.15 Elasticsearch deployment while preserving data and configuration. * [Migrate Objects to Elasticsearch for a Distributed Database](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.15/onboard-cortex-xsoar/elasticsearch/migration/migrate-objects-to-elasticsearch-for-a-distributed-database.md): Migrate Cortex XSOAR 6.15 objects to Elasticsearch from a distributed database deployment. * [Manage Partial Migration to Elasticsearch](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.15/onboard-cortex-xsoar/elasticsearch/migration/manage-partial-migration-to-elasticsearch.md): Manage a partial Cortex XSOAR 6.15 migration to Elasticsearch and complete the remaining data migration. * [Validate the Migration to Elasticsearch](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.15/onboard-cortex-xsoar/elasticsearch/migration/validate-the-migration-to-elasticsearch.md): Validate a Cortex XSOAR 6.15 migration to Elasticsearch and identify incomplete or failed migrated objects. * [Elasticsearch Post Migration Health Check](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.15/onboard-cortex-xsoar/elasticsearch/migration/elasticsearch-post-migration-health-check.md): Run post-migration health checks to confirm a Cortex XSOAR 6.15 Elasticsearch deployment is operating correctly. * [Disaster Recovery for Elasticsearch](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.15/onboard-cortex-xsoar/elasticsearch/disaster-recovery-for-elasticsearch.md): Back up and restore a Cortex XSOAR 6.15 Elasticsearch deployment using snapshots for disaster recovery. * [Create Elasticsearch Snapshots](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.15/onboard-cortex-xsoar/elasticsearch/disaster-recovery-for-elasticsearch/create-elasticsearch-snapshots.md): Create Elasticsearch snapshots to back up Cortex XSOAR 6.15 data and prepare for disaster recovery. * [Restore Elasticsearch Snapshots](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.15/onboard-cortex-xsoar/elasticsearch/disaster-recovery-for-elasticsearch/restore-elasticsearch-snapshots.md): Restore Elasticsearch snapshots to recover Cortex XSOAR 6.15 data after data loss or an outage. * [Archive Data with Elasticsearch](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.15/onboard-cortex-xsoar/elasticsearch/archive-data-with-elasticsearch.md): Archive Cortex XSOAR 6.15 data with Elasticsearch index lifecycle management to manage storage and data retention. * [Troubleshoot Elasticsearch](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.15/onboard-cortex-xsoar/elasticsearch/troubleshoot-elasticsearch.md): Troubleshoot common Cortex XSOAR 6.15 Elasticsearch deployment, connectivity, indexing, and performance issues. * [Docker](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.15/onboard-cortex-xsoar/docker.md): Install, configure, secure, and troubleshoot Docker for Cortex XSOAR 6.15. * [Docker Overview](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.15/onboard-cortex-xsoar/docker/docker-overview.md): Understand how Cortex XSOAR 6.15 uses Docker to run integrations and automations securely and predictably. * [Docker Installation](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.15/onboard-cortex-xsoar/docker/docker-installation.md): Install and troubleshoot Docker on supported Enterprise Linux platforms for Cortex XSOAR 6.15. * [Configure Python Docker Integrations to Trust Custom Certificates](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.15/onboard-cortex-xsoar/docker/configure-python-docker-integrations-to-trust-custom-certificates.md): Configure Cortex XSOAR 6.15 Python Docker integrations to trust CA-signed and custom certificates. * [Docker Images in Cortex XSOAR](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.15/onboard-cortex-xsoar/docker/docker-images-in-cortex-xsoar.md): Use Docker images to run Cortex XSOAR 6.15 Python scripts and integrations in controlled environments. * [Create a Docker Image In Cortex XSOAR](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.15/onboard-cortex-xsoar/docker/docker-images-in-cortex-xsoar/create-a-docker-image-in-cortex-xsoar.md): Create a custom Docker image for Cortex XSOAR 6.15 integrations and automations. * [Install Docker Images Offline](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.15/onboard-cortex-xsoar/docker/docker-images-in-cortex-xsoar/install-docker-images-offline.md): Download and install Docker images offline for air-gapped Cortex XSOAR 6.14 environments. * [Docker Image Security](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.15/onboard-cortex-xsoar/docker/docker-images-in-cortex-xsoar/docker-image-security.md): Apply Docker image security practices for Cortex XSOAR 6.15 integrations and automations. * [Manage Docker Images](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.15/onboard-cortex-xsoar/docker/docker-images-in-cortex-xsoar/manage-docker-images.md): Manage, update, and remove Docker images used by Cortex XSOAR 6.15 integrations and automations. * [Change the Docker Image for Automations and Integrations](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.15/onboard-cortex-xsoar/docker/docker-images-in-cortex-xsoar/change-the-docker-image-for-automations-and-integrations.md): Change the Docker image used by Cortex XSOAR 6.15 automations and integrations. * [Use the Cortex XSOAR Container Registry](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.15/onboard-cortex-xsoar/docker/docker-images-in-cortex-xsoar/use-the-cortex-xsoar-container-registry.md): Use the Cortex XSOAR 6.15 container registry to manage and distribute Docker images. * [Docker hardening Guide](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.15/onboard-cortex-xsoar/docker/docker-hardening-guide.md): Configure Docker hardening in Cortex XSOAR 6.15 using non-root users, resource limits, and network access controls. * [Run Docker with Non-Root Internal Users](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.15/onboard-cortex-xsoar/docker/docker-hardening-guide/run-docker-with-non-root-internal-users.md): Run Cortex XSOAR 6.15 Docker containers with non-root internal users to enforce least privilege. * [Configure Memory Limit Support Without Swap Limit Capabilities](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.15/onboard-cortex-xsoar/docker/docker-hardening-guide/configure-memory-limit-support-without-swap-limit-capabilities.md): Configure Docker memory limits for Cortex XSOAR 6.15 when swap limit capabilities are unavailable. * [Configure the Memory Limitation](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.15/onboard-cortex-xsoar/docker/docker-hardening-guide/configure-the-memory-limitation.md): Configure Docker container memory limits to protect Cortex XSOAR 6.15 hosts from resource exhaustion. * [Test the Memory Limit](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.15/onboard-cortex-xsoar/docker/docker-hardening-guide/test-the-memory-limit.md): Test Docker memory limits configured for Cortex XSOAR 6.15 containers. * [Limit Available CPU](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.15/onboard-cortex-xsoar/docker/docker-hardening-guide/limit-available-cpu.md): Limit Docker container CPU resources to protect the Cortex XSOAR 6.15 host. * [Configure the PIDs Limit](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.15/onboard-cortex-xsoar/docker/docker-hardening-guide/configure-the-pids-limit.md): Configure Docker PID limits to prevent process exhaustion in Cortex XSOAR 6.15 containers. * [Configure the Open File Descriptors Limit](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.15/onboard-cortex-xsoar/docker/docker-hardening-guide/configure-the-open-file-descriptors-limit.md): Configure Docker open file descriptor limits for Cortex XSOAR 6.15 containers. * [Docker Network Hardening](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.15/onboard-cortex-xsoar/docker/docker-hardening-guide/docker-network-hardening.md): Harden Docker network access for Cortex XSOAR 6.15 containers with network security controls. * [Docker FAQs](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.15/onboard-cortex-xsoar/docker/docker-faqs.md): Find answers to frequently asked questions about Docker in Cortex XSOAR 6.15. * [Troubleshoot Docker Networking Issues](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.15/onboard-cortex-xsoar/docker/troubleshoot-docker-networking-issues.md): Troubleshoot Docker networking issues in Cortex XSOAR 6.15. * [Troubleshoot Docker Performance Issues](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.15/onboard-cortex-xsoar/docker/troubleshoot-docker-performance-issues.md): Troubleshoot Cortex XSOAR 6.15 Docker performance issues and update Docker packages and dependencies. * [Configure Docker Pull Rate Limit](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.15/onboard-cortex-xsoar/docker/configure-docker-pull-rate-limit.md): Configure Docker image pull rate limits for Cortex XSOAR 6.15 and authenticate for higher limits. * [Change the Docker Installation Folder](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.15/onboard-cortex-xsoar/docker/change-the-docker-installation-folder.md): Change the default Docker installation folder for Cortex XSOAR 6.15. * [Podman](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.15/onboard-cortex-xsoar/podman.md): Install, configure, migrate to, and troubleshoot Podman for Cortex XSOAR 6.14 on RHEL 8 and later. * [Podman Overview](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.15/onboard-cortex-xsoar/podman/podman-overview.md): Understand how to use Podman instead of Docker for Cortex XSOAR 6.14 on supported operating systems, including RHEL 8. * [Change container storage directory](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.15/onboard-cortex-xsoar/podman/change-container-storage-directory.md): Change the Podman container storage directory for Cortex XSOAR 6.14. * [Podman Installation](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.15/onboard-cortex-xsoar/podman/podman-installation.md): Install Podman for Cortex XSOAR 6.14 on supported Linux operating systems. * [Configure the SELinux Policy for PowerShell Integrations](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.15/onboard-cortex-xsoar/podman/configure-the-selinux-policy-for-powershell-integrations.md): Configure the Podman SELinux policy for PowerShell integrations in Cortex XSOAR 6.14. * [Migrate From Docker to Podman](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.15/onboard-cortex-xsoar/podman/migrate-from-docker-to-podman.md): Migrate Cortex XSOAR 6.14 from Docker to Podman on RHEL 8 or later. * [Troubleshoot Podman](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.15/onboard-cortex-xsoar/podman/troubleshoot-podman.md): Troubleshoot Podman installation, configuration, and container issues in Cortex XSOAR 6.14. * [Proxy](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.15/onboard-cortex-xsoar/proxy.md): Configure proxy, proxy bypass, and NGINX reverse proxy settings for Cortex XSOAR 6.15. * [Configure Proxy Settings](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.15/onboard-cortex-xsoar/proxy/configure-proxy-settings.md): Configure global proxy settings for Cortex XSOAR 6.15 with server configuration options. * [Configure how to bypass proxy settings](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.15/onboard-cortex-xsoar/proxy/configure-how-to-bypass-proxy-settings.md): Configure proxy bypass settings for Cortex XSOAR 6.15 with server configuration options. * [Use NGINX as a Reverse Proxy to the Server](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.15/onboard-cortex-xsoar/proxy/use-nginx-as-a-reverse-proxy-to-the-server.md): Configure NGINX as a reverse proxy for a Cortex XSOAR 6.15 server. * [High Availability](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.15/onboard-cortex-xsoar/high-availability.md): Configure Cortex XSOAR 6.15 high availability with Elasticsearch, including sizing, migration, app servers, engines, and certificates. * [High Availability Overview](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.15/onboard-cortex-xsoar/high-availability/high-availability-overview.md): Understand Cortex XSOAR 6.15 high availability deployment architectures and components. * [Set Up High Availability](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.15/onboard-cortex-xsoar/high-availability/set-up-high-availability.md): Set up high availability for Cortex XSOAR 6.15 with the required deployment steps. * [Sizing Requirements for High Availability Deployments](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.15/onboard-cortex-xsoar/high-availability/sizing-requirements-for-high-availability-deployments.md): Review sizing requirements for a Cortex XSOAR 6.15 high availability deployment. * [Monitor the Health of the App Servers](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.15/onboard-cortex-xsoar/high-availability/monitor-the-health-of-the-app-servers.md): Monitor application server health in a Cortex XSOAR 6.15 high availability environment. * [Migrate a Single Instance for High Availability](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.15/onboard-cortex-xsoar/high-availability/migrate-a-single-instance-for-high-availability.md): Migrate a Cortex XSOAR 6.15 single-instance deployment to high availability. * [Migrate a Multi-Tenant Deployment for High Availability](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.15/onboard-cortex-xsoar/high-availability/migrate-a-multi-tenant-deployment-for-high-availability.md): Migrate a Cortex XSOAR 6.15 multi-tenant deployment to enable high availability. * [Install Additional App Servers](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.15/onboard-cortex-xsoar/high-availability/install-additional-app-servers.md): Install additional application servers for a Cortex XSOAR 6.15 high availability configuration. * [Deploy Engines in a High Availability Environment](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.15/onboard-cortex-xsoar/high-availability/deploy-engines-in-a-high-availability-environment.md): Deploy Cortex XSOAR 6.15 engines in high availability and route engine connections through a load balancer. * [Use a Signed Certificate](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.15/onboard-cortex-xsoar/high-availability/use-a-signed-certificate.md): Use a signed certificate in a Cortex XSOAR 6.15 high availability deployment. * [Disaster Recovery and Live Backup](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.15/onboard-cortex-xsoar/disaster-recovery-and-live-backup.md): Configure Cortex XSOAR 6.15 disaster recovery and live backup, including failover, backups, restores, and troubleshooting. * [Disaster Recovery and Live Backup Overview](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.15/onboard-cortex-xsoar/disaster-recovery-and-live-backup/disaster-recovery-and-live-backup-overview.md): Understand Cortex XSOAR 6.15 live backup, disaster recovery states, environment configuration, and recovery scenarios. * [Host Names, DNS, and Disaster Recovery](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.15/onboard-cortex-xsoar/disaster-recovery-and-live-backup/host-names-dns-and-disaster-recovery.md): Configure host names and DNS for a Cortex XSOAR 6.15 disaster recovery environment. * [Configure the Live Backup Environment](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.15/onboard-cortex-xsoar/disaster-recovery-and-live-backup/configure-the-live-backup-environment.md): Configure Cortex XSOAR 6.15 live backup by mirroring a production server to a standby backup server. * [Configure Live Backup for Multiple SAMLs](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.15/onboard-cortex-xsoar/disaster-recovery-and-live-backup/configure-the-live-backup-environment/configure-live-backup-for-multiple-samls.md): Configure Cortex XSOAR 6.15 live backup for environments that use multiple SAML identity providers. * [DR Scenario: Testing the DR Environment](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.15/onboard-cortex-xsoar/disaster-recovery-and-live-backup/configure-the-live-backup-environment/dr-scenario-testing-the-dr-environment.md): Test a Cortex XSOAR 6.15 disaster recovery environment and restore the original server roles. * [DR Scenario: Unrecoverable Active Server Failure](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.15/onboard-cortex-xsoar/disaster-recovery-and-live-backup/configure-the-live-backup-environment/dr-scenario-unrecoverable-active-server-failure.md): Recover from an unrecoverable active server failure with Cortex XSOAR 6.15 live backup. * [DR Scenario: Unrecoverable Standby Server Failure](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.15/onboard-cortex-xsoar/disaster-recovery-and-live-backup/configure-the-live-backup-environment/dr-scenario-unrecoverable-standby-server-failure.md): Replace an unrecoverable standby server in a Cortex XSOAR 6.15 live backup environment. * [Transition an Active Server to Standby Mode](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.15/onboard-cortex-xsoar/disaster-recovery-and-live-backup/transition-an-active-server-to-standby-mode.md): Transition an active Cortex XSOAR 6.15 server to standby mode for disaster recovery. * [Transition a Standby Server to Active Mode](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.15/onboard-cortex-xsoar/disaster-recovery-and-live-backup/transition-a-standby-server-to-active-mode.md): Transition a standby Cortex XSOAR 6.15 server to active production mode. * [Transition Between DR States Through the Configuration File](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.15/onboard-cortex-xsoar/disaster-recovery-and-live-backup/transition-between-dr-states-through-the-configuration-file.md): Transition Cortex XSOAR 6.15 disaster recovery states with the configuration file during first server startup. * [Upgrade the Live Backup Environment](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.15/onboard-cortex-xsoar/disaster-recovery-and-live-backup/upgrade-the-live-backup-environment.md): Upgrade a Cortex XSOAR 6.15 live backup environment while preserving disaster recovery readiness. * [Engines and Disaster Recovery Troubleshooting](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.15/onboard-cortex-xsoar/disaster-recovery-and-live-backup/engines-and-disaster-recovery-troubleshooting.md): Troubleshoot Cortex XSOAR 6.15 engine failover issues in a disaster recovery environment. * [Back up the Database](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.15/onboard-cortex-xsoar/disaster-recovery-and-live-backup/back-up-the-database.md): Create manual and automated database backups for Cortex XSOAR 6.15 and schedule backup jobs. * [Restore the Database](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.15/onboard-cortex-xsoar/disaster-recovery-and-live-backup/restore-the-database.md): Restore a Cortex XSOAR 6.15 database from a manual or automated backup. * [Restore a Partition](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.15/onboard-cortex-xsoar/disaster-recovery-and-live-backup/restore-a-partition.md): Restore one or more specific Cortex XSOAR 6.15 database partitions from a backup. * [Troubleshoot Live Backup](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.15/onboard-cortex-xsoar/disaster-recovery-and-live-backup/troubleshoot-live-backup.md): Troubleshoot live backup and disaster recovery scenarios in Cortex XSOAR 6.15. * [Users and Roles](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.15/onboard-cortex-xsoar/users-and-roles.md): Manage Cortex XSOAR 6.15 users, roles, permissions, settings, shifts, passwords, and authentication. * [Users and Roles Overview](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.15/onboard-cortex-xsoar/users-and-roles/users-and-roles-overview.md): Manage Cortex XSOAR 6.15 users, roles, invitations, password policies, and user activity. * [Roles in Cortex XSOAR](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.15/onboard-cortex-xsoar/users-and-roles/roles-in-cortex-xsoar.md): Configure Cortex XSOAR 6.15 roles, permissions, access levels, queries, and shifts. * [Pre-set Query per Role](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.15/onboard-cortex-xsoar/users-and-roles/roles-in-cortex-xsoar/pre-set-query-per-role.md): Configure pre-set queries for Cortex XSOAR 6.15 roles. * [Define a Role](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.15/onboard-cortex-xsoar/users-and-roles/roles-in-cortex-xsoar/define-a-role.md): Define a custom role and its permissions in Cortex XSOAR 6.15. * [Role-based Permission Levels](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.15/onboard-cortex-xsoar/users-and-roles/roles-in-cortex-xsoar/role-based-permission-levels.md): Understand role-based permission levels in Cortex XSOAR 6.15. * [Shift Management](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.15/onboard-cortex-xsoar/users-and-roles/roles-in-cortex-xsoar/shift-management.md): Manage user shifts and on-call schedules in Cortex XSOAR 6.15. * [Define Shifts](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.15/onboard-cortex-xsoar/users-and-roles/roles-in-cortex-xsoar/shift-management/define-shifts.md): Create and manage shifts for Cortex XSOAR 6.15 users. * [Shift Automation](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.15/onboard-cortex-xsoar/users-and-roles/roles-in-cortex-xsoar/shift-management/shift-automation.md): Leverage shift schedules to route incoming incidents, assign tasks, and monitor analyst availability. * [User Management](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.15/onboard-cortex-xsoar/users-and-roles/user-management.md): Invite and manage Cortex XSOAR 6.15 users, roles, passwords, access, and preferences. * [User Invitations](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.15/onboard-cortex-xsoar/users-and-roles/user-management/user-invitations.md): Manage user invitations in Cortex XSOAR 6.15. * [Invite a User](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.15/onboard-cortex-xsoar/users-and-roles/user-management/user-invitations/invite-a-user.md): Invite a user to Cortex XSOAR 6.15 and assign access. * [Set the User as Default Administrator](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.15/onboard-cortex-xsoar/users-and-roles/user-management/user-invitations/set-the-user-as-default-administrator.md): Set a Cortex XSOAR 6.15 user as the default administrator. * [Self-Service Read-Only Users](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.15/onboard-cortex-xsoar/users-and-roles/user-management/self-service-read-only-users.md): Configure self-service read-only users in Cortex XSOAR 6.15. * [Configure the Server for Self-Service Read-Only Users](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.15/onboard-cortex-xsoar/users-and-roles/user-management/self-service-read-only-users/configure-the-server-for-self-service-read-only-users.md): Configure the Cortex XSOAR 6.15 server for self-service read-only users. * [Create the Self-Service Read-Only Users](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.15/onboard-cortex-xsoar/users-and-roles/user-management/self-service-read-only-users/create-the-self-service-read-only-users.md): Create self-service read-only users in Cortex XSOAR 6.15. * [Create the Read-Only Dashboard](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.15/onboard-cortex-xsoar/users-and-roles/user-management/self-service-read-only-users/create-the-read-only-dashboard.md): Create a read-only dashboard for Cortex XSOAR 6.15 users. * [Create the Read-Only Incident Type and Layout](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.15/onboard-cortex-xsoar/users-and-roles/user-management/self-service-read-only-users/create-the-read-only-incident-type-and-layout.md): Create a read-only incident type and layout in Cortex XSOAR 6.15. * [Disable a User](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.15/onboard-cortex-xsoar/users-and-roles/user-management/disable-a-user.md): Disable a Cortex XSOAR 6.15 user account. * [Remove a User](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.15/onboard-cortex-xsoar/users-and-roles/user-management/remove-a-user.md): Remove a user from Cortex XSOAR 6.15. * [Clear Users Data Using the CLI](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.15/onboard-cortex-xsoar/users-and-roles/user-management/clear-users-data-using-the-cli.md): Clear user data with the Cortex XSOAR 6.15 CLI. * [Clear Users Data Using a Playbook](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.15/onboard-cortex-xsoar/users-and-roles/user-management/clear-users-data-using-a-playbook.md): Clear user data with a Cortex XSOAR 6.15 playbook. * [Configure Users Data Using Server Configurations](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.15/onboard-cortex-xsoar/users-and-roles/user-management/configure-users-data-using-server-configurations.md): Configure user data with Cortex XSOAR 6.15 server configurations. * [User Settings and Preferences](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.15/onboard-cortex-xsoar/users-and-roles/user-management/user-settings-and-preferences.md): Manage Cortex XSOAR 6.15 user settings and preferences. * [Configure User Settings](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.15/onboard-cortex-xsoar/users-and-roles/user-management/configure-user-settings.md): Configure user settings in Cortex XSOAR 6.15. * [Manually Refresh the Number of Licenses in Use](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.15/onboard-cortex-xsoar/users-and-roles/user-management/manually-refresh-the-number-of-licenses-in-use.md): Manually refresh the number of Cortex XSOAR 6.15 licenses in use. * [Integration Permissions](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.15/onboard-cortex-xsoar/users-and-roles/integration-permissions.md): Configure integration command permissions with role-based access control in Cortex XSOAR 6.15. * [Password Policy](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.15/onboard-cortex-xsoar/users-and-roles/password-policy.md): Configure password policies and requirements for Cortex XSOAR 6.15 users. * [Create a Password Policy](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.15/onboard-cortex-xsoar/users-and-roles/password-policy/create-a-password-policy.md): Create a password policy for Cortex XSOAR 6.15 users. * [Edit a Default Password Policy](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.15/onboard-cortex-xsoar/users-and-roles/password-policy/edit-a-default-password-policy.md): Edit the default password policy in Cortex XSOAR 6.15. * [Default Password Policy Keys](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.15/onboard-cortex-xsoar/users-and-roles/password-policy/edit-a-default-password-policy/default-password-policy-keys.md): Reference default password policy keys for Cortex XSOAR 6.15. * [Change the Administrator Password](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.15/onboard-cortex-xsoar/users-and-roles/change-the-administrator-password.md): Change the Cortex XSOAR 6.15 administrator password when account access is unavailable. * [Authenticate Users with SAML 2.0](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.15/onboard-cortex-xsoar/users-and-roles/authenticate-users-with-saml-2.0.md): Authenticate Cortex XSOAR 6.15 users with SAML 2.0 identity providers, including Okta, Microsoft Entra ID, ADFS, and Duo. * [Set up Okta as the Identity Provider Using SAML 2.0](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.15/onboard-cortex-xsoar/users-and-roles/authenticate-users-with-saml-2.0/set-up-okta-as-the-identity-provider-using-saml-2.0.md): Set up Okta as a SAML 2.0 identity provider for Cortex XSOAR 6.15. * [Create Okta Groups for Cortex XSOAR Users](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.15/onboard-cortex-xsoar/users-and-roles/authenticate-users-with-saml-2.0/set-up-okta-as-the-identity-provider-using-saml-2.0/create-okta-groups-for-cortex-xsoar-users.md): Create Okta groups for Cortex XSOAR 6.15 users. * [Define the Okta Application to authenticate Cortex XSOAR](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.15/onboard-cortex-xsoar/users-and-roles/authenticate-users-with-saml-2.0/set-up-okta-as-the-identity-provider-using-saml-2.0/define-the-okta-application-to-authenticate-cortex-xsoar.md): Define an Okta application to authenticate Cortex XSOAR 6.15 users. * [SAML Settings for the Okta Application](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.15/onboard-cortex-xsoar/users-and-roles/authenticate-users-with-saml-2.0/set-up-okta-as-the-identity-provider-using-saml-2.0/define-the-okta-application-to-authenticate-cortex-xsoar/saml-settings-for-the-okta-application.md): Configure SAML settings for the Okta application in Cortex XSOAR 6.15. * [Configure the SAML 2.0 Integration for Okta](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.15/onboard-cortex-xsoar/users-and-roles/authenticate-users-with-saml-2.0/set-up-okta-as-the-identity-provider-using-saml-2.0/configure-the-saml-2.0-integration-for-okta.md): Configure the SAML 2.0 integration for Okta in Cortex XSOAR 6.15. * [SAML 2.0 Okta Parameters](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.15/onboard-cortex-xsoar/users-and-roles/authenticate-users-with-saml-2.0/set-up-okta-as-the-identity-provider-using-saml-2.0/configure-the-saml-2.0-integration-for-okta/saml-2.0-okta-parameters.md): Reference SAML 2.0 Okta parameters for Cortex XSOAR 6.15. * [Map Okta Groups to Cortex XSOAR Roles](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.15/onboard-cortex-xsoar/users-and-roles/authenticate-users-with-saml-2.0/set-up-okta-as-the-identity-provider-using-saml-2.0/map-okta-groups-to-cortex-xsoar-roles.md): Map Okta groups to Cortex XSOAR 6.15 roles. * [Set Up Microsoft Entra ID as the Identity Provider Using SAML 2.0](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.15/onboard-cortex-xsoar/users-and-roles/authenticate-users-with-saml-2.0/set-up-microsoft-entra-id-as-the-identity-provider-using-saml-2.0.md): Set up Microsoft Entra ID as a SAML 2.0 identity provider for Cortex XSOAR 6.15. * [Configure Microsoft Entra ID to Authenticate Cortex XSOAR](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.15/onboard-cortex-xsoar/users-and-roles/authenticate-users-with-saml-2.0/set-up-microsoft-entra-id-as-the-identity-provider-using-saml-2.0/configure-microsoft-entra-id-to-authenticate-cortex-xsoar.md): Configure Microsoft Entra ID to authenticate Cortex XSOAR 6.15 users. * [Configure the SAML 2.0 Integration for Microsoft Entra ID](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.15/onboard-cortex-xsoar/users-and-roles/authenticate-users-with-saml-2.0/set-up-microsoft-entra-id-as-the-identity-provider-using-saml-2.0/configure-the-saml-2.0-integration-for-microsoft-entra-id.md): Configure the SAML 2.0 integration for Microsoft Entra ID in Cortex XSOAR 6.15. * [SAML 2.0 Microsoft Entra ID Parameters](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.15/onboard-cortex-xsoar/users-and-roles/authenticate-users-with-saml-2.0/set-up-microsoft-entra-id-as-the-identity-provider-using-saml-2.0/configure-the-saml-2.0-integration-for-microsoft-entra-id/saml-2.0-microsoft-entra-id-parameters.md): Reference SAML 2.0 Microsoft Entra ID parameters for Cortex XSOAR 6.15. * [Set up ADFS as the Identity Provider Using SAML 2.0](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.15/onboard-cortex-xsoar/users-and-roles/authenticate-users-with-saml-2.0/set-up-adfs-as-the-identity-provider-using-saml-2.0.md): Set up ADFS as a SAML 2.0 identity provider for Cortex XSOAR 6.15. * [Create Relying Party Trust in ADFS](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.15/onboard-cortex-xsoar/users-and-roles/authenticate-users-with-saml-2.0/set-up-adfs-as-the-identity-provider-using-saml-2.0/create-relying-party-trust-in-adfs.md): Create an ADFS relying party trust for Cortex XSOAR 6.15. * [Define the Claim Issuance Policy](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.15/onboard-cortex-xsoar/users-and-roles/authenticate-users-with-saml-2.0/set-up-adfs-as-the-identity-provider-using-saml-2.0/define-the-claim-issuance-policy.md): Define the ADFS claim issuance policy for Cortex XSOAR 6.15 authentication. * [Configure the SAML 2.0 Integration for ADFS](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.15/onboard-cortex-xsoar/users-and-roles/authenticate-users-with-saml-2.0/set-up-adfs-as-the-identity-provider-using-saml-2.0/configure-the-saml-2.0-integration-for-adfs.md): Configure the SAML 2.0 integration for ADFS in Cortex XSOAR 6.15. * [SAML 2.0 ADFS Parameters](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.15/onboard-cortex-xsoar/users-and-roles/authenticate-users-with-saml-2.0/set-up-adfs-as-the-identity-provider-using-saml-2.0/configure-the-saml-2.0-integration-for-adfs/saml-2.0-adfs-parameters.md): Reference SAML 2.0 ADFS parameters for Cortex XSOAR 6.15. * [Map ADFS Groups to Cortex XSOAR Roles](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.15/onboard-cortex-xsoar/users-and-roles/authenticate-users-with-saml-2.0/set-up-adfs-as-the-identity-provider-using-saml-2.0/map-adfs-groups-to-cortex-xsoar-roles.md): Map ADFS groups to Cortex XSOAR 6.15 roles. * [Duo for Single Sign-On](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.15/onboard-cortex-xsoar/users-and-roles/authenticate-users-with-saml-2.0/duo-for-single-sign-on.md): Configure Duo single sign-on for Cortex XSOAR 6.15. * [Create Duo Groups for Cortex XSOAR Users](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.15/onboard-cortex-xsoar/users-and-roles/authenticate-users-with-saml-2.0/duo-for-single-sign-on/create-duo-groups-for-cortex-xsoar-users.md): Create Duo groups for Cortex XSOAR 6.15 users. * [Define Duo to authenticate Cortex XSOAR](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.15/onboard-cortex-xsoar/users-and-roles/authenticate-users-with-saml-2.0/duo-for-single-sign-on/define-duo-to-authenticate-cortex-xsoar.md): Define Duo to authenticate Cortex XSOAR 6.15 users. * [Configure the SAML 2.0 Integration for Duo](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.15/onboard-cortex-xsoar/users-and-roles/authenticate-users-with-saml-2.0/duo-for-single-sign-on/configure-the-saml-2.0-integration-for-duo.md): Configure the SAML 2.0 integration for Duo in Cortex XSOAR 6.15. * [Map Duo Groups to Cortex XSOAR Roles](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.15/onboard-cortex-xsoar/users-and-roles/authenticate-users-with-saml-2.0/duo-for-single-sign-on/map-duo-groups-to-cortex-xsoar-roles.md): Map Duo groups to Cortex XSOAR 6.15 roles. * [Change the Default Administrator to a SAML User](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.15/onboard-cortex-xsoar/users-and-roles/authenticate-users-with-saml-2.0/change-the-default-administrator-to-a-saml-user.md): Change the default Cortex XSOAR 6.15 administrator to a SAML user. * [Set Up SAML Logout](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.15/onboard-cortex-xsoar/users-and-roles/authenticate-users-with-saml-2.0/set-up-saml-logout.md) * [Set the Default Theme for New Users](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.15/onboard-cortex-xsoar/users-and-roles/set-the-default-theme-for-new-users.md): Set the default color theme for new Cortex XSOAR 6.15 users with server configuration settings. * [Authenticate Users with Active Directory](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.15/onboard-cortex-xsoar/users-and-roles/authenticate-users-with-active-directory.md): Authenticate Cortex XSOAR 6.15 users with Active Directory credentials. * [Marketplace](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.15/onboard-cortex-xsoar/marketplace.md): Browse Cortex XSOAR 6.15 Marketplace content packs, manage installations, and contribute content. * [Marketplace Overview](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.15/onboard-cortex-xsoar/marketplace/marketplace-overview.md): Use Cortex XSOAR 6.15 Marketplace to discover, install, manage, and contribute content packs. * [Content Packs Support Types](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.15/onboard-cortex-xsoar/marketplace/content-packs-support-types.md): Understand Cortex XSOAR 6.15 content pack support types and ownership levels. * [Marketplace FAQs](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.15/onboard-cortex-xsoar/marketplace/marketplace-faqs.md): Find answers to common Cortex XSOAR 6.15 Marketplace and content pack questions. * [Search and Navigate in the Marketplace](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.15/onboard-cortex-xsoar/marketplace/search-and-navigate-in-the-marketplace.md): Search and browse Cortex XSOAR 6.15 Marketplace content by use case, integration, and category. * [Convert Existing Content to Content Pack Format](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.15/onboard-cortex-xsoar/marketplace/convert-existing-content-to-content-pack-format.md): Convert existing content to Cortex XSOAR 6.15 content pack format. * [Use Cases](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.15/onboard-cortex-xsoar/marketplace/use-cases.md): Explore Cortex XSOAR 6.15 Marketplace content packs by security use case. * [Content Pack Installation](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.15/onboard-cortex-xsoar/marketplace/content-pack-installation.md): Review Cortex XSOAR 6.15 content pack dependencies, installation requirements, errors, and warnings. * [Install a Content Pack](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.15/onboard-cortex-xsoar/marketplace/content-pack-installation/install-a-content-pack.md): Install a Cortex XSOAR 6.15 Marketplace content pack and its required dependencies. * [Set up Your Use Case with the Deployment Wizard](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.15/onboard-cortex-xsoar/marketplace/content-pack-installation/install-a-content-pack/set-up-your-use-case-with-the-deployment-wizard.md): Configure a supported Cortex XSOAR 6.15 content pack with the Deployment Wizard. * [Delete a Content Pack](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.15/onboard-cortex-xsoar/marketplace/content-pack-installation/delete-a-content-pack.md): Delete an installed Cortex XSOAR 6.15 Marketplace content pack. * [Update a Content Pack](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.15/onboard-cortex-xsoar/marketplace/content-pack-installation/update-a-content-pack.md): Update an installed Cortex XSOAR 6.15 Marketplace content pack. * [Revert a Content Pack](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.15/onboard-cortex-xsoar/marketplace/content-pack-installation/revert-a-content-pack.md): Revert a Cortex XSOAR 6.15 content pack to an earlier version. * [Install a Content Pack Offline](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.15/onboard-cortex-xsoar/marketplace/install-a-content-pack-offline.md): Install Cortex XSOAR 6.15 Marketplace content packs in offline or air-gapped environments. * [Configure the Marketplace for Offline Installation](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.15/onboard-cortex-xsoar/marketplace/install-a-content-pack-offline/configure-the-marketplace-for-offline-installation.md): Configure Cortex XSOAR 6.15 Marketplace for offline content pack installation. * [Content Pack Update Notifications](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.15/onboard-cortex-xsoar/marketplace/content-pack-update-notifications.md): Enable update notifications for Cortex XSOAR 6.15 content packs. * [Customize Content Pack Notifications](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.15/onboard-cortex-xsoar/marketplace/content-pack-update-notifications/customize-content-pack-notifications.md): Customize Cortex XSOAR 6.15 content pack update notifications. * [Marketplace Troubleshooting](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.15/onboard-cortex-xsoar/marketplace/marketplace-troubleshooting.md): Troubleshoot Cortex XSOAR 6.15 Marketplace login, connectivity, timeout, and certificate issues. * [Content Pack Contributions](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.15/onboard-cortex-xsoar/marketplace/content-pack-contributions.md): Create and submit content packs to the Cortex XSOAR 6.15 Marketplace. * [Create a Content Pack](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.15/onboard-cortex-xsoar/marketplace/content-pack-contributions/create-a-content-pack.md): Create a content pack for the Cortex XSOAR 6.15 Marketplace. * [Resubmit a Content Pack](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.15/onboard-cortex-xsoar/marketplace/content-pack-contributions/resubmit-a-content-pack.md): Resubmit an updated content pack to the Cortex XSOAR 6.15 Marketplace. * [Remote Repositories in Cortex XSOAR](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.15/onboard-cortex-xsoar/remote-repositories-in-cortex-xsoar.md): Configure Cortex XSOAR 6.15 remote repositories for content development, synchronization, and deployment. * [Content Management in Cortex XSOAR](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.15/onboard-cortex-xsoar/remote-repositories-in-cortex-xsoar/content-management-in-cortex-xsoar.md): Manage Cortex XSOAR 6.15 content with remote repositories and CI/CD workflows. * [Remote Repositories Overview](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.15/onboard-cortex-xsoar/remote-repositories-in-cortex-xsoar/remote-repositories-overview.md): Understand remote repository workflows and configuration in Cortex XSOAR 6.15. * [Configure a Remote Repository on a Development Machine](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.15/onboard-cortex-xsoar/remote-repositories-in-cortex-xsoar/configure-a-remote-repository-on-a-development-machine.md): Configure a Cortex XSOAR 6.15 remote repository on a development machine. * [Configure a Remote Repository on the Production Machine](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.15/onboard-cortex-xsoar/remote-repositories-in-cortex-xsoar/configure-a-remote-repository-on-the-production-machine.md): Configure a Cortex XSOAR 6.15 remote repository on a production machine. * [Edit and Push Content to a Remote Repository](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.15/onboard-cortex-xsoar/remote-repositories-in-cortex-xsoar/edit-and-push-content-to-a-remote-repository.md): Edit and push Cortex XSOAR 6.15 content to a remote repository. * [Upgrade Remote Repositories from Versions 5.5 and below](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.15/onboard-cortex-xsoar/remote-repositories-in-cortex-xsoar/upgrade-remote-repositories-from-versions-5.5-and-below.md): Upgrade remote repository environments from Cortex XSOAR 5.5 to Cortex XSOAR 6.15. * [Troubleshoot a Remote Repository Configuration](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.15/onboard-cortex-xsoar/remote-repositories-in-cortex-xsoar/troubleshoot-a-remote-repository-configuration.md): Troubleshoot Cortex XSOAR 6.15 remote repository configuration and content workflow issues. * [Troubleshoot a Remote Repository Definition](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.15/onboard-cortex-xsoar/remote-repositories-in-cortex-xsoar/troubleshoot-a-remote-repository-configuration/troubleshoot-a-remote-repository-definition.md): Troubleshoot Cortex XSOAR 6.15 remote repository definition issues. * [Troubleshoot Editing and Pushing Content](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.15/onboard-cortex-xsoar/remote-repositories-in-cortex-xsoar/troubleshoot-a-remote-repository-configuration/troubleshoot-editing-and-pushing-content.md): Troubleshoot editing and pushing Cortex XSOAR 6.15 remote repository content. * [Troubleshoot Content Issues](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.15/onboard-cortex-xsoar/remote-repositories-in-cortex-xsoar/troubleshoot-a-remote-repository-configuration/troubleshoot-content-issues.md): Troubleshoot Cortex XSOAR 6.15 content issues in remote repositories. * [Troubleshoot a Remote Repository with an HTTP Proxy](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.15/onboard-cortex-xsoar/remote-repositories-in-cortex-xsoar/troubleshoot-a-remote-repository-configuration/troubleshoot-a-remote-repository-with-an-http-proxy.md): Troubleshoot a Cortex XSOAR 6.15 remote repository using an HTTP proxy. * [Engines](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.15/onboard-cortex-xsoar/engines.md): Install, manage, configure, and troubleshoot Cortex XSOAR 6.15 engines. * [Cortex XSOAR Engines Overview](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.15/onboard-cortex-xsoar/engines/cortex-xsoar-engines-overview.md): Understand Cortex XSOAR 6.15 engine architecture, installation, configuration, and load balancing groups. * [Engine Installation](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.15/onboard-cortex-xsoar/engines/engine-installation.md): Review Cortex XSOAR 6.15 engine requirements and supported installation methods. * [Install a Cortex XSOAR Engine](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.15/onboard-cortex-xsoar/engines/engine-installation/install-a-cortex-xsoar-engine.md): Install a Cortex XSOAR 6.14 engine on a supported host. * [Install a Signed Engine](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.15/onboard-cortex-xsoar/engines/engine-installation/install-a-signed-engine.md): Install a signed Cortex XSOAR 6.15 engine. * [Install a Cortex XSOAR Engine Offline](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.15/onboard-cortex-xsoar/engines/engine-installation/install-a-cortex-xsoar-engine-offline.md): Install a Cortex XSOAR 6.14 engine in an offline environment. * [Use an Engine in an Integration](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.15/onboard-cortex-xsoar/engines/use-an-engine-in-an-integration.md): Use a Cortex XSOAR 6.15 engine or load-balancing group with an integration. * [Run a Script using an Engine](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.15/onboard-cortex-xsoar/engines/run-a-script-using-an-engine.md): Run Cortex XSOAR 6.15 scripts and automations on an engine or load-balancing group. * [Manage Engines](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.15/onboard-cortex-xsoar/engines/manage-engines.md): Manage Cortex XSOAR 6.15 engines and load-balancing groups. * [Configure Engines](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.15/onboard-cortex-xsoar/engines/configure-engines.md): Configure Cortex XSOAR 6.15 engine workers, connectivity, communication tasks, and notifications. * [Edit the Engine Configuration](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.15/onboard-cortex-xsoar/engines/configure-engines/edit-the-engine-configuration.md): Edit configuration settings for a Cortex XSOAR 6.15 engine. * [Common Properties When Editing an Engine Configuration](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.15/onboard-cortex-xsoar/engines/configure-engines/common-properties-when-editing-an-engine-configuration.md): Reference common Cortex XSOAR 6.15 engine configuration properties. * [Configure the Engine to Use a Web Proxy](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.15/onboard-cortex-xsoar/engines/configure-engines/configure-the-engine-to-use-a-web-proxy.md): Configure a Cortex XSOAR 6.15 engine to use a web proxy. * [Configure the Engine to Call the Server Without Using a Proxy](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.15/onboard-cortex-xsoar/engines/configure-engines/configure-the-engine-to-call-the-server-without-using-a-proxy.md): Configure a Cortex XSOAR 6.15 engine to connect without a proxy. * [Configure the Number of Workers for the Server](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.15/onboard-cortex-xsoar/engines/configure-engines/configure-the-number-of-workers-for-the-server.md): Configure the number of workers for a Cortex XSOAR 6.15 engine. * [Configure Access to Communication Tasks through an Engine](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.15/onboard-cortex-xsoar/engines/configure-engines/configure-access-to-communication-tasks-through-an-engine.md): Configure communication task access through a Cortex XSOAR 6.15 engine. * [Configure an Engine to Use Custom Certificates](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.15/onboard-cortex-xsoar/engines/configure-engines/configure-an-engine-to-use-custom-certificates.md): Configure custom certificates for a Cortex XSOAR 6.15 engine. * [Notify Users When an Engine Disconnects](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.15/onboard-cortex-xsoar/engines/configure-engines/notify-users-when-an-engine-disconnects.md): Notify users when a Cortex XSOAR 6.15 engine disconnects. * [Remove an Engine](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.15/onboard-cortex-xsoar/engines/remove-an-engine.md): Remove a Cortex XSOAR 6.15 engine from a supported operating system. * [Troubleshoot Cortex XSOAR Engines](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.15/onboard-cortex-xsoar/engines/troubleshoot-cortex-xsoar-engines.md): Troubleshoot Cortex XSOAR 6.15 engines with logs, errors, and diagnostics. * [Customize and Configure Cortex XSOAR](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.15/customize-cortex-xsoar/customize-and-configure-cortex-xsoar.md): Customize and configure Cortex XSOAR 6.15 incidents, playbooks, data, reporting, and system settings. * [Incidents](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.15/customize-cortex-xsoar/customize-and-configure-cortex-xsoar/incidents.md): Configure Cortex XSOAR 6.15 incident types, workflows, fields, layouts, and access controls. * [Incident Lifecycle](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.15/customize-cortex-xsoar/customize-and-configure-cortex-xsoar/incidents/incident-lifecycle.md): Incidents are potential security threats analysts identify and remediate in Cortex XSOAR 6.15. * [Fetch Incidents From an Integration Instance](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.15/customize-cortex-xsoar/customize-and-configure-cortex-xsoar/incidents/incident-lifecycle/fetch-incidents-from-an-integration-instance.md): Fetch incidents from an integration instance in Cortex XSOAR 6.15. * [Receive Notification on an Incident Fetch Error](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.15/customize-cortex-xsoar/customize-and-configure-cortex-xsoar/incidents/incident-lifecycle/receive-notification-on-an-incident-fetch-error.md): Configure Cortex XSOAR 6.15 notifications for incident fetch errors. * [Incident Context Data](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.15/customize-cortex-xsoar/customize-and-configure-cortex-xsoar/incidents/incident-context-data.md): Learn about incident context data in Cortex XSOAR 6.15 and how to access it. * [Incident Customization](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.15/customize-cortex-xsoar/customize-and-configure-cortex-xsoar/incidents/incident-customization.md): Customize incidents in Cortex XSOAR 6.15, including types, fields, layouts, and indicator extraction. * [Create an Incident Type](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.15/customize-cortex-xsoar/customize-and-configure-cortex-xsoar/incidents/incident-customization/create-an-incident-type.md): Create and configure incident types in Cortex XSOAR 6.15. * [Customize Incident Layouts](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.15/customize-cortex-xsoar/customize-and-configure-cortex-xsoar/incidents/incident-customization/customize-incident-layouts.md): Customize incident layouts for Cortex XSOAR 6.15. * [Incident Fields](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.15/customize-cortex-xsoar/customize-and-configure-cortex-xsoar/incidents/incident-customization/incident-fields.md): Configure incident fields for Cortex XSOAR 6.15. * [Create a Custom Incident Field](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.15/customize-cortex-xsoar/customize-and-configure-cortex-xsoar/incidents/incident-customization/incident-fields/create-a-custom-incident-field.md): Create custom incident fields in Cortex XSOAR 6.15. * [Create a Grid Field for an Incident Type](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.15/customize-cortex-xsoar/customize-and-configure-cortex-xsoar/incidents/incident-customization/incident-fields/create-a-grid-field-for-an-incident-type.md): Create grid fields for Cortex XSOAR 6.15 incident types. * [Use Scripts with the Grid Field](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.15/customize-cortex-xsoar/customize-and-configure-cortex-xsoar/incidents/incident-customization/incident-fields/use-scripts-with-the-grid-field.md): Use scripts with Cortex XSOAR 6.15 grid incident fields. * [Incident Field Trigger Scripts](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.15/customize-cortex-xsoar/customize-and-configure-cortex-xsoar/incidents/incident-customization/incident-fields/incident-field-trigger-scripts.md): Configure Cortex XSOAR 6.15 incident field trigger scripts. * [Troubleshoot Closing Case Incident after Changing Field Type](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.15/customize-cortex-xsoar/customize-and-configure-cortex-xsoar/incidents/incident-customization/incident-fields/troubleshoot-closing-case-incident-after-changing-field-type.md): Troubleshoot Cortex XSOAR 6.15 cases after changing an incident field type. * [Create an Evidence Field](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.15/customize-cortex-xsoar/customize-and-configure-cortex-xsoar/incidents/incident-customization/incident-fields/create-an-evidence-field.md): Create evidence fields for Cortex XSOAR 6.15 incidents. * [Incident De-Duplication](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.15/customize-cortex-xsoar/customize-and-configure-cortex-xsoar/incidents/incident-de-duplication.md): De-duplicate Cortex XSOAR 6.15 incidents manually or automatically with rules, scripts, and playbooks. * [Manually De-Duplicate Incidents](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.15/customize-cortex-xsoar/customize-and-configure-cortex-xsoar/incidents/incident-de-duplication/manually-de-duplicate-incidents.md): Manually de-duplicate Cortex XSOAR 6.15 incidents. * [Automatic De-Duplication Using Scripts](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.15/customize-cortex-xsoar/customize-and-configure-cortex-xsoar/incidents/incident-de-duplication/automatic-de-duplication-using-scripts.md): Automate Cortex XSOAR 6.15 incident de-duplication with scripts. * [Pre-Process Rules](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.15/customize-cortex-xsoar/customize-and-configure-cortex-xsoar/incidents/pre-process-rules.md): Create Cortex XSOAR 6.15 pre-process rules to automate actions on incoming incidents. * [Create Pre-Process Rules for Incidents](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.15/customize-cortex-xsoar/customize-and-configure-cortex-xsoar/incidents/pre-process-rules/create-pre-process-rules-for-incidents.md): Create Cortex XSOAR 6.15 pre-process rules for incidents. * [Rule Actions for Pre-Process Rules](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.15/customize-cortex-xsoar/customize-and-configure-cortex-xsoar/incidents/pre-process-rules/create-pre-process-rules-for-incidents/rule-actions-for-pre-process-rules.md): Configure rule actions for Cortex XSOAR 6.15 pre-process rules. * [Post Processing for Incidents](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.15/customize-cortex-xsoar/customize-and-configure-cortex-xsoar/incidents/post-processing-for-incidents.md): Configure Cortex XSOAR 6.15 post-processing scripts to automate actions before incident closure. * [Create a Post-Processing Script](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.15/customize-cortex-xsoar/customize-and-configure-cortex-xsoar/incidents/post-processing-for-incidents/create-a-post-processing-script.md): Create post-processing scripts for Cortex XSOAR 6.15 incidents. * [Add a Post-Processing Script to the Incident Type](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.15/customize-cortex-xsoar/customize-and-configure-cortex-xsoar/incidents/post-processing-for-incidents/add-a-post-processing-script-to-the-incident-type.md): Add post-processing scripts to Cortex XSOAR 6.15 incident types. * [War Room Overview](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.15/customize-cortex-xsoar/customize-and-configure-cortex-xsoar/incidents/war-room-overview.md): Use the Cortex XSOAR 6.15 War Room for real-time incident investigation, commands, and collaboration. * [Schedule a Command](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.15/customize-cortex-xsoar/customize-and-configure-cortex-xsoar/incidents/war-room-overview/schedule-a-command.md): Schedule commands in the Cortex XSOAR 6.15 War Room. * [Add a Custom Widget in the War Room](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.15/customize-cortex-xsoar/customize-and-configure-cortex-xsoar/incidents/war-room-overview/add-a-custom-widget-in-the-war-room.md): Add custom widgets to the Cortex XSOAR 6.15 War Room. * [War Room Indexing](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.15/customize-cortex-xsoar/customize-and-configure-cortex-xsoar/incidents/war-room-overview/war-room-indexing.md): Configure War Room indexing in Cortex XSOAR 6.15. * [Index War Room Entries Using Bolt DB](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.15/customize-cortex-xsoar/customize-and-configure-cortex-xsoar/incidents/war-room-overview/war-room-indexing/index-war-room-entries-using-bolt-db.md): Index Cortex XSOAR 6.15 War Room entries with Bolt DB. * [Index War Room Entries Using Elasticsearch](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.15/customize-cortex-xsoar/customize-and-configure-cortex-xsoar/incidents/war-room-overview/war-room-indexing/index-war-room-entries-using-elasticsearch.md): Index Cortex XSOAR 6.15 War Room entries with Elasticsearch. * [Incident Access Control Configuration](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.15/customize-cortex-xsoar/customize-and-configure-cortex-xsoar/incidents/incident-access-control-configuration.md): Configure Cortex XSOAR 6.15 incident and investigation access with role-based access controls. * [Limit Access to Investigations using RBAC](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.15/customize-cortex-xsoar/customize-and-configure-cortex-xsoar/incidents/incident-access-control-configuration/limit-access-to-investigations-using-rbac.md): Limit Cortex XSOAR 6.15 investigation access with role-based controls. * [Restrict an Investigation](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.15/customize-cortex-xsoar/customize-and-configure-cortex-xsoar/incidents/incident-access-control-configuration/restrict-an-investigation.md): Restrict access to Cortex XSOAR 6.15 investigations. * [Classification and Mapping](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.15/customize-cortex-xsoar/customize-and-configure-cortex-xsoar/incidents/classification-and-mapping.md): Classify and map incoming integration data to Cortex XSOAR 6.15 incidents and indicators. * [Classify Events Using a Classification Key](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.15/customize-cortex-xsoar/customize-and-configure-cortex-xsoar/incidents/classification-and-mapping/classify-events-using-a-classification-key.md): Classify events with a classification key in Cortex XSOAR 6.15. * [Create a Mapper](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.15/customize-cortex-xsoar/customize-and-configure-cortex-xsoar/incidents/classification-and-mapping/create-a-mapper.md): Create mappers for Cortex XSOAR 6.15 incident classification and mapping. * [Incident Mirroring](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.15/customize-cortex-xsoar/customize-and-configure-cortex-xsoar/incidents/incident-mirroring.md): Configure Cortex XSOAR 6.15 incident mirroring with third-party applications and integrations. * [Customize Incident Close Reasons](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.15/customize-cortex-xsoar/customize-and-configure-cortex-xsoar/incidents/customize-incident-close-reasons.md): Customize close reasons for incidents by adding a server configuration in Cortex XSOAR 6.15. * [Change the Display Name of Security Incidents](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.15/customize-cortex-xsoar/customize-and-configure-cortex-xsoar/incidents/change-the-display-name-of-security-incidents.md): Add a Cortex XSOAR 6.15 server configuration to change the name of security incidents from ‘incident’ to another term - cases, issues, etc. * [Playbooks](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.15/customize-cortex-xsoar/customize-and-configure-cortex-xsoar/playbooks.md): Build and manage Cortex XSOAR 6.15 playbooks for security orchestration and response. * [What Are Playbooks?](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.15/customize-cortex-xsoar/customize-and-configure-cortex-xsoar/playbooks/what-are-playbooks.md): Understand Cortex XSOAR 6.15 playbooks for security process automation and incident remediation. * [Playbook Development](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.15/customize-cortex-xsoar/customize-and-configure-cortex-xsoar/playbooks/playbook-development.md): Develop Cortex XSOAR 6.15 playbooks to automate security workflows and response actions. * [Configure IoT Security Playbooks](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.15/customize-cortex-xsoar/customize-and-configure-cortex-xsoar/playbooks/configure-iot-security-playbooks.md): Configure Cortex XSOAR 6.15 IoT Security playbooks for automated security workflows. * [Manage Playbook Settings](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.15/customize-cortex-xsoar/customize-and-configure-cortex-xsoar/playbooks/manage-playbook-settings.md): Configure Cortex XSOAR 6.15 playbook settings, access, triggers, and Quiet Mode. * [Obtain Playbook Metadata](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.15/customize-cortex-xsoar/customize-and-configure-cortex-xsoar/playbooks/manage-playbook-settings/obtain-playbook-metadata.md): Analyze incident playbook task inputs, outputs, storage use, and task types in Cortex XSOAR 6.15. * [Version Control](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.15/customize-cortex-xsoar/customize-and-configure-cortex-xsoar/playbooks/version-control.md): Save and manage Cortex XSOAR 6.15 playbook versions during development. * [Playbook Task Fields](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.15/customize-cortex-xsoar/customize-and-configure-cortex-xsoar/playbooks/playbook-task-fields.md): Reference fields for defining Cortex XSOAR 6.15 playbook tasks. * [Create Section Headers](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.15/customize-cortex-xsoar/customize-and-configure-cortex-xsoar/playbooks/playbook-task-fields/create-section-headers.md): Create section headers to organize Cortex XSOAR 6.15 playbook tasks. * [Create a Conditional Task](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.15/customize-cortex-xsoar/customize-and-configure-cortex-xsoar/playbooks/playbook-task-fields/create-a-conditional-task.md): Create conditional tasks for branching Cortex XSOAR 6.15 playbook workflows. * [Communication Tasks](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.15/customize-cortex-xsoar/customize-and-configure-cortex-xsoar/playbooks/playbook-task-fields/communication-tasks.md): Configure Cortex XSOAR 6.15 playbook communication tasks for analyst interactions. * [Create an Ask Task](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.15/customize-cortex-xsoar/customize-and-configure-cortex-xsoar/playbooks/playbook-task-fields/communication-tasks/create-an-ask-task.md): Create Cortex XSOAR 6.15 Ask tasks to collect analyst responses. * [Ask Task Examples](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.15/customize-cortex-xsoar/customize-and-configure-cortex-xsoar/playbooks/playbook-task-fields/communication-tasks/create-an-ask-task/ask-task-examples.md): Review Cortex XSOAR 6.15 Ask task examples for playbook communication. * [Customize an Ask Task](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.15/customize-cortex-xsoar/customize-and-configure-cortex-xsoar/playbooks/playbook-task-fields/communication-tasks/create-an-ask-task/customize-an-ask-task.md): Customize Cortex XSOAR 6.15 Ask tasks for analyst communication workflows. * [Create a Data Collection Task](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.15/customize-cortex-xsoar/customize-and-configure-cortex-xsoar/playbooks/playbook-task-fields/communication-tasks/create-a-data-collection-task.md): Create Cortex XSOAR 6.15 data collection tasks to gather analyst input. * [Data Collection Task Examples](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.15/customize-cortex-xsoar/customize-and-configure-cortex-xsoar/playbooks/playbook-task-fields/communication-tasks/create-a-data-collection-task/data-collection-task-examples.md): Review Cortex XSOAR 6.15 data collection task examples for playbooks. * [Customize a Data Collection Task](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.15/customize-cortex-xsoar/customize-and-configure-cortex-xsoar/playbooks/playbook-task-fields/communication-tasks/create-a-data-collection-task/customize-a-data-collection-task.md): Customize Cortex XSOAR 6.15 data collection tasks for playbook workflows. * [Customize the SOC Name](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.15/customize-cortex-xsoar/customize-and-configure-cortex-xsoar/playbooks/playbook-task-fields/communication-tasks/customize-the-soc-name.md): Customize the SOC name shown in Cortex XSOAR 6.15 communication tasks. * [Create Communication Task Authentication](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.15/customize-cortex-xsoar/customize-and-configure-cortex-xsoar/playbooks/playbook-task-fields/communication-tasks/create-communication-task-authentication.md): Configure authentication for Cortex XSOAR 6.15 communication tasks. * [Add Ad Hoc Tasks to a Work Plan](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.15/customize-cortex-xsoar/customize-and-configure-cortex-xsoar/playbooks/playbook-task-fields/communication-tasks/add-ad-hoc-tasks-to-a-work-plan.md): Add ad hoc tasks to Cortex XSOAR 6.15 incident work plans. * [Handle Errors in a Playbook](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.15/customize-cortex-xsoar/customize-and-configure-cortex-xsoar/playbooks/playbook-task-fields/communication-tasks/handle-errors-in-a-playbook.md): Handle task errors in Cortex XSOAR 6.15 playbooks and automation workflows. * [Playbook Task Fields](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.15/customize-cortex-xsoar/customize-and-configure-cortex-xsoar/playbooks/playbook-task-fields/communication-tasks/playbook-task-fields.md): Reference Cortex XSOAR 6.15 fields for communication playbook tasks. * [Playbook Inputs and Outputs](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.15/customize-cortex-xsoar/customize-and-configure-cortex-xsoar/playbooks/playbook-inputs-and-outputs.md): Configure Cortex XSOAR 6.15 playbook inputs and outputs for task data flow. * [Task Cheat Sheet](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.15/customize-cortex-xsoar/customize-and-configure-cortex-xsoar/playbooks/playbook-inputs-and-outputs/task-cheat-sheet.md): Use this Cortex XSOAR 6.15 cheat sheet for playbook task configuration. * [Extend Context](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.15/customize-cortex-xsoar/customize-and-configure-cortex-xsoar/playbooks/extend-context.md): Extend Cortex XSOAR 6.15 context with integration and command output data. * [Extend Context in a Playbook Task](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.15/customize-cortex-xsoar/customize-and-configure-cortex-xsoar/playbooks/extend-context/extend-context-in-a-playbook-task.md): Extend context within a Cortex XSOAR 6.15 playbook task. * [Extend Context using the Command Line](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.15/customize-cortex-xsoar/customize-and-configure-cortex-xsoar/playbooks/extend-context/extend-context-using-the-command-line.md): Extend Cortex XSOAR 6.15 context using command-line commands. * [Use DT syntax to get select keys from a list of dictionaries](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.15/customize-cortex-xsoar/customize-and-configure-cortex-xsoar/playbooks/extend-context/use-dt-syntax-to-get-select-keys-from-a-list-of-dictionaries.md): Use DT syntax in Cortex XSOAR 6.15 to select dictionary list keys. * [Filters and Transformers](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.15/customize-cortex-xsoar/customize-and-configure-cortex-xsoar/playbooks/filters-and-transformers.md): Use Cortex XSOAR 6.15 filters and transformers to manipulate playbook data. * [Create Filters and Transformers in a Playbook](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.15/customize-cortex-xsoar/customize-and-configure-cortex-xsoar/playbooks/filters-and-transformers/create-filters-and-transformers-in-a-playbook.md): Create filters and transformers for Cortex XSOAR 6.15 playbook tasks. * [Create a Filter Example](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.15/customize-cortex-xsoar/customize-and-configure-cortex-xsoar/playbooks/filters-and-transformers/create-filters-and-transformers-in-a-playbook/create-a-filter-example.md): Create a Cortex XSOAR 6.15 playbook filter with this example. * [Create a Filter (Advanced) Example](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.15/customize-cortex-xsoar/customize-and-configure-cortex-xsoar/playbooks/filters-and-transformers/create-filters-and-transformers-in-a-playbook/create-a-filter-advanced-example.md): Create advanced Cortex XSOAR 6.15 playbook filters with this example. * [Filter Operators](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.15/customize-cortex-xsoar/customize-and-configure-cortex-xsoar/playbooks/filters-and-transformers/filter-operators.md): Reference filter operators for Cortex XSOAR 6.15 playbook data processing. * [Built-in Filters](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.15/customize-cortex-xsoar/customize-and-configure-cortex-xsoar/playbooks/filters-and-transformers/filter-operators/built-in-filters.md): Use built-in filters to transform Cortex XSOAR 6.15 playbook data. * [Transformers Operators](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.15/customize-cortex-xsoar/customize-and-configure-cortex-xsoar/playbooks/filters-and-transformers/filter-operators/transformers-operators.md): Reference transformer operators for Cortex XSOAR 6.15 playbook data. * [Create Custom Filter and Transformer Operators](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.15/customize-cortex-xsoar/customize-and-configure-cortex-xsoar/playbooks/filters-and-transformers/filter-operators/create-custom-filter-and-transformer-operators.md): Create custom filters and transformers for Cortex XSOAR 6.15 playbooks. * [Automations](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.15/customize-cortex-xsoar/customize-and-configure-cortex-xsoar/playbooks/automations.md): Create and manage Cortex XSOAR 6.15 automations for playbook workflows. * [Special Automation Tags](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.15/customize-cortex-xsoar/customize-and-configure-cortex-xsoar/playbooks/automations/special-automation-tags.md): Reference special automation tags in Cortex XSOAR 6.15. * [Common Scripts to use in Automations](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.15/customize-cortex-xsoar/customize-and-configure-cortex-xsoar/playbooks/automations/common-scripts-to-use-in-automations.md): Use common Cortex XSOAR 6.15 scripts in automation workflows. * [Configure a Sub-playbook Loop](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.15/customize-cortex-xsoar/customize-and-configure-cortex-xsoar/playbooks/configure-a-sub-playbook-loop.md): Configure a Cortex XSOAR 6.15 sub-playbook to run in a loop. * [Playbook Polling](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.15/customize-cortex-xsoar/customize-and-configure-cortex-xsoar/playbooks/playbook-polling.md): Use the Cortex XSOAR 6.15 Generic Polling playbook to check remote process status. * [Create Incident Fields in a Playbook](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.15/customize-cortex-xsoar/customize-and-configure-cortex-xsoar/playbooks/create-incident-fields-in-a-playbook.md): Use the Cortex XSOAR 6.15 setIncident automation to update system incident fields. * [Playbook Testing](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.15/customize-cortex-xsoar/customize-and-configure-cortex-xsoar/playbooks/playbook-testing.md): Test Cortex XSOAR 6.15 playbooks with ingested incidents. * [Debug a Playbook](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.15/customize-cortex-xsoar/customize-and-configure-cortex-xsoar/playbooks/playbook-testing/debug-a-playbook.md): Debug Cortex XSOAR 6.15 playbooks to inspect tasks and execution flow. * [Debugger Troubleshooting](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.15/customize-cortex-xsoar/customize-and-configure-cortex-xsoar/playbooks/playbook-testing/debugger-troubleshooting.md): Troubleshoot the Cortex XSOAR 6.15 playbook debugger. * [Playbook Best Practices](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.15/customize-cortex-xsoar/customize-and-configure-cortex-xsoar/playbooks/best-practices.md): Follow best practices for developing and managing Cortex XSOAR 6.15 playbooks. * [Jobs](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.15/customize-cortex-xsoar/customize-and-configure-cortex-xsoar/jobs.md): Schedule Cortex XSOAR 6.15 playbooks with time-triggered and feed-triggered jobs. * [Create a Time Triggered Job](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.15/customize-cortex-xsoar/customize-and-configure-cortex-xsoar/jobs/create-a-time-triggered-job.md): Create a time-triggered Cortex XSOAR 6.15 job to run a playbook. * [Create a Job Triggered by a Delta in Feed](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.15/customize-cortex-xsoar/customize-and-configure-cortex-xsoar/jobs/create-a-job-triggered-by-a-delta-in-feed.md): Create a Cortex XSOAR 6.15 job triggered by feed changes. * [Time Triggered Job Parameters](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.15/customize-cortex-xsoar/customize-and-configure-cortex-xsoar/jobs/time-triggered-job-parameters.md): Describe parameters for creating a time-triggered job in Cortex XSOAR 6.15. * [Process Indicators Using a Job Triggered By Delta](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.15/customize-cortex-xsoar/customize-and-configure-cortex-xsoar/jobs/process-indicators-using-a-job-triggered-by-delta.md): Process indicators with a feed-triggered Cortex XSOAR 6.15 job. * [Add Indicators to SIEM Using a Time Triggered Job](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.15/customize-cortex-xsoar/customize-and-configure-cortex-xsoar/jobs/add-indicators-to-siem-using-a-time-triggered-job.md): Send indicators to a SIEM with a time-triggered Cortex XSOAR 6.15 job. * [Work with SLAs](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.15/customize-cortex-xsoar/customize-and-configure-cortex-xsoar/work-with-slas.md): Create and manage Cortex XSOAR 6.15 SLAs, timers, triggers, scripts, and risk thresholds. * [SLA Overview](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.15/customize-cortex-xsoar/customize-and-configure-cortex-xsoar/work-with-slas/sla-overview.md): Understand SLA fields, timers, and actions in Cortex XSOAR 6.15. * [Create an SLA Field](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.15/customize-cortex-xsoar/customize-and-configure-cortex-xsoar/work-with-slas/create-an-sla-field.md): Create SLA and timer fields in Cortex XSOAR 6.15. * [Manage SLA and Timer Fields in an Incident](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.15/customize-cortex-xsoar/customize-and-configure-cortex-xsoar/work-with-slas/manage-sla-and-timer-fields-in-an-incident.md): Manage incident SLA and timer fields in Cortex XSOAR 6.15. * [Create an SLA Trigger](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.15/customize-cortex-xsoar/customize-and-configure-cortex-xsoar/work-with-slas/create-an-sla-trigger.md): Create SLA triggers for Cortex XSOAR 6.15 playbook tasks. * [Customize SLA Scripts](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.15/customize-cortex-xsoar/customize-and-configure-cortex-xsoar/work-with-slas/customize-sla-scripts.md): Customize SLA scripts for Cortex XSOAR 6.15. * [Search Incidents using SLA and Timer Fields](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.15/customize-cortex-xsoar/customize-and-configure-cortex-xsoar/work-with-slas/search-incidents-using-sla-and-timer-fields.md): Search Cortex XSOAR 6.15 incidents by SLA and timer fields. * [Configure the Global Risk Threshold](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.15/customize-cortex-xsoar/customize-and-configure-cortex-xsoar/work-with-slas/configure-the-global-risk-threshold.md): Configure the global SLA risk threshold in Cortex XSOAR 6.15. * [Machine Learning](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.15/customize-cortex-xsoar/customize-and-configure-cortex-xsoar/machine-learning.md): Use Cortex XSOAR 6.15 machine learning models for phishing classification and automation. * [Machine Learning Capabilities](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.15/customize-cortex-xsoar/customize-and-configure-cortex-xsoar/machine-learning/machine-learning-capabilities.md): Explore Cortex XSOAR 6.15 machine learning and phishing classifier capabilities. * [Machine Learning Models](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.15/customize-cortex-xsoar/customize-and-configure-cortex-xsoar/machine-learning/machine-learning-models.md): Use Cortex XSOAR 6.15 machine learning models for incident analysis. * [Use the Phishing Classifier in Production](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.15/customize-cortex-xsoar/customize-and-configure-cortex-xsoar/machine-learning/use-the-phishing-classifier-in-production.md): Use the Cortex XSOAR 6.15 phishing classifier in production. * [Create a Machine Learning Model](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.15/customize-cortex-xsoar/customize-and-configure-cortex-xsoar/machine-learning/create-a-machine-learning-model.md): Create a Cortex XSOAR 6.15 machine learning model for phishing classification. * [Phishing Classifier Demo](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.15/customize-cortex-xsoar/customize-and-configure-cortex-xsoar/machine-learning/phishing-classifier-demo.md): Try the Cortex XSOAR 6.15 phishing classifier demonstration. * [Train a Phishing Classifier on Non-English Languages](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.15/customize-cortex-xsoar/customize-and-configure-cortex-xsoar/machine-learning/train-a-phishing-classifier-on-non-english-languages.md): Train a Cortex XSOAR 6.15 phishing classifier for non-English language emails. * [Additional Machine Learning Scripts](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.15/customize-cortex-xsoar/customize-and-configure-cortex-xsoar/machine-learning/additional-machine-learning-scripts.md): Reference additional Cortex XSOAR 6.15 machine learning scripts. * [Lists](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.15/customize-cortex-xsoar/customize-and-configure-cortex-xsoar/lists.md): Create and manage Cortex XSOAR 6.15 lists for playbooks and automations. * [Work With Lists](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.15/customize-cortex-xsoar/customize-and-configure-cortex-xsoar/lists/work-with-lists.md): Manage lists in Cortex XSOAR 6.15 that automations and playbooks can access. * [Work with JSON Lists](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.15/customize-cortex-xsoar/customize-and-configure-cortex-xsoar/lists/work-with-lists/work-with-json-lists.md): Extract, filter, and transform JSON list data in Cortex XSOAR 6.15 playbooks. * [Create a List](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.15/customize-cortex-xsoar/customize-and-configure-cortex-xsoar/lists/create-a-list.md): Create Cortex XSOAR 6.15 lists that scripts can parse and modify. * [Set the List Separator Character](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.15/customize-cortex-xsoar/customize-and-configure-cortex-xsoar/lists/set-the-list-separator-character.md): Set the list separator character in Cortex XSOAR 6.15. The default is a comma. * [Transform a List into an Array](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.15/customize-cortex-xsoar/customize-and-configure-cortex-xsoar/lists/transform-a-list-into-an-array.md): Transform a list into an array for playbook tasks and instance mapping in Cortex XSOAR 6.15. * [Indicators](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.15/customize-cortex-xsoar/customize-and-configure-cortex-xsoar/indicators.md): Manage Cortex XSOAR 6.15 threat indicators, including types, fields, extraction, enrichment, expiration, and feeds. * [Indicator Concepts](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.15/customize-cortex-xsoar/customize-and-configure-cortex-xsoar/indicators/indicator-concepts.md): Learn Cortex XSOAR 6.15 threat intelligence concepts, including fetching, configuring, enriching, and exporting indicators. * [Indicator Verdict](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.15/customize-cortex-xsoar/customize-and-configure-cortex-xsoar/indicators/indicator-verdict.md): Understand how Cortex XSOAR 6.15 assigns and uses indicator verdicts from the most reliable reputation source. * [Indicator Ingestion](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.15/customize-cortex-xsoar/customize-and-configure-cortex-xsoar/indicators/indicator-ingestion.md): Understand how Cortex XSOAR 6.15 detects, ingests, and processes threat indicators from supported sources. * [Indicator Customization](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.15/customize-cortex-xsoar/customize-and-configure-cortex-xsoar/indicators/indicator-customization.md): Customize Cortex XSOAR 6.15 indicator types, fields, scripts, profiles, and layouts for threat intelligence workflows. * [Indicator Types](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.15/customize-cortex-xsoar/customize-and-configure-cortex-xsoar/indicators/indicator-customization/indicator-types.md): Configure Cortex XSOAR 6.15 indicator types, associated fields, profiles, and scripts for threat intelligence data. * [File Indicators](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.15/customize-cortex-xsoar/customize-and-configure-cortex-xsoar/indicators/indicator-customization/indicator-types/file-indicators.md): Manage Cortex XSOAR 6.15 file indicators and their associated hash values for threat intelligence workflows. * [File Indicator Merging Strategy](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.15/customize-cortex-xsoar/customize-and-configure-cortex-xsoar/indicators/indicator-customization/indicator-types/file-indicators/file-indicator-merging-strategy.md): Understand how Cortex XSOAR 6.15 merges file indicators using their hash values. * [Create an Indicator Type](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.15/customize-cortex-xsoar/customize-and-configure-cortex-xsoar/indicators/indicator-customization/indicator-types/create-an-indicator-type.md): Create a custom Cortex XSOAR 6.15 indicator type for structured threat intelligence data. * [Indicator Type Profile](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.15/customize-cortex-xsoar/customize-and-configure-cortex-xsoar/indicators/indicator-customization/indicator-types/indicator-type-profile.md): Configure Cortex XSOAR 6.15 indicator type profiles to control indicator fields and behavior. * [Map Custom Indicator Fields](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.15/customize-cortex-xsoar/customize-and-configure-cortex-xsoar/indicators/indicator-customization/indicator-types/map-custom-indicator-fields.md): Map custom fields to Cortex XSOAR 6.15 indicator data for consistent threat intelligence management. * [Formatting Scripts](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.15/customize-cortex-xsoar/customize-and-configure-cortex-xsoar/indicators/indicator-customization/indicator-types/formatting-scripts.md): Configure Cortex XSOAR 6.15 formatting scripts to normalize indicator values and output. * [Enhancement Scripts](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.15/customize-cortex-xsoar/customize-and-configure-cortex-xsoar/indicators/indicator-customization/indicator-types/enhancement-scripts.md): Configure Cortex XSOAR 6.15 enhancement scripts to enrich indicators on demand. * [Reputation Scripts](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.15/customize-cortex-xsoar/customize-and-configure-cortex-xsoar/indicators/indicator-customization/indicator-types/reputation-scripts.md): Configure Cortex XSOAR 6.15 reputation scripts that calculate and update indicator verdicts. * [Reputation Commands](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.15/customize-cortex-xsoar/customize-and-configure-cortex-xsoar/indicators/indicator-customization/indicator-types/reputation-commands.md): Configure Cortex XSOAR 6.15 reputation commands that calculate and update indicator verdicts. * [Indicator Fields](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.15/customize-cortex-xsoar/customize-and-configure-cortex-xsoar/indicators/indicator-customization/indicator-fields.md): Create and configure Cortex XSOAR 6.15 indicator fields for structured threat intelligence data. * [Create a Custom Indicator Field](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.15/customize-cortex-xsoar/customize-and-configure-cortex-xsoar/indicators/indicator-customization/indicator-fields/create-a-custom-indicator-field.md): Create a custom Cortex XSOAR 6.15 indicator field for tailored threat intelligence data. * [Configure the HTML Field](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.15/customize-cortex-xsoar/customize-and-configure-cortex-xsoar/indicators/indicator-customization/indicator-fields/create-a-custom-indicator-field/configure-the-html-field.md): Configure HTML indicator fields in Cortex XSOAR 6.15 to display rich threat intelligence content. * [Indicator Field Trigger Scripts](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.15/customize-cortex-xsoar/customize-and-configure-cortex-xsoar/indicators/indicator-customization/indicator-fields/indicator-field-trigger-scripts.md): Run Cortex XSOAR 6.15 scripts automatically when indicator field values change. * [Indicator Layouts](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.15/customize-cortex-xsoar/customize-and-configure-cortex-xsoar/indicators/indicator-customization/indicator-layouts.md): Customize Cortex XSOAR 6.15 layouts for indicator types and threat intelligence investigations. * [Customize an Indicator Type Layout](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.15/customize-cortex-xsoar/customize-and-configure-cortex-xsoar/indicators/indicator-customization/indicator-layouts/customize-an-indicator-type-layout.md): Customize a Cortex XSOAR 6.15 layout for an indicator type and its threat intelligence data. * [Add a Script in the Indicator Layout](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.15/customize-cortex-xsoar/customize-and-configure-cortex-xsoar/indicators/indicator-customization/indicator-layouts/add-a-script-in-the-indicator-layout.md): Add dynamic script output to a Cortex XSOAR 6.15 indicator layout. * [Indicator Extraction](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.15/customize-cortex-xsoar/customize-and-configure-cortex-xsoar/indicators/indicator-extraction.md): Configure Cortex XSOAR 6.15 indicator extraction and enrichment from incident fields, playbook tasks, and CLI commands. * [Indicator Extraction Modes](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.15/customize-cortex-xsoar/customize-and-configure-cortex-xsoar/indicators/indicator-extraction/indicator-extraction-modes.md): Understand Cortex XSOAR 6.15 indicator extraction modes and their behavior for incident data. * [Create Indicator Extraction Rules for an Incident Type](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.15/customize-cortex-xsoar/customize-and-configure-cortex-xsoar/indicators/indicator-extraction/create-indicator-extraction-rules-for-an-incident-type.md): Configure Cortex XSOAR 6.15 indicator extraction rules for incident types and fields. * [Run Indicator Extraction in the CLI](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.15/customize-cortex-xsoar/customize-and-configure-cortex-xsoar/indicators/indicator-extraction/run-indicator-extraction-in-the-cli.md): Extract and enrich Cortex XSOAR 6.15 indicators from the command-line interface. * [Create Indicator Extract Rules for a Playbook Task](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.15/customize-cortex-xsoar/customize-and-configure-cortex-xsoar/indicators/indicator-extraction/create-indicator-extract-rules-for-a-playbook-task.md): Configure Cortex XSOAR 6.15 indicator extraction rules for playbook tasks. * [Disable Indicator Extraction for Automations or Integrations](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.15/customize-cortex-xsoar/customize-and-configure-cortex-xsoar/indicators/indicator-extraction/disable-indicator-extraction-for-automations-or-integrations.md): Disable Cortex XSOAR 6.15 indicator extraction for selected automations or integrations. * [Indicator Expiration](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.15/customize-cortex-xsoar/customize-and-configure-cortex-xsoar/indicators/indicator-expiration.md): Configure Cortex XSOAR 6.15 indicator expiration statuses, default methods, and retention periods. * [Feed Integrations](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.15/customize-cortex-xsoar/customize-and-configure-cortex-xsoar/indicators/feed-integrations.md): Use Cortex XSOAR 6.15 feed integrations to fetch and process threat indicators from intelligence sources. * [Set the Source Reliability of Enrichment Integrations](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.15/customize-cortex-xsoar/customize-and-configure-cortex-xsoar/indicators/feed-integrations/set-the-source-reliability-of-enrichment-integrations.md): Set Cortex XSOAR 6.15 source reliability for enrichment integrations and indicator reputation data. * [Dashboards](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.15/customize-cortex-xsoar/customize-and-configure-cortex-xsoar/dashboards.md): Create, customize, share, and manage Cortex XSOAR 6.15 dashboards and widgets for security operations data. * [Dashboard Overview](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.15/customize-cortex-xsoar/customize-and-configure-cortex-xsoar/dashboards/dashboard-overview.md): Explore Cortex XSOAR 6.15 dashboards, customizable widgets, filters, sharing, imports, exports, and dashboard management. * [Create a Dashboard](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.15/customize-cortex-xsoar/customize-and-configure-cortex-xsoar/dashboards/create-a-dashboard.md): Create and customize a Cortex XSOAR 6.15 dashboard with widgets, data views, and security operations insights. * [Add a Widget to a Dashboard](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.15/customize-cortex-xsoar/customize-and-configure-cortex-xsoar/dashboards/add-a-widget-to-a-dashboard.md): Add and configure widgets on Cortex XSOAR 6.15 dashboards, including widget parameters and date ranges. * [Share a Dashboard](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.15/customize-cortex-xsoar/customize-and-configure-cortex-xsoar/dashboards/share-a-dashboard.md): Share Cortex XSOAR 6.15 dashboards with users by role and manage permissions for shared dashboard access. * [Edit a Dashboard](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.15/customize-cortex-xsoar/customize-and-configure-cortex-xsoar/dashboards/edit-a-dashboard.md): Edit Cortex XSOAR 6.15 dashboards by managing widgets, date ranges, layout, size, and position. * [Reports](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.15/customize-cortex-xsoar/customize-and-configure-cortex-xsoar/reports.md): Create, customize, schedule, and troubleshoot Cortex XSOAR 6.15 reports for security operations data. * [Reports Overview](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.15/customize-cortex-xsoar/customize-and-configure-cortex-xsoar/reports/reports-overview.md): Explore Cortex XSOAR 6.15 reporting features, including report creation, customization, scheduling, formats, and branding. * [Create a Report](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.15/customize-cortex-xsoar/customize-and-configure-cortex-xsoar/reports/create-a-report.md): Create and customize Cortex XSOAR 6.15 reports with widgets, schedules, recipients, and PDF, CSV, or Word output. * [Schedule a report](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.15/customize-cortex-xsoar/customize-and-configure-cortex-xsoar/reports/schedule-a-report.md): Schedule Cortex XSOAR 6.15 reports with email recipients, role restrictions, start dates, and Cron expressions. * [Customize the Email When Sending a Report](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.15/customize-cortex-xsoar/customize-and-configure-cortex-xsoar/reports/customize-the-email-when-sending-a-report.md): Customize Cortex XSOAR 6.15 report email subjects, message bodies, and HTML content for scheduled delivery. * [Create an Incident Summary Report](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.15/customize-cortex-xsoar/customize-and-configure-cortex-xsoar/reports/create-an-incident-summary-report.md): Create Cortex XSOAR 6.15 incident summary reports from incident pages and save report templates. * [Select and Customize Sections to Export to a Summary Report](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.15/customize-cortex-xsoar/customize-and-configure-cortex-xsoar/reports/select-and-customize-sections-to-export-to-a-summary-report.md): Select and customize Cortex XSOAR 6.15 summary report sections, then save the report as a reusable template. * [Add a Widget to a Report](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.15/customize-cortex-xsoar/customize-and-configure-cortex-xsoar/reports/add-a-widget-to-a-report.md): Add and configure widgets in Cortex XSOAR 6.15 reports to visualize security operations data. * [Edit a report](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.15/customize-cortex-xsoar/customize-and-configure-cortex-xsoar/reports/edit-a-report.md): Edit Cortex XSOAR 6.15 report widgets, layout, and output type for custom reports. * [Change the Report Logo](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.15/customize-cortex-xsoar/customize-and-configure-cortex-xsoar/reports/change-the-report-logo.md): Add and customize a company logo in Cortex XSOAR 6.15 reports using server configuration settings. * [Configure the Time Zone and Format in a Report](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.15/customize-cortex-xsoar/customize-and-configure-cortex-xsoar/reports/configure-the-time-zone-and-format-in-a-report.md): Configure Cortex XSOAR 6.15 report time zones and date formats, and resolve related display issues. * [Troubleshoot Reports](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.15/customize-cortex-xsoar/customize-and-configure-cortex-xsoar/reports/troubleshoot-reports.md): Troubleshoot Cortex XSOAR 6.15 reports by downloading and reviewing report JSON output. * [Widgets](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.15/customize-cortex-xsoar/customize-and-configure-cortex-xsoar/widgets.md): Create, customize, and manage Cortex XSOAR 6.15 widgets for dashboards, reports, and security operations data. * [Widgets Overview](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.15/customize-cortex-xsoar/customize-and-configure-cortex-xsoar/widgets/widgets-overview.md): Explore Cortex XSOAR 6.15 widgets and learn how to create, configure, and use them in dashboards and reports. * [Create a Widget using the Widget Builder](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.15/customize-cortex-xsoar/customize-and-configure-cortex-xsoar/widgets/create-a-widget-using-the-widget-builder.md): Create Cortex XSOAR 6.15 widgets with the Widget Builder for dashboards and reports. * [Create a Custom Widget Using a JSON File](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.15/customize-cortex-xsoar/customize-and-configure-cortex-xsoar/widgets/create-a-custom-widget-using-a-json-file.md): Create custom Cortex XSOAR 6.15 widgets from JSON files for dashboards and reports. * [Create a Custom Widget Using an Automation Script](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.15/customize-cortex-xsoar/customize-and-configure-cortex-xsoar/widgets/create-a-custom-widget-using-an-automation-script.md): Create custom Cortex XSOAR 6.15 widgets with automation scripts for dashboards and reports. * [Edit a Widget](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.15/customize-cortex-xsoar/customize-and-configure-cortex-xsoar/widgets/edit-a-widget.md): Edit Cortex XSOAR 6.15 widgets in the Widgets Library, dashboards, and reports. * [Create a Used Percentage Widget for a Disk Partition](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.15/customize-cortex-xsoar/customize-and-configure-cortex-xsoar/widgets/create-a-used-percentage-widget-for-a-disk-partition.md): Create a Cortex XSOAR 6.15 disk partition usage widget with server configuration and a dashboard. * [Saved By Dbot (ROI) Widget](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.15/customize-cortex-xsoar/customize-and-configure-cortex-xsoar/widgets/saved-by-dbot-roi-widget.md): Configure the Cortex XSOAR 6.15 Saved by Dbot widget to calculate security operations return on investment. * [Manage Data](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.15/customize-cortex-xsoar/customize-and-configure-cortex-xsoar/manage-data.md): Manage Cortex XSOAR 6.15 data with reindexing, archiving, migration, storage, and restoration procedures. * [Reindex the Entire Database](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.15/customize-cortex-xsoar/customize-and-configure-cortex-xsoar/manage-data/reindex-the-entire-database.md): Reindex the entire Cortex XSOAR 6.15 database to rebuild searchable data and indexes. * [Reindex a Specific Index Database](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.15/customize-cortex-xsoar/customize-and-configure-cortex-xsoar/manage-data/reindex-a-specific-index-database.md): Reindex specific Cortex XSOAR 6.15 index databases, including multiple selected indexes. * [Reindex the Audit Log](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.15/customize-cortex-xsoar/customize-and-configure-cortex-xsoar/manage-data/reindex-the-audit-log.md): Reindex the Cortex XSOAR 6.15 audit log to restore searchable historical audit trail data. * [Free up Disk Space with Data Archiving](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.15/customize-cortex-xsoar/customize-and-configure-cortex-xsoar/manage-data/free-up-disk-space-with-data-archiving.md): Free Cortex XSOAR 6.15 disk space by archiving unused incident, entry, and indicator data. * [Archive Artifacts and Attachments](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.15/customize-cortex-xsoar/customize-and-configure-cortex-xsoar/manage-data/archive-artifacts-and-attachments.md): Archive Cortex XSOAR 6.15 artifacts and attachment folders to reduce storage use. * [Store Incident/Artifact Files in the Cloud](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.15/customize-cortex-xsoar/customize-and-configure-cortex-xsoar/manage-data/store-incidentartifact-files-in-the-cloud.md): Store Cortex XSOAR 6.15 incident attachments, artifacts, and War Room files in cloud storage. * [Migrate Data to Another Server](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.15/customize-cortex-xsoar/customize-and-configure-cortex-xsoar/manage-data/migrate-data-to-another-server.md): Migrate Cortex XSOAR 6.15 data, files, and directories to another server. * [Migrate Data to Another Server for Multi-Tenant](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.15/customize-cortex-xsoar/customize-and-configure-cortex-xsoar/manage-data/migrate-data-to-another-server-for-multi-tenant.md): Migrate Cortex XSOAR 6.15 data to another server in a multi-tenant environment. * [Move Data Folders to Another Location on the Server](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.15/customize-cortex-xsoar/customize-and-configure-cortex-xsoar/manage-data/move-data-folders-to-another-location-on-the-server.md): Move Cortex XSOAR 6.15 data folders to a different server location for storage management. * [Restore an Archived Folder](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.15/customize-cortex-xsoar/customize-and-configure-cortex-xsoar/manage-data/restore-an-archived-folder.md): Restore an archived Cortex XSOAR 6.15 data folder when access to archived data is required. * [Logs](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.15/customize-cortex-xsoar/customize-and-configure-cortex-xsoar/logs.md): Configure Cortex XSOAR 6.15 server logs, access logs, audit trails, and diagnostic log bundles. * [Logs Overview](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.15/customize-cortex-xsoar/customize-and-configure-cortex-xsoar/logs/logs-overview.md): Understand Cortex XSOAR 6.15 logs and use log data for system monitoring and troubleshooting. * [Configure the Server Log](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.15/customize-cortex-xsoar/customize-and-configure-cortex-xsoar/logs/configure-the-server-log.md): Configure Cortex XSOAR 6.15 server log levels, file sizes, backups, and retention periods. * [Configure the Access Log for HTTPS Requests](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.15/customize-cortex-xsoar/customize-and-configure-cortex-xsoar/logs/configure-the-access-log-for-https-requests.md): Configure Cortex XSOAR 6.15 access logs to view HTTP and HTTPS requests. * [Create a Log Bundle](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.15/customize-cortex-xsoar/customize-and-configure-cortex-xsoar/logs/create-a-log-bundle.md): Create a Cortex XSOAR 6.15 diagnostic log bundle for troubleshooting and support investigations. * [Audit Trail](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.15/customize-cortex-xsoar/customize-and-configure-cortex-xsoar/logs/audit-trail.md): View, export, extract, and purge Cortex XSOAR 6.15 audit trail records for administrative user actions. * [Send the Audit Trail to an External Log Service](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.15/customize-cortex-xsoar/customize-and-configure-cortex-xsoar/logs/send-the-audit-trail-to-an-external-log-service.md): Send Cortex XSOAR 6.15 audit trail records to an external log service using server configurations. * [System Settings](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.15/customize-cortex-xsoar/customize-and-configure-cortex-xsoar/system-settings.md): Configure Cortex XSOAR 6.15 branding, login messages, system emails, and notification delivery settings. * [Customize the Logo](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.15/customize-cortex-xsoar/customize-and-configure-cortex-xsoar/system-settings/customize-the-logo.md): Customize full-size and minimized logos in Cortex XSOAR 6.15. * [Customize the Login Message](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.15/customize-cortex-xsoar/customize-and-configure-cortex-xsoar/system-settings/customize-the-login-message.md): Customize the login page message displayed to Cortex XSOAR 6.15 users before authentication. * [Customize System Emails](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.15/customize-cortex-xsoar/customize-and-configure-cortex-xsoar/system-settings/customize-system-emails.md): Customize Cortex XSOAR 6.15 system email subjects and message bodies in HTML or plain-text formats. * [Configure System Notifications](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.15/customize-cortex-xsoar/customize-and-configure-cortex-xsoar/system-settings/configure-system-notifications.md): Configure Cortex XSOAR 6.15 email notifications and mail sender settings with server configurations. * [Day to Day Tasks in Cortex XSOAR](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.15/investigate-and-respond-to-threats/day-to-day-tasks-in-cortex-xsoar.md): Manage daily Cortex XSOAR 6.15 incidents and threat indicators with investigation and response workflows. * [Incident Management](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.15/investigate-and-respond-to-threats/day-to-day-tasks-in-cortex-xsoar/incident-management.md): Open, investigate, manage, and resolve security incidents in Cortex XSOAR 6.15. * [Create an Incident](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.15/investigate-and-respond-to-threats/day-to-day-tasks-in-cortex-xsoar/incident-management/create-an-incident.md): Create Cortex XSOAR 6.15 incidents manually, from feeds, or by importing JSON files. * [Create a Search Query for Incidents](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.15/investigate-and-respond-to-threats/day-to-day-tasks-in-cortex-xsoar/incident-management/create-a-search-query-for-incidents.md): Create and save Cortex XSOAR 6.15 incident search queries to filter displayed results. * [Create a Widget From an Incident](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.15/investigate-and-respond-to-threats/day-to-day-tasks-in-cortex-xsoar/incident-management/create-a-widget-from-an-incident.md): Create custom Cortex XSOAR 6.15 widgets from incident search results. * [Export an Incident to CSV Using the UTF8-BOM Format](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.15/investigate-and-respond-to-threats/day-to-day-tasks-in-cortex-xsoar/incident-management/export-an-incident-to-csv-using-the-utf8-bom-format.md): Export Cortex XSOAR 6.15 incidents to UTF-8 BOM CSV files for Cyrillic characters. * [Incident Investigation](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.15/investigate-and-respond-to-threats/day-to-day-tasks-in-cortex-xsoar/incident-management/incident-investigation.md): Open Cortex XSOAR 6.15 incidents to review details and investigate security events. * [Work Plan](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.15/investigate-and-respond-to-threats/day-to-day-tasks-in-cortex-xsoar/incident-management/work-plan.md): Monitor and manage Cortex XSOAR 6.15 incident playbook workflows in the Work Plan. * [Investigate an Incident Using the Canvas](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.15/investigate-and-respond-to-threats/day-to-day-tasks-in-cortex-xsoar/incident-management/investigate-an-incident-using-the-canvas.md): Visually map and investigate Cortex XSOAR 6.15 incident relationships with the investigation canvas. * [Auto Populate the Canvas](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.15/investigate-and-respond-to-threats/day-to-day-tasks-in-cortex-xsoar/incident-management/investigate-an-incident-using-the-canvas/auto-populate-the-canvas.md): Automatically add related Cortex XSOAR 6.15 incidents and entities to an investigation canvas. * [Dbot Suggestions: Quick View Window](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.15/investigate-and-respond-to-threats/day-to-day-tasks-in-cortex-xsoar/incident-management/investigate-an-incident-using-the-canvas/dbot-suggestions-quick-view-window.md): Review DBot incident and indicator suggestions in the Cortex XSOAR 6.15 canvas quick view. * [Edit Dbot Incident and Indicator Suggestions](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.15/investigate-and-respond-to-threats/day-to-day-tasks-in-cortex-xsoar/incident-management/investigate-an-incident-using-the-canvas/edit-dbot-incident-and-indicator-suggestions.md): Configure DBot incident and indicator suggestions for Cortex XSOAR 6.15 investigations. * [Incident Actions](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.15/investigate-and-respond-to-threats/day-to-day-tasks-in-cortex-xsoar/incident-management/incident-actions.md): Perform Cortex XSOAR 6.15 incident actions, including tasks, notes, reports, editing, and deletion. * [Evidence Handling](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.15/investigate-and-respond-to-threats/day-to-day-tasks-in-cortex-xsoar/incident-management/evidence-handling.md): Add and manage investigation evidence in the Cortex XSOAR 6.15 War Room. * [Incident Tasks](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.15/investigate-and-respond-to-threats/day-to-day-tasks-in-cortex-xsoar/incident-management/incident-tasks.md): Create and complete Cortex XSOAR 6.15 playbook and to-do tasks during investigations. * [Link Incidents](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.15/investigate-and-respond-to-threats/day-to-day-tasks-in-cortex-xsoar/incident-management/link-incidents.md): Link related Cortex XSOAR 6.15 incidents from the interface, pre-process rules, or CLI. * [Manage Related Incidents](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.15/investigate-and-respond-to-threats/day-to-day-tasks-in-cortex-xsoar/incident-management/link-incidents/manage-related-incidents.md): View and manage related incidents during Cortex XSOAR 6.15 investigations. * [Link and Unlink incidents in the CLI](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.15/investigate-and-respond-to-threats/day-to-day-tasks-in-cortex-xsoar/incident-management/link-incidents/link-and-unlink-incidents-in-the-cli.md): Link and unlink related Cortex XSOAR 6.15 incidents using the command-line interface. * [Configure Incident Fields for Related Incidents](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.15/investigate-and-respond-to-threats/day-to-day-tasks-in-cortex-xsoar/incident-management/configure-incident-fields-for-related-incidents.md): Configure related Cortex XSOAR 6.15 incident fields using allow and ignore list settings. * [Indicator Management](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.15/investigate-and-respond-to-threats/day-to-day-tasks-in-cortex-xsoar/indicator-management.md): Create, search, edit, export, and manage threat indicators in Cortex XSOAR 6.15. * [Configure the Indicator Timeline](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.15/investigate-and-respond-to-threats/day-to-day-tasks-in-cortex-xsoar/indicator-management/configure-the-indicator-timeline.md): Configure the Cortex XSOAR 6.15 indicator timeline and improve timeline performance. * [Exclusion List](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.15/investigate-and-respond-to-threats/day-to-day-tasks-in-cortex-xsoar/indicator-management/exclusion-list.md): Add threat indicators to Cortex XSOAR 6.15 exclusion lists to prevent system processing. * [Export Indicators](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.15/investigate-and-respond-to-threats/day-to-day-tasks-in-cortex-xsoar/indicator-management/export-indicators.md): Export Cortex XSOAR 6.15 threat indicators as lists or files for security tools. * [Manually Export Indicators](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.15/investigate-and-respond-to-threats/day-to-day-tasks-in-cortex-xsoar/indicator-management/export-indicators/manually-export-indicators.md): Manually export Cortex XSOAR 6.15 threat indicators for external security tools. * [Export Indicators Integrations](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.15/investigate-and-respond-to-threats/day-to-day-tasks-in-cortex-xsoar/indicator-management/export-indicators/export-indicators-integrations.md): Export Cortex XSOAR 6.15 threat indicators through supported integrations. * [Export an Indicator to CSV Using the UTF8-BOM Format](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.15/investigate-and-respond-to-threats/day-to-day-tasks-in-cortex-xsoar/indicator-management/export-indicators/export-an-indicator-to-csv-using-the-utf8-bom-format.md): Export Cortex XSOAR 6.15 threat indicators to UTF-8 BOM CSV files. * [Reference](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.15/reference-docs/reference.md): Find Cortex XSOAR 6.15 reference information for configuration, diagnostics, security, and operations. * [Navigation Cheat Sheet](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.15/reference-docs/reference/navigation-cheat-sheet.md): Use the Cortex XSOAR 6.15 navigation cheat sheet to access common features quickly. * [Server Configurations](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.15/reference-docs/reference/server-configurations.md): Reference Cortex XSOAR 6.15 server configurations for customization, administration, and troubleshooting. * [Modify Server Configurations](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.15/reference-docs/reference/server-configurations/modify-server-configurations.md): Modify Cortex XSOAR 6.15 server configurations for customization and troubleshooting. * [Active Directory Server Configurations](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.15/reference-docs/reference/server-configurations/active-directory-server-configurations.md): Reference Cortex XSOAR 6.15 server configurations for Active Directory authentication. * [Automation Server Configurations](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.15/reference-docs/reference/server-configurations/automation-server-configurations.md): Reference Cortex XSOAR 6.15 server configurations for automation behavior. * [Dashboard Server Configurations](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.15/reference-docs/reference/server-configurations/dashboard-server-configurations.md): Reference Cortex XSOAR 6.15 server configurations for dashboards. * [Database Server Configurations](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.15/reference-docs/reference/server-configurations/database-server-configurations.md): Server configurations for the database in Cortex XSOAR 6.15. * [Disaster Recovery Server Configurations](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.15/reference-docs/reference/server-configurations/disaster-recovery-server-configurations.md): Reference Cortex XSOAR 6.15 server configurations for disaster recovery. * [Docker Server Configurations](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.15/reference-docs/reference/server-configurations/docker-server-configurations.md): Reference Cortex XSOAR 6.15 server configurations for Docker. * [Elasticsearch Server Configurations](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.15/reference-docs/reference/server-configurations/elasticsearch-server-configurations.md): Reference Cortex XSOAR 6.15 server configurations for Elasticsearch. * [Engine Server Configurations](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.15/reference-docs/reference/server-configurations/engine-server-configurations.md): Reference Cortex XSOAR 6.15 server configurations for engines. * [General Server Configurations](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.15/reference-docs/reference/server-configurations/general-server-configurations.md): Reference general Cortex XSOAR 6.15 server configuration settings. * [Google API Server Configuration](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.15/reference-docs/reference/server-configurations/google-api-server-configuration.md): Reference Cortex XSOAR 6.15 server configuration settings for Google APIs. * [Incident Server Configurations](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.15/reference-docs/reference/server-configurations/incident-server-configurations.md): Reference Cortex XSOAR 6.15 server configurations for incident management. * [Indicator Server Configurations](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.15/reference-docs/reference/server-configurations/indicator-server-configurations.md): Server configurations for indicators in Cortex XSOAR 6.15. * [Integration Server Configurations](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.15/reference-docs/reference/server-configurations/integration-server-configurations.md): Server configurations for integrations in Cortex XSOAR 6.15. * [List Server Configurations](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.15/reference-docs/reference/server-configurations/list-server-configurations.md): Reference Cortex XSOAR 6.15 server configurations for lists. * [Logs Server Configurations](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.15/reference-docs/reference/server-configurations/logs-server-configurations.md): Server configurations for logs in Cortex XSOAR 6.15. * [Marketplace Server Configurations](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.15/reference-docs/reference/server-configurations/marketplace-server-configurations.md): Reference Cortex XSOAR 6.15 server configurations for Marketplace. * [Multi-Tenant Server Configurations](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.15/reference-docs/reference/server-configurations/multi-tenant-server-configurations.md): Server configurations for multi-tenant deployments in Cortex XSOAR 6.15. * [Notification Server Configurations](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.15/reference-docs/reference/server-configurations/notification-server-configurations.md): Reference Cortex XSOAR 6.15 server configurations for notifications. * [Playbook Server Configurations](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.15/reference-docs/reference/server-configurations/playbook-server-configurations.md): Server configurations for playbooks in Cortex XSOAR 6.15. * [Proxy Server Configurations](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.15/reference-docs/reference/server-configurations/proxy-server-configurations.md): Reference Cortex XSOAR 6.15 server configurations for proxy servers. * [Remote Repository Server Configurations](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.15/reference-docs/reference/server-configurations/remote-repository-server-configurations.md): Server configurations for remote repositories in Cortex XSOAR 6.15. * [Report Server Configurations](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.15/reference-docs/reference/server-configurations/report-server-configurations.md): Reference Cortex XSOAR 6.15 server configurations for reports. * [Security Headers Server Configurations](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.15/reference-docs/reference/server-configurations/security-headers-server-configurations.md): Reference Cortex XSOAR 6.15 server configurations for security headers. * [SLA Server Configuration](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.15/reference-docs/reference/server-configurations/sla-server-configuration.md): Server configuration for SLAs in Cortex XSOAR 6.15. * [System Diagnostics Server Configurations](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.15/reference-docs/reference/server-configurations/system-diagnostics-server-configurations.md): Reference Cortex XSOAR 6.15 server configurations for system diagnostics. * [Users and Roles Server Configurations](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.15/reference-docs/reference/server-configurations/users-and-roles-server-configurations.md): Reference Cortex XSOAR 6.15 server configurations for users and roles. * [War Room Server Configurations](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.15/reference-docs/reference/server-configurations/war-room-server-configurations.md): Server configurations for the War Room in Cortex XSOAR 6.15. * [Widget Server Configurations](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.15/reference-docs/reference/server-configurations/widget-server-configurations.md): Server configurations for widgets in Cortex XSOAR 6.15. * [System Diagnostics](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.15/reference-docs/reference/system-diagnostics.md): Monitor Cortex XSOAR 6.15 system health and resolve performance and diagnostic alerts. * [Fix System Diagnostics Issues](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.15/reference-docs/reference/system-diagnostics/fix-system-diagnostics-issues.md): Resolve Cortex XSOAR 6.15 alerts reported on the System Diagnostics page. * [Performance Tuning for Cortex XSOAR](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.15/reference-docs/reference/performance-tuning-for-cortex-xsoar.md): Tune Cortex XSOAR 6.15 performance for reliable and scalable security operations. * [Supported Ciphers](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.15/reference-docs/reference/supported-ciphers.md): Review TLS 1.2 and TLS 1.3 cipher suites supported by Cortex XSOAR 6.15 servers and engines. * [Telemetry](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.15/reference-docs/reference/telemetry.md): Configure Cortex XSOAR 6.15 telemetry collection and control product usage data sharing. * [Keyboard Shortcuts](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.15/reference-docs/reference/keyboard-shortcuts.md): Use Cortex XSOAR 6.15 keyboard shortcuts for playbooks, scripts, the CLI, and incident pages. * [Indicator Fields Structure](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.15/reference-docs/reference/indicator-fields-structure.md): Reference Cortex XSOAR 6.15 indicator field structures aligned with STIX standards. - [Navigate the Cortex XSOAR 6.14 Administrator Guide](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.14/learn-about-cortex-xsoar/readme.md): Start here for a visual overview of the main Cortex XSOAR 6.14 documentation areas. - [Overview](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.14/learn-about-cortex-xsoar/overview.md): Cortex XSOAR provides security orchestration, incident management, and interactive investigation. Overview of Cortex XSOAR 6.14 features and concepts. - [Get Started in Cortex XSOAR](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.14/learn-about-cortex-xsoar/get-started-in-cortex-xsoar.md): Get started with Cortex XSOAR 6.14. Learn core concepts, licenses, lifecycle support, API keys, search, CLI commands, and Markdown. - [Licenses](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.14/learn-about-cortex-xsoar/get-started-in-cortex-xsoar/licenses.md): Learn about Cortex XSOAR 6.14 licenses, editions, user types, license quotas, and multi-tenant licensing. - [FIPS Version](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.14/learn-about-cortex-xsoar/get-started-in-cortex-xsoar/fips-version.md): Learn about the vendor-affirmed Cortex XSOAR 6.14 FIPS version, its FIPS 140-3 cryptography, supported deployments, and limitations. - [Concepts](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.14/learn-about-cortex-xsoar/get-started-in-cortex-xsoar/concepts.md): Learn Cortex XSOAR 6.14 concepts, including incidents, integrations, playbooks, automations, commands, War Room, indicators, and Playground. - [Product Support Lifecycle](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.14/learn-about-cortex-xsoar/get-started-in-cortex-xsoar/product-support-lifecycle.md): Review Cortex XSOAR 6.14 release versioning, supported releases, end-of-life dates, and product support lifecycle guidance. - [API Keys](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.14/learn-about-cortex-xsoar/get-started-in-cortex-xsoar/api-keys.md): Generate, manage, revoke, and secure API keys for Cortex XSOAR 6.14 REST API access. - [Use the Command Line Interface](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.14/learn-about-cortex-xsoar/get-started-in-cortex-xsoar/use-the-command-line-interface.md): Use the Cortex XSOAR 6.14 CLI to run system and integration commands, automations, scripts, and user notifications. - [How to Search](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.14/learn-about-cortex-xsoar/get-started-in-cortex-xsoar/how-to-search.md): Search Cortex XSOAR 6.14 with Bleve query syntax, the search box, general search, filters, wildcards, and regular expressions. - [How to Use Markdown](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.14/learn-about-cortex-xsoar/get-started-in-cortex-xsoar/how-to-use-markdown.md): Use Markdown in Cortex XSOAR 6.14 to format text, add links, tables, images, and XSOAR-specific content elements. - [New User FAQ](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.14/learn-about-cortex-xsoar/get-started-in-cortex-xsoar/new-user-faq.md): Find answers to common Cortex XSOAR 6.14 new-user questions about content, log bundles, commands, notifications, dashboards, and search. - [Onboarding in Cortex XSOAR](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.14/onboard-cortex-xsoar/onboarding-in-cortex-xsoar.md): Onboarding process for Cortex XSOAR 6.14. - [Deployment Checklist - Best Practices](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.14/onboard-cortex-xsoar/deployment-checklist-best-practices.md): Overview of the deployment process, including best practices for Cortex XSOAR 6.14 installation and maintenance. - [Single Server Deployment](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.14/onboard-cortex-xsoar/single-server-deployment.md): Install, configure, upgrade, and maintain a Cortex XSOAR 6.14 single-server deployment. - [System Requirements](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.14/onboard-cortex-xsoar/single-server-deployment/system-requirements.md): Verify operating system, hardware, network, and software requirements for a Cortex XSOAR 6.14 single-server deployment. - [Deployment Guidelines](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.14/onboard-cortex-xsoar/single-server-deployment/deployment-guidelines.md): Review Cortex XSOAR 6.14 single-server deployment guidelines for AWS EC2, Microsoft Azure, and Google Cloud Platform. - [Install the Server for a Single Server Deployment](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.14/onboard-cortex-xsoar/single-server-deployment/install-the-server-for-a-single-server-deployment.md): Install Cortex XSOAR 6.14 on a single server with the application and database services on one host. - [Installer Flags](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.14/onboard-cortex-xsoar/single-server-deployment/install-the-server-for-a-single-server-deployment/installer-flags.md): Reference the Cortex XSOAR 6.14 installer flags for installation, upgrades, Elasticsearch, backups, and system configuration. - [Install the Server with Elasticsearch](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.14/onboard-cortex-xsoar/single-server-deployment/install-the-server-with-elasticsearch.md): Install Cortex XSOAR 6.14 with Elasticsearch. Review prerequisites and deployment steps for a new Elasticsearch-backed environment. - [Install the Server Offline](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.14/onboard-cortex-xsoar/single-server-deployment/install-the-server-offline.md): Install Cortex XSOAR 6.14 in an offline or air-gapped environment without internet access. - [Dependencies for Offline Installation](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.14/onboard-cortex-xsoar/single-server-deployment/install-the-server-offline/dependencies-for-offline-installation.md): Review required RPM and Ubuntu dependencies for an offline Cortex XSOAR 6.14 server or engine installation. - [Add a License](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.14/onboard-cortex-xsoar/single-server-deployment/add-a-license.md): Add a Cortex XSOAR 6.14 license file through the user interface or directly on the server. - [Post-Installation Checklist](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.14/onboard-cortex-xsoar/single-server-deployment/post-installation-checklist.md): Complete the Cortex XSOAR 6.14 post-installation checklist for monitoring, certificates, HTTP configuration, and troubleshooting. - [Monitor Components](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.14/onboard-cortex-xsoar/single-server-deployment/post-installation-checklist/monitor-components.md): Monitor Cortex XSOAR 6.14 server, engine, and Elasticsearch health with system checks, alerts, and health monitoring tools. - [HTTPS with a Signed Certificate](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.14/onboard-cortex-xsoar/single-server-deployment/post-installation-checklist/https-with-a-signed-certificate.md): Configure HTTPS for Cortex XSOAR 6.14 with a signed X.509 certificate and supported TLS versions. - [Create a Self-Signed Certificate](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.14/onboard-cortex-xsoar/single-server-deployment/post-installation-checklist/create-a-self-signed-certificate.md): Create and apply a self-signed certificate for a Cortex XSOAR 6.14 development environment. - [Install or Renew a Custom Certificate](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.14/onboard-cortex-xsoar/single-server-deployment/post-installation-checklist/install-or-renew-a-custom-certificate.md): Install or renew a CA-signed certificate for secure Cortex XSOAR 6.14 production deployments. - [Configure the Server to Listen on HTTP](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.14/onboard-cortex-xsoar/single-server-deployment/post-installation-checklist/configure-the-server-to-listen-on-http.md): Configure a Cortex XSOAR 6.14 server HTTP endpoint for deployments using HTTPS termination. - [Troubleshoot WebSockets](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.14/onboard-cortex-xsoar/single-server-deployment/post-installation-checklist/troubleshoot-websockets.md): Troubleshoot Cortex XSOAR 6.14 WebSocket disconnects, slow responses, and missing real-time browser updates. - [Upgrade the Cortex XSOAR Server](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.14/onboard-cortex-xsoar/single-server-deployment/upgrade-the-cortex-xsoar-server.md): Upgrade a Cortex XSOAR 6.14 server with preparation, installation, and post-upgrade validation steps. - [Uninstall the Server](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.14/onboard-cortex-xsoar/single-server-deployment/uninstall-the-server.md): Uninstall a Cortex XSOAR 6.14 server while retaining configuration files and engine-created files. - [Elasticsearch](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.14/onboard-cortex-xsoar/elasticsearch.md): Deploy and manage Cortex XSOAR 6.14 with Elasticsearch, including setup, security, migration, backups, and troubleshooting. - [Elasticsearch Overview](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.14/onboard-cortex-xsoar/elasticsearch/elasticsearch-overview.md): Understand Cortex XSOAR 6.14 Elasticsearch deployments and how XSOAR data is migrated to Elasticsearch indices. - [Elasticsearch Setup](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.14/onboard-cortex-xsoar/elasticsearch/elasticsearch-setup.md): Configure Elasticsearch for Cortex XSOAR 6.14 with best practices, sizing guidance, and data management settings. - [Elasticsearch System Requirements](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.14/onboard-cortex-xsoar/elasticsearch/elasticsearch-setup/elasticsearch-system-requirements.md): Review Elasticsearch system requirements for a supported and scalable Cortex XSOAR 6.14 deployment. - [Elasticsearch Configurations](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.14/onboard-cortex-xsoar/elasticsearch/elasticsearch-setup/elasticsearch-configurations.md): Configure Elasticsearch connection, indexing, shards, replicas, and performance settings for Cortex XSOAR 6.14. - [Elasticsearch Data Management](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.14/onboard-cortex-xsoar/elasticsearch/elasticsearch-setup/elasticsearch-data-management.md): Manage Cortex XSOAR 6.14 data in Elasticsearch, including index operations, data retention, and storage considerations. - [Elasticsearch Security](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.14/onboard-cortex-xsoar/elasticsearch/elasticsearch-security.md): Apply Elasticsearch security guidance and best practices to Cortex XSOAR 6.14 single-server and multi-tenant deployments. - [Elasticsearch General Security Guidelines](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.14/onboard-cortex-xsoar/elasticsearch/elasticsearch-security/elasticsearch-general-security-guidelines.md): Follow general Elasticsearch security guidelines for protecting a Cortex XSOAR 6.14 deployment. - [Elasticsearch Security Guidelines - Multi-tenant Deployments](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.14/onboard-cortex-xsoar/elasticsearch/elasticsearch-security/elasticsearch-security-guidelines-multi-tenant-deployments.md): Apply Elasticsearch security guidelines for Cortex XSOAR 6.14 multi-tenant deployments and tenant data isolation. - [Migration](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.14/onboard-cortex-xsoar/elasticsearch/migration.md): Migrate Cortex XSOAR 6.14 data to Elasticsearch for single-server and multi-tenant environments. - [Elasticsearch Migration Overview](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.14/onboard-cortex-xsoar/elasticsearch/migration/elasticsearch-migration-overview.md): Understand the Cortex XSOAR 6.14 Elasticsearch migration process, prerequisites, sequencing, and migration tool options. - [Migrate Objects to Elasticsearch for a Single Server](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.14/onboard-cortex-xsoar/elasticsearch/migration/migrate-objects-to-elasticsearch-for-a-single-server.md): Migrate Cortex XSOAR 6.14 objects and data to Elasticsearch in a single-server deployment. - [Migrate Objects to Elasticsearch for Multi-Tenant](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.14/onboard-cortex-xsoar/elasticsearch/migration/migrate-objects-to-elasticsearch-for-multi-tenant.md): Migrate Cortex XSOAR 6.14 objects and tenant data to Elasticsearch in a multi-tenant deployment. - [Migrate an Existing Elasticsearch Deployment](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.14/onboard-cortex-xsoar/elasticsearch/migration/migrate-an-existing-elasticsearch-deployment.md): Migrate an existing Cortex XSOAR 6.14 Elasticsearch deployment while preserving data and configuration. - [Migrate Objects to Elasticsearch for a Distributed Database](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.14/onboard-cortex-xsoar/elasticsearch/migration/migrate-objects-to-elasticsearch-for-a-distributed-database.md): Migrate Cortex XSOAR 6.14 objects to Elasticsearch from a distributed database deployment. - [Manage Partial Migration to Elasticsearch](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.14/onboard-cortex-xsoar/elasticsearch/migration/manage-partial-migration-to-elasticsearch.md): Manage a partial Cortex XSOAR 6.14 migration to Elasticsearch and complete the remaining data migration. - [Validate the Migration to Elasticsearch](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.14/onboard-cortex-xsoar/elasticsearch/migration/validate-the-migration-to-elasticsearch.md): Validate a Cortex XSOAR 6.14 migration to Elasticsearch and identify incomplete or failed migrated objects. - [Elasticsearch Post Migration Health Check](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.14/onboard-cortex-xsoar/elasticsearch/migration/elasticsearch-post-migration-health-check.md): Run post-migration health checks to confirm a Cortex XSOAR 6.14 Elasticsearch deployment is operating correctly. - [Disaster Recovery for Elasticsearch](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.14/onboard-cortex-xsoar/elasticsearch/disaster-recovery-for-elasticsearch.md): Back up and restore a Cortex XSOAR 6.14 Elasticsearch deployment using snapshots for disaster recovery. - [Create Elasticsearch Snapshots](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.14/onboard-cortex-xsoar/elasticsearch/disaster-recovery-for-elasticsearch/create-elasticsearch-snapshots.md): Create Elasticsearch snapshots to back up Cortex XSOAR 6.14 data and prepare for disaster recovery. - [Restore Elasticsearch Snapshots](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.14/onboard-cortex-xsoar/elasticsearch/disaster-recovery-for-elasticsearch/restore-elasticsearch-snapshots.md): Restore Elasticsearch snapshots to recover Cortex XSOAR 6.14 data after data loss or an outage. - [Archive Data with Elasticsearch](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.14/onboard-cortex-xsoar/elasticsearch/archive-data-with-elasticsearch.md): Archive Cortex XSOAR 6.14 data with Elasticsearch index lifecycle management to manage storage and data retention. - [Troubleshoot Elasticsearch](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.14/onboard-cortex-xsoar/elasticsearch/troubleshoot-elasticsearch.md): Troubleshoot common Cortex XSOAR 6.14 Elasticsearch deployment, connectivity, indexing, and performance issues. - [Docker](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.14/onboard-cortex-xsoar/docker.md): Install, configure, secure, and troubleshoot Docker for Cortex XSOAR 6.14. - [Docker Overview](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.14/onboard-cortex-xsoar/docker/docker-overview.md): Understand how Cortex XSOAR 6.14 uses Docker to run integrations and automations securely and predictably. - [Docker Installation](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.14/onboard-cortex-xsoar/docker/docker-installation.md): Install and troubleshoot Docker on supported Enterprise Linux platforms for Cortex XSOAR 6.14. - [Configure Python Docker Integrations to Trust Custom Certificates](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.14/onboard-cortex-xsoar/docker/configure-python-docker-integrations-to-trust-custom-certificates.md): Configure Cortex XSOAR 6.14 Python Docker integrations to trust CA-signed and custom certificates. - [Docker Images in Cortex XSOAR](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.14/onboard-cortex-xsoar/docker/docker-images-in-cortex-xsoar.md): Use Docker images to run Cortex XSOAR 6.14 Python scripts and integrations in controlled environments. - [Create a Docker Image In Cortex XSOAR](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.14/onboard-cortex-xsoar/docker/docker-images-in-cortex-xsoar/create-a-docker-image-in-cortex-xsoar.md): Create a custom Docker image for Cortex XSOAR 6.14 integrations and automations. - [Install Docker Images Offline](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.14/onboard-cortex-xsoar/docker/docker-images-in-cortex-xsoar/install-docker-images-offline.md): Download and install Docker images offline for air-gapped Cortex XSOAR 6.14 environments. - [Docker Image Security](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.14/onboard-cortex-xsoar/docker/docker-images-in-cortex-xsoar/docker-image-security.md): Apply Docker image security practices for Cortex XSOAR 6.14 integrations and automations. - [Manage Docker Images](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.14/onboard-cortex-xsoar/docker/docker-images-in-cortex-xsoar/manage-docker-images.md): Manage, update, and remove Docker images used by Cortex XSOAR 6.14 integrations and automations. - [Change the Docker Image for Automations and Integrations](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.14/onboard-cortex-xsoar/docker/docker-images-in-cortex-xsoar/change-the-docker-image-for-automations-and-integrations.md): Change the Docker image used by Cortex XSOAR 6.14 automations and integrations. - [Use the Cortex XSOAR Container Registry](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.14/onboard-cortex-xsoar/docker/docker-images-in-cortex-xsoar/use-the-cortex-xsoar-container-registry.md): Use the Cortex XSOAR 6.14 container registry to manage and distribute Docker images. - [Docker Hardening Guide](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.14/onboard-cortex-xsoar/docker/docker-hardening-guide.md): Harden Docker containers in Cortex XSOAR 6.14 with least privilege, resource limits, and network security controls. - [Run Docker with Non-Root Internal Users](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.14/onboard-cortex-xsoar/docker/docker-hardening-guide/run-docker-with-non-root-internal-users.md): Run Cortex XSOAR 6.14 Docker containers with non-root internal users to enforce least privilege. - [Configure Memory Limit Support Without Swap Limit Capabilities](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.14/onboard-cortex-xsoar/docker/docker-hardening-guide/configure-memory-limit-support-without-swap-limit-capabilities.md): Configure Docker memory limits for Cortex XSOAR 6.14 when swap limit capabilities are unavailable. - [Configure the Memory Limitation](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.14/onboard-cortex-xsoar/docker/docker-hardening-guide/configure-the-memory-limitation.md): Configure Docker container memory limits to protect Cortex XSOAR 6.14 hosts from resource exhaustion. - [Test the Memory Limit](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.14/onboard-cortex-xsoar/docker/docker-hardening-guide/test-the-memory-limit.md): Test Docker memory limits configured for Cortex XSOAR 6.14 containers. - [Limit Available CPU](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.14/onboard-cortex-xsoar/docker/docker-hardening-guide/limit-available-cpu.md): Limit Docker container CPU resources to protect the Cortex XSOAR 6.14 host. - [Configure the PIDs Limit](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.14/onboard-cortex-xsoar/docker/docker-hardening-guide/configure-the-pids-limit.md): Configure Docker PID limits to prevent process exhaustion in Cortex XSOAR 6.14 containers. - [Configure the Open File Descriptors Limit](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.14/onboard-cortex-xsoar/docker/docker-hardening-guide/configure-the-open-file-descriptors-limit.md): Configure Docker open file descriptor limits for Cortex XSOAR 6.14 containers. - [Docker Network Hardening](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.14/onboard-cortex-xsoar/docker/docker-hardening-guide/docker-network-hardening.md): Harden Docker network access for Cortex XSOAR 6.14 containers with network security controls. - [Docker FAQs](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.14/onboard-cortex-xsoar/docker/docker-faqs.md): Find answers to frequently asked questions about Docker in Cortex XSOAR 6.14. - [Troubleshoot Docker Networking Issues](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.14/onboard-cortex-xsoar/docker/troubleshoot-docker-networking-issues.md): Troubleshoot Docker networking issues in Cortex XSOAR 6.14. - [Troubleshoot Docker Performance Issues](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.14/onboard-cortex-xsoar/docker/troubleshoot-docker-performance-issues.md): Troubleshoot Cortex XSOAR 6.14 Docker performance issues and update Docker packages and dependencies. - [Configure Docker Pull Rate Limit](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.14/onboard-cortex-xsoar/docker/configure-docker-pull-rate-limit.md): Configure Docker image pull rate limits for Cortex XSOAR 6.14 and authenticate for higher limits. - [Change the Docker Installation Folder](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.14/onboard-cortex-xsoar/docker/change-the-docker-installation-folder.md): Change the default Docker installation folder for Cortex XSOAR 6.14. - [Podman](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.14/onboard-cortex-xsoar/podman.md): Install, configure, migrate to, and troubleshoot Podman for Cortex XSOAR 6.14 on RHEL 8 and later. - [Podman Overview](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.14/onboard-cortex-xsoar/podman/podman-overview.md): Understand how to use Podman instead of Docker for Cortex XSOAR 6.14 on supported operating systems, including RHEL 8. - [Change container storage directory](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.14/onboard-cortex-xsoar/podman/change-container-storage-directory.md): Change the Podman container storage directory for Cortex XSOAR 6.14. - [Podman Installation](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.14/onboard-cortex-xsoar/podman/podman-installation.md): Install Podman for Cortex XSOAR 6.14 on supported Linux operating systems. - [Configure the SELinux Policy for PowerShell Integrations](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.14/onboard-cortex-xsoar/podman/configure-the-selinux-policy-for-powershell-integrations.md): Configure the Podman SELinux policy for PowerShell integrations in Cortex XSOAR 6.14. - [Migrate From Docker to Podman](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.14/onboard-cortex-xsoar/podman/migrate-from-docker-to-podman.md): Migrate Cortex XSOAR 6.14 from Docker to Podman on RHEL 8 or later. - [Troubleshoot Podman](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.14/onboard-cortex-xsoar/podman/troubleshoot-podman.md): Troubleshoot Podman installation, configuration, and container issues in Cortex XSOAR 6.14. - [Proxy](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.14/onboard-cortex-xsoar/proxy.md): Configure proxy, proxy bypass, and NGINX reverse proxy settings for Cortex XSOAR 6.14. - [Configure Proxy Settings](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.14/onboard-cortex-xsoar/proxy/configure-proxy-settings.md): Configure global proxy settings for Cortex XSOAR 6.14 with server configuration options. - [Configure how to bypass proxy settings](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.14/onboard-cortex-xsoar/proxy/configure-how-to-bypass-proxy-settings.md): Configure proxy bypass settings for Cortex XSOAR 6.14 with server configuration options. - [Use NGINX as a Reverse Proxy to the Server](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.14/onboard-cortex-xsoar/proxy/use-nginx-as-a-reverse-proxy-to-the-server.md): Configure NGINX as a reverse proxy for a Cortex XSOAR 6.14 server. - [High Availability](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.14/onboard-cortex-xsoar/high-availability.md): Configure Cortex XSOAR 6.14 high availability with Elasticsearch, including sizing, migration, app servers, engines, and certificates. - [High Availability Overview](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.14/onboard-cortex-xsoar/high-availability/high-availability-overview.md): Understand Cortex XSOAR 6.14 high availability deployment architectures and components. - [Set Up High Availability](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.14/onboard-cortex-xsoar/high-availability/set-up-high-availability.md): Set up high availability for Cortex XSOAR 6.14 with the required deployment steps. - [Sizing Requirements for High Availability Deployments](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.14/onboard-cortex-xsoar/high-availability/sizing-requirements-for-high-availability-deployments.md): Review sizing requirements for a Cortex XSOAR 6.14 high availability deployment. - [Monitor the Health of the App Servers](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.14/onboard-cortex-xsoar/high-availability/monitor-the-health-of-the-app-servers.md): Monitor application server health in a Cortex XSOAR 6.14 high availability environment. - [Migrate a Single Instance for High Availability](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.14/onboard-cortex-xsoar/high-availability/migrate-a-single-instance-for-high-availability.md): Migrate a Cortex XSOAR 6.14 single-instance deployment to high availability. - [Migrate a Multi-Tenant Deployment for High Availability](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.14/onboard-cortex-xsoar/high-availability/migrate-a-multi-tenant-deployment-for-high-availability.md): Migrate a Cortex XSOAR 6.14 multi-tenant deployment to enable high availability. - [Install Additional App Servers](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.14/onboard-cortex-xsoar/high-availability/install-additional-app-servers.md): Install additional application servers for a Cortex XSOAR 6.14 high availability configuration. - [Deploy Engines in a High Availability Environment](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.14/onboard-cortex-xsoar/high-availability/deploy-engines-in-a-high-availability-environment.md): Deploy Cortex XSOAR 6.14 engines in high availability and route engine connections through a load balancer. - [Use a Signed Certificate](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.14/onboard-cortex-xsoar/high-availability/use-a-signed-certificate.md): Use a signed certificate in a Cortex XSOAR 6.14 high availability deployment. - [Disaster Recovery and Live Backup](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.14/onboard-cortex-xsoar/disaster-recovery-and-live-backup.md): Configure Cortex XSOAR 6.14 disaster recovery and live backup, including failover, backups, restores, and troubleshooting. - [Disaster Recovery and Live Backup Overview](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.14/onboard-cortex-xsoar/disaster-recovery-and-live-backup/disaster-recovery-and-live-backup-overview.md): Understand Cortex XSOAR 6.14 live backup, disaster recovery states, environment configuration, and recovery scenarios. - [Host Names, DNS, and Disaster Recovery](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.14/onboard-cortex-xsoar/disaster-recovery-and-live-backup/host-names-dns-and-disaster-recovery.md): Configure host names and DNS for a Cortex XSOAR 6.14 disaster recovery environment. - [Configure the Live Backup Environment](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.14/onboard-cortex-xsoar/disaster-recovery-and-live-backup/configure-the-live-backup-environment.md): Configure Cortex XSOAR 6.14 live backup by mirroring a production server to a standby backup server. - [Configure Live Backup for Multiple SAMLs](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.14/onboard-cortex-xsoar/disaster-recovery-and-live-backup/configure-the-live-backup-environment/configure-live-backup-for-multiple-samls.md): Configure Cortex XSOAR 6.14 live backup for environments that use multiple SAML identity providers. - [DR Scenario: Testing the DR Environment](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.14/onboard-cortex-xsoar/disaster-recovery-and-live-backup/configure-the-live-backup-environment/dr-scenario-testing-the-dr-environment.md): Test a Cortex XSOAR 6.14 disaster recovery environment and restore the original server roles. - [DR Scenario: Unrecoverable Active Server Failure](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.14/onboard-cortex-xsoar/disaster-recovery-and-live-backup/configure-the-live-backup-environment/dr-scenario-unrecoverable-active-server-failure.md): Recover from an unrecoverable active server failure with Cortex XSOAR 6.14 live backup. - [DR Scenario: Unrecoverable Standby Server Failure](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.14/onboard-cortex-xsoar/disaster-recovery-and-live-backup/configure-the-live-backup-environment/dr-scenario-unrecoverable-standby-server-failure.md): Replace an unrecoverable standby server in a Cortex XSOAR 6.14 live backup environment. - [Transition an Active Server to Standby Mode](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.14/onboard-cortex-xsoar/disaster-recovery-and-live-backup/transition-an-active-server-to-standby-mode.md): Transition an active Cortex XSOAR 6.14 server to standby mode for disaster recovery. - [Transition a Standby Server to Active Mode](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.14/onboard-cortex-xsoar/disaster-recovery-and-live-backup/transition-a-standby-server-to-active-mode.md): Transition a standby Cortex XSOAR 6.14 server to active production mode. - [Transition Between DR States Through the Configuration File](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.14/onboard-cortex-xsoar/disaster-recovery-and-live-backup/transition-between-dr-states-through-the-configuration-file.md): Transition Cortex XSOAR 6.14 disaster recovery states with the configuration file during first server startup. - [Upgrade the Live Backup Environment](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.14/onboard-cortex-xsoar/disaster-recovery-and-live-backup/upgrade-the-live-backup-environment.md): Upgrade a Cortex XSOAR 6.14 live backup environment while preserving disaster recovery readiness. - [Engines and Disaster Recovery Troubleshooting](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.14/onboard-cortex-xsoar/disaster-recovery-and-live-backup/engines-and-disaster-recovery-troubleshooting.md): Troubleshoot Cortex XSOAR 6.14 engine failover issues in a disaster recovery environment. - [Back up the Database](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.14/onboard-cortex-xsoar/disaster-recovery-and-live-backup/back-up-the-database.md): Create manual and automated database backups for Cortex XSOAR 6.14 and schedule backup jobs. - [Restore the Database](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.14/onboard-cortex-xsoar/disaster-recovery-and-live-backup/restore-the-database.md): Restore a Cortex XSOAR 6.14 database from a manual or automated backup. - [Restore a Partition](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.14/onboard-cortex-xsoar/disaster-recovery-and-live-backup/restore-a-partition.md): Restore one or more specific Cortex XSOAR 6.14 database partitions from a backup. - [Troubleshoot Live Backup](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.14/onboard-cortex-xsoar/disaster-recovery-and-live-backup/troubleshoot-live-backup.md): Troubleshoot live backup and disaster recovery scenarios in Cortex XSOAR 6.14. - [Users and Roles](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.14/onboard-cortex-xsoar/users-and-roles.md): Manage Cortex XSOAR 6.14 users, roles, permissions, settings, shifts, passwords, and authentication. - [Users and Roles Overview](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.14/onboard-cortex-xsoar/users-and-roles/users-and-roles-overview.md): Manage Cortex XSOAR 6.14 users, roles, invitations, password policies, and user activity. - [Roles in Cortex XSOAR](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.14/onboard-cortex-xsoar/users-and-roles/roles-in-cortex-xsoar.md): Configure Cortex XSOAR 6.14 roles, permissions, access levels, queries, and shifts. - [Pre-set Query per Role](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.14/onboard-cortex-xsoar/users-and-roles/roles-in-cortex-xsoar/pre-set-query-per-role.md): Configure pre-set queries for Cortex XSOAR 6.14 roles. - [Define a Role](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.14/onboard-cortex-xsoar/users-and-roles/roles-in-cortex-xsoar/define-a-role.md): Define a custom role and its permissions in Cortex XSOAR 6.14. - [Role-based Permission Levels](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.14/onboard-cortex-xsoar/users-and-roles/roles-in-cortex-xsoar/role-based-permission-levels.md): Understand role-based permission levels in Cortex XSOAR 6.14. - [Shift Management](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.14/onboard-cortex-xsoar/users-and-roles/roles-in-cortex-xsoar/shift-management.md): Manage user shifts and on-call schedules in Cortex XSOAR 6.14. - [Managing Shifts](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.14/onboard-cortex-xsoar/users-and-roles/roles-in-cortex-xsoar/shift-management/managing-shifts.md): Create and manage shifts for Cortex XSOAR 6.14 users. - [User Management](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.14/onboard-cortex-xsoar/users-and-roles/user-management.md): Invite and manage Cortex XSOAR 6.14 users, roles, passwords, access, and preferences. - [User Invitations](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.14/onboard-cortex-xsoar/users-and-roles/user-management/user-invitations.md): Manage user invitations in Cortex XSOAR 6.14. - [Invite a User](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.14/onboard-cortex-xsoar/users-and-roles/user-management/user-invitations/invite-a-user.md): Invite a user to Cortex XSOAR 6.14 and assign access. - [Set the User as Default Administrator](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.14/onboard-cortex-xsoar/users-and-roles/user-management/user-invitations/set-the-user-as-default-administrator.md): Set a Cortex XSOAR 6.14 user as the default administrator. - [Self-Service Read-Only Users](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.14/onboard-cortex-xsoar/users-and-roles/user-management/self-service-read-only-users.md): Configure self-service read-only users in Cortex XSOAR 6.14. - [Configure the Server for Self-Service Read-Only Users](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.14/onboard-cortex-xsoar/users-and-roles/user-management/self-service-read-only-users/configure-the-server-for-self-service-read-only-users.md): Configure the Cortex XSOAR 6.14 server for self-service read-only users. - [Create the Self-Service Read-Only Users](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.14/onboard-cortex-xsoar/users-and-roles/user-management/self-service-read-only-users/create-the-self-service-read-only-users.md): Create self-service read-only users in Cortex XSOAR 6.14. - [Create the Read-Only Dashboard](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.14/onboard-cortex-xsoar/users-and-roles/user-management/self-service-read-only-users/create-the-read-only-dashboard.md): Create a read-only dashboard for Cortex XSOAR 6.14 users. - [Create the Read-Only Incident Type and Layout](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.14/onboard-cortex-xsoar/users-and-roles/user-management/self-service-read-only-users/create-the-read-only-incident-type-and-layout.md): Create a read-only incident type and layout in Cortex XSOAR 6.14. - [Disable a User](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.14/onboard-cortex-xsoar/users-and-roles/user-management/disable-a-user.md): Disable a Cortex XSOAR 6.14 user account. - [Remove a User](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.14/onboard-cortex-xsoar/users-and-roles/user-management/remove-a-user.md): Remove a user from Cortex XSOAR 6.14. - [Clear Users Data Using the CLI](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.14/onboard-cortex-xsoar/users-and-roles/user-management/clear-users-data-using-the-cli.md): Clear user data with the Cortex XSOAR 6.14 CLI. - [Clear Users Data Using a Playbook](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.14/onboard-cortex-xsoar/users-and-roles/user-management/clear-users-data-using-a-playbook.md): Clear user data with a Cortex XSOAR 6.14 playbook. - [Configure Users Data Using Server Configurations](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.14/onboard-cortex-xsoar/users-and-roles/user-management/configure-users-data-using-server-configurations.md): Configure user data with Cortex XSOAR 6.14 server configurations. - [User Settings and Preferences](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.14/onboard-cortex-xsoar/users-and-roles/user-management/user-settings-and-preferences.md): Manage Cortex XSOAR 6.14 user settings and preferences. - [Configure User Settings](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.14/onboard-cortex-xsoar/users-and-roles/user-management/configure-user-settings.md): Configure user settings in Cortex XSOAR 6.14. - [Manually Refresh the Number of Licenses in Use](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.14/onboard-cortex-xsoar/users-and-roles/user-management/manually-refresh-the-number-of-licenses-in-use.md): Manually refresh the number of Cortex XSOAR 6.14 licenses in use. - [Integration Permissions](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.14/onboard-cortex-xsoar/users-and-roles/integration-permissions.md): Configure integration command permissions with role-based access control in Cortex XSOAR 6.14. - [Password Policy](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.14/onboard-cortex-xsoar/users-and-roles/password-policy.md): Configure password policies and requirements for Cortex XSOAR 6.14 users. - [Create a Password Policy](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.14/onboard-cortex-xsoar/users-and-roles/password-policy/create-a-password-policy.md): Create a password policy for Cortex XSOAR 6.14 users. - [Edit a Default Password Policy](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.14/onboard-cortex-xsoar/users-and-roles/password-policy/edit-a-default-password-policy.md): Edit the default password policy in Cortex XSOAR 6.14. - [Default Password Policy Keys](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.14/onboard-cortex-xsoar/users-and-roles/password-policy/edit-a-default-password-policy/default-password-policy-keys.md): Reference default password policy keys for Cortex XSOAR 6.14. - [Change the Administrator Password](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.14/onboard-cortex-xsoar/users-and-roles/change-the-administrator-password.md): Change the Cortex XSOAR 6.14 administrator password when account access is unavailable. - [Authenticate Users with SAML 2.0](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.14/onboard-cortex-xsoar/users-and-roles/authenticate-users-with-saml-2.0.md): Authenticate Cortex XSOAR 6.14 users with SAML 2.0 identity providers, including Okta, Microsoft Entra ID, ADFS, and Duo. - [Set up Okta as the Identity Provider Using SAML 2.0](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.14/onboard-cortex-xsoar/users-and-roles/authenticate-users-with-saml-2.0/set-up-okta-as-the-identity-provider-using-saml-2.0.md): Set up Okta as a SAML 2.0 identity provider for Cortex XSOAR 6.14. - [Create Okta Groups for Cortex XSOAR Users](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.14/onboard-cortex-xsoar/users-and-roles/authenticate-users-with-saml-2.0/set-up-okta-as-the-identity-provider-using-saml-2.0/create-okta-groups-for-cortex-xsoar-users.md): Create Okta groups for Cortex XSOAR 6.14 users. - [Define the Okta Application to authenticate Cortex XSOAR](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.14/onboard-cortex-xsoar/users-and-roles/authenticate-users-with-saml-2.0/set-up-okta-as-the-identity-provider-using-saml-2.0/define-the-okta-application-to-authenticate-cortex-xsoar.md): Define an Okta application to authenticate Cortex XSOAR 6.14 users. - [SAML Settings for the Okta Application](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.14/onboard-cortex-xsoar/users-and-roles/authenticate-users-with-saml-2.0/set-up-okta-as-the-identity-provider-using-saml-2.0/define-the-okta-application-to-authenticate-cortex-xsoar/saml-settings-for-the-okta-application.md): Configure SAML settings for the Okta application in Cortex XSOAR 6.14. - [Configure the SAML 2.0 Integration for Okta](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.14/onboard-cortex-xsoar/users-and-roles/authenticate-users-with-saml-2.0/set-up-okta-as-the-identity-provider-using-saml-2.0/configure-the-saml-2.0-integration-for-okta.md): Configure the SAML 2.0 integration for Okta in Cortex XSOAR 6.14. - [SAML 2.0 Okta Parameters](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.14/onboard-cortex-xsoar/users-and-roles/authenticate-users-with-saml-2.0/set-up-okta-as-the-identity-provider-using-saml-2.0/configure-the-saml-2.0-integration-for-okta/saml-2.0-okta-parameters.md): Reference SAML 2.0 Okta parameters for Cortex XSOAR 6.14. - [Map Okta Groups to Cortex XSOAR Roles](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.14/onboard-cortex-xsoar/users-and-roles/authenticate-users-with-saml-2.0/set-up-okta-as-the-identity-provider-using-saml-2.0/map-okta-groups-to-cortex-xsoar-roles.md): Map Okta groups to Cortex XSOAR 6.14 roles. - [Set Up Microsoft Entra ID as the Identity Provider Using SAML 2.0](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.14/onboard-cortex-xsoar/users-and-roles/authenticate-users-with-saml-2.0/set-up-microsoft-entra-id-as-the-identity-provider-using-saml-2.0.md): Set up Microsoft Entra ID as a SAML 2.0 identity provider for Cortex XSOAR 6.14. - [Configure Microsoft Entra ID to Authenticate Cortex XSOAR](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.14/onboard-cortex-xsoar/users-and-roles/authenticate-users-with-saml-2.0/set-up-microsoft-entra-id-as-the-identity-provider-using-saml-2.0/configure-microsoft-entra-id-to-authenticate-cortex-xsoar.md): Configure Microsoft Entra ID to authenticate Cortex XSOAR 6.14 users. - [Configure the SAML 2.0 Integration for Microsoft Entra ID](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.14/onboard-cortex-xsoar/users-and-roles/authenticate-users-with-saml-2.0/set-up-microsoft-entra-id-as-the-identity-provider-using-saml-2.0/configure-the-saml-2.0-integration-for-microsoft-entra-id.md): Configure the SAML 2.0 integration for Microsoft Entra ID in Cortex XSOAR 6.14. - [SAML 2.0 Microsoft Entra ID Parameters](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.14/onboard-cortex-xsoar/users-and-roles/authenticate-users-with-saml-2.0/set-up-microsoft-entra-id-as-the-identity-provider-using-saml-2.0/configure-the-saml-2.0-integration-for-microsoft-entra-id/saml-2.0-microsoft-entra-id-parameters.md): Reference SAML 2.0 Microsoft Entra ID parameters for Cortex XSOAR 6.14. - [Set up ADFS as the Identity Provider Using SAML 2.0](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.14/onboard-cortex-xsoar/users-and-roles/authenticate-users-with-saml-2.0/set-up-adfs-as-the-identity-provider-using-saml-2.0.md): Set up ADFS as a SAML 2.0 identity provider for Cortex XSOAR 6.14. - [Create Relying Party Trust in ADFS](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.14/onboard-cortex-xsoar/users-and-roles/authenticate-users-with-saml-2.0/set-up-adfs-as-the-identity-provider-using-saml-2.0/create-relying-party-trust-in-adfs.md): Create an ADFS relying party trust for Cortex XSOAR 6.14. - [Define the Claim Issuance Policy](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.14/onboard-cortex-xsoar/users-and-roles/authenticate-users-with-saml-2.0/set-up-adfs-as-the-identity-provider-using-saml-2.0/define-the-claim-issuance-policy.md): Define the ADFS claim issuance policy for Cortex XSOAR 6.14 authentication. - [Configure the SAML 2.0 Integration for ADFS](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.14/onboard-cortex-xsoar/users-and-roles/authenticate-users-with-saml-2.0/set-up-adfs-as-the-identity-provider-using-saml-2.0/configure-the-saml-2.0-integration-for-adfs.md): Configure the SAML 2.0 integration for ADFS in Cortex XSOAR 6.14. - [SAML 2.0 ADFS Parameters](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.14/onboard-cortex-xsoar/users-and-roles/authenticate-users-with-saml-2.0/set-up-adfs-as-the-identity-provider-using-saml-2.0/configure-the-saml-2.0-integration-for-adfs/saml-2.0-adfs-parameters.md): Reference SAML 2.0 ADFS parameters for Cortex XSOAR 6.14. - [Map ADFS Groups to Cortex XSOAR Roles](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.14/onboard-cortex-xsoar/users-and-roles/authenticate-users-with-saml-2.0/set-up-adfs-as-the-identity-provider-using-saml-2.0/map-adfs-groups-to-cortex-xsoar-roles.md): Map ADFS groups to Cortex XSOAR 6.14 roles. - [Duo for Single Sign-On](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.14/onboard-cortex-xsoar/users-and-roles/authenticate-users-with-saml-2.0/duo-for-single-sign-on.md): Configure Duo single sign-on for Cortex XSOAR 6.14. - [Create Duo Groups for Cortex XSOAR Users](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.14/onboard-cortex-xsoar/users-and-roles/authenticate-users-with-saml-2.0/duo-for-single-sign-on/create-duo-groups-for-cortex-xsoar-users.md): Create Duo groups for Cortex XSOAR 6.14 users. - [Define Duo to authenticate Cortex XSOAR](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.14/onboard-cortex-xsoar/users-and-roles/authenticate-users-with-saml-2.0/duo-for-single-sign-on/define-duo-to-authenticate-cortex-xsoar.md): Define Duo to authenticate Cortex XSOAR 6.14 users. - [Configure the SAML 2.0 Integration for Duo](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.14/onboard-cortex-xsoar/users-and-roles/authenticate-users-with-saml-2.0/duo-for-single-sign-on/configure-the-saml-2.0-integration-for-duo.md): Configure the SAML 2.0 integration for Duo in Cortex XSOAR 6.14. - [Map Duo Groups to Cortex XSOAR Roles](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.14/onboard-cortex-xsoar/users-and-roles/authenticate-users-with-saml-2.0/duo-for-single-sign-on/map-duo-groups-to-cortex-xsoar-roles.md): Map Duo groups to Cortex XSOAR 6.14 roles. - [Change the Default Administrator to a SAML User](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.14/onboard-cortex-xsoar/users-and-roles/authenticate-users-with-saml-2.0/change-the-default-administrator-to-a-saml-user.md): Change the default Cortex XSOAR 6.14 administrator to a SAML user. - [Set Up SAML Logout](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.14/onboard-cortex-xsoar/users-and-roles/authenticate-users-with-saml-2.0/set-up-saml-logout.md) - [Set the Default Theme for New Users](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.14/onboard-cortex-xsoar/users-and-roles/set-the-default-theme-for-new-users.md): Set the default color theme for new Cortex XSOAR 6.14 users with server configuration settings. - [Authenticate Users with Active Directory](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.14/onboard-cortex-xsoar/users-and-roles/authenticate-users-with-active-directory.md): Authenticate Cortex XSOAR 6.14 users with Active Directory credentials. - [Marketplace](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.14/onboard-cortex-xsoar/marketplace.md): Browse Cortex XSOAR 6.14 Marketplace content packs, manage installations, and contribute content. - [Marketplace Overview](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.14/onboard-cortex-xsoar/marketplace/marketplace-overview.md): Use Cortex XSOAR 6.14 Marketplace to discover, install, manage, and contribute content packs. - [Content Packs Support Types](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.14/onboard-cortex-xsoar/marketplace/content-packs-support-types.md): Understand Cortex XSOAR 6.14 content pack support types and ownership levels. - [Marketplace FAQs](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.14/onboard-cortex-xsoar/marketplace/marketplace-faqs.md): Find answers to common Cortex XSOAR 6.14 Marketplace and content pack questions. - [Search and Navigate in the Marketplace](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.14/onboard-cortex-xsoar/marketplace/search-and-navigate-in-the-marketplace.md): Search and browse Cortex XSOAR 6.14 Marketplace content by use case, integration, and category. - [Convert Existing Content to Content Pack Format](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.14/onboard-cortex-xsoar/marketplace/convert-existing-content-to-content-pack-format.md): Convert existing content to Cortex XSOAR 6.14 content pack format. - [Use Cases](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.14/onboard-cortex-xsoar/marketplace/use-cases.md): Explore Cortex XSOAR 6.14 Marketplace content packs by security use case. - [Content Pack Installation](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.14/onboard-cortex-xsoar/marketplace/content-pack-installation.md): Review Cortex XSOAR 6.14 content pack dependencies, installation requirements, errors, and warnings. - [Install a Content Pack](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.14/onboard-cortex-xsoar/marketplace/content-pack-installation/install-a-content-pack.md): Install a Cortex XSOAR 6.14 Marketplace content pack and its required dependencies. - [Set up Your Use Case with the Deployment Wizard](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.14/onboard-cortex-xsoar/marketplace/content-pack-installation/install-a-content-pack/set-up-your-use-case-with-the-deployment-wizard.md): Configure a supported Cortex XSOAR 6.14 content pack with the Deployment Wizard. - [Delete a Content Pack](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.14/onboard-cortex-xsoar/marketplace/content-pack-installation/delete-a-content-pack.md): Delete an installed Cortex XSOAR 6.14 Marketplace content pack. - [Update a Content Pack](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.14/onboard-cortex-xsoar/marketplace/content-pack-installation/update-a-content-pack.md): Update an installed Cortex XSOAR 6.14 Marketplace content pack. - [Revert a Content Pack](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.14/onboard-cortex-xsoar/marketplace/content-pack-installation/revert-a-content-pack.md): Revert a Cortex XSOAR 6.14 content pack to an earlier version. - [Install a Content Pack Offline](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.14/onboard-cortex-xsoar/marketplace/install-a-content-pack-offline.md): Install Cortex XSOAR 6.14 Marketplace content packs in offline or air-gapped environments. - [Configure the Marketplace for Offline Installation](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.14/onboard-cortex-xsoar/marketplace/install-a-content-pack-offline/configure-the-marketplace-for-offline-installation.md): Configure Cortex XSOAR 6.14 Marketplace for offline content pack installation. - [Content Pack Update Notifications](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.14/onboard-cortex-xsoar/marketplace/content-pack-update-notifications.md): Enable update notifications for Cortex XSOAR 6.14 content packs. - [Customize Content Pack Notifications](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.14/onboard-cortex-xsoar/marketplace/content-pack-update-notifications/customize-content-pack-notifications.md): Customize Cortex XSOAR 6.14 content pack update notifications. - [Marketplace Troubleshooting](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.14/onboard-cortex-xsoar/marketplace/marketplace-troubleshooting.md): Troubleshoot Cortex XSOAR 6.14 Marketplace login, connectivity, timeout, and certificate issues. - [Content Pack Contributions](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.14/onboard-cortex-xsoar/marketplace/content-pack-contributions.md): Create and submit content packs to the Cortex XSOAR 6.14 Marketplace. - [Create a Content Pack](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.14/onboard-cortex-xsoar/marketplace/content-pack-contributions/create-a-content-pack.md): Create a content pack for the Cortex XSOAR 6.14 Marketplace. - [Resubmit a Content Pack](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.14/onboard-cortex-xsoar/marketplace/content-pack-contributions/resubmit-a-content-pack.md): Resubmit an updated content pack to the Cortex XSOAR 6.14 Marketplace. - [Remote Repositories in Cortex XSOAR](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.14/onboard-cortex-xsoar/remote-repositories-in-cortex-xsoar.md): Configure Cortex XSOAR 6.14 remote repositories for content development, synchronization, and deployment. - [Content Management in Cortex XSOAR](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.14/onboard-cortex-xsoar/remote-repositories-in-cortex-xsoar/content-management-in-cortex-xsoar.md): Manage Cortex XSOAR 6.14 content with remote repositories and CI/CD workflows. - [Remote Repositories Overview](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.14/onboard-cortex-xsoar/remote-repositories-in-cortex-xsoar/remote-repositories-overview.md): Understand remote repository workflows and configuration in Cortex XSOAR 6.14. - [Configure a Remote Repository on a Development Machine](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.14/onboard-cortex-xsoar/remote-repositories-in-cortex-xsoar/configure-a-remote-repository-on-a-development-machine.md): Configure a Cortex XSOAR 6.14 remote repository on a development machine. - [Configure a Remote Repository on the Production Machine](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.14/onboard-cortex-xsoar/remote-repositories-in-cortex-xsoar/configure-a-remote-repository-on-the-production-machine.md): Configure a Cortex XSOAR 6.14 remote repository on a production machine. - [Edit and Push Content to a Remote Repository](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.14/onboard-cortex-xsoar/remote-repositories-in-cortex-xsoar/edit-and-push-content-to-a-remote-repository.md): Edit and push Cortex XSOAR 6.14 content to a remote repository. - [Upgrade Remote Repositories from Versions 5.5 and below](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.14/onboard-cortex-xsoar/remote-repositories-in-cortex-xsoar/upgrade-remote-repositories-from-versions-5.5-and-below.md): Upgrade remote repository environments from Cortex XSOAR 5.5 to Cortex XSOAR 6.14. - [Troubleshoot a Remote Repository Configuration](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.14/onboard-cortex-xsoar/remote-repositories-in-cortex-xsoar/troubleshoot-a-remote-repository-configuration.md): Troubleshoot Cortex XSOAR 6.14 remote repository configuration and content workflow issues. - [Troubleshoot a Remote Repository Definition](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.14/onboard-cortex-xsoar/remote-repositories-in-cortex-xsoar/troubleshoot-a-remote-repository-configuration/troubleshoot-a-remote-repository-definition.md): Troubleshoot Cortex XSOAR 6.14 remote repository definition issues. - [Troubleshoot Editing and Pushing Content](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.14/onboard-cortex-xsoar/remote-repositories-in-cortex-xsoar/troubleshoot-a-remote-repository-configuration/troubleshoot-editing-and-pushing-content.md): Troubleshoot editing and pushing Cortex XSOAR 6.14 remote repository content. - [Troubleshoot Content Issues](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.14/onboard-cortex-xsoar/remote-repositories-in-cortex-xsoar/troubleshoot-a-remote-repository-configuration/troubleshoot-content-issues.md): Troubleshoot Cortex XSOAR 6.14 content issues in remote repositories. - [Troubleshoot a Remote Repository with an HTTP Proxy](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.14/onboard-cortex-xsoar/remote-repositories-in-cortex-xsoar/troubleshoot-a-remote-repository-configuration/troubleshoot-a-remote-repository-with-an-http-proxy.md): Troubleshoot a Cortex XSOAR 6.14 remote repository using an HTTP proxy. - [Engines](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.14/onboard-cortex-xsoar/engines.md): Install, manage, configure, and troubleshoot Cortex XSOAR 6.14 engines. - [Cortex XSOAR Engines Overview](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.14/onboard-cortex-xsoar/engines/cortex-xsoar-engines-overview.md): Understand Cortex XSOAR 6.14 engine architecture, installation, configuration, and load balancing groups. - [Engine Installation](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.14/onboard-cortex-xsoar/engines/engine-installation.md): Review Cortex XSOAR 6.14 engine requirements and supported installation methods. - [Install a Cortex XSOAR Engine](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.14/onboard-cortex-xsoar/engines/engine-installation/install-a-cortex-xsoar-engine.md): Install a Cortex XSOAR 6.14 engine on a supported host. - [Install a Signed Engine](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.14/onboard-cortex-xsoar/engines/engine-installation/install-a-signed-engine.md): Install a signed Cortex XSOAR 6.14 engine. - [Install a Cortex XSOAR Engine Offline](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.14/onboard-cortex-xsoar/engines/engine-installation/install-a-cortex-xsoar-engine-offline.md): Install a Cortex XSOAR 6.14 engine in an offline environment. - [Use an Engine in an Integration](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.14/onboard-cortex-xsoar/engines/use-an-engine-in-an-integration.md): Use a Cortex XSOAR 6.14 engine or load-balancing group with an integration. - [Run a Script using an Engine](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.14/onboard-cortex-xsoar/engines/run-a-script-using-an-engine.md): Run Cortex XSOAR 6.14 scripts and automations on an engine or load-balancing group. - [Manage Engines](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.14/onboard-cortex-xsoar/engines/manage-engines.md): Manage Cortex XSOAR 6.14 engines and load-balancing groups. - [Configure Engines](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.14/onboard-cortex-xsoar/engines/configure-engines.md): Configure Cortex XSOAR 6.14 engine workers, connectivity, communication tasks, and notifications. - [Edit the Engine Configuration](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.14/onboard-cortex-xsoar/engines/configure-engines/edit-the-engine-configuration.md): Edit configuration settings for a Cortex XSOAR 6.14 engine. - [Common Properties When Editing an Engine Configuration](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.14/onboard-cortex-xsoar/engines/configure-engines/common-properties-when-editing-an-engine-configuration.md): Reference common Cortex XSOAR 6.14 engine configuration properties. - [Configure the Engine to Use a Web Proxy](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.14/onboard-cortex-xsoar/engines/configure-engines/configure-the-engine-to-use-a-web-proxy.md): Configure a Cortex XSOAR 6.14 engine to use a web proxy. - [Configure the Engine to Call the Server Without Using a Proxy](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.14/onboard-cortex-xsoar/engines/configure-engines/configure-the-engine-to-call-the-server-without-using-a-proxy.md): Configure a Cortex XSOAR 6.14 engine to connect without a proxy. - [Configure the Number of Workers for the Server](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.14/onboard-cortex-xsoar/engines/configure-engines/configure-the-number-of-workers-for-the-server.md): Configure the number of workers for a Cortex XSOAR 6.14 engine. - [Configure Access to Communication Tasks through an Engine](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.14/onboard-cortex-xsoar/engines/configure-engines/configure-access-to-communication-tasks-through-an-engine.md): Configure communication task access through a Cortex XSOAR 6.14 engine. - [Configure an Engine to Use Custom Certificates](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.14/onboard-cortex-xsoar/engines/configure-engines/configure-an-engine-to-use-custom-certificates.md): Configure custom certificates for a Cortex XSOAR 6.14 engine. - [Notify Users When an Engine Disconnects](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.14/onboard-cortex-xsoar/engines/configure-engines/notify-users-when-an-engine-disconnects.md): Notify users when a Cortex XSOAR 6.14 engine disconnects. - [Remove an Engine](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.14/onboard-cortex-xsoar/engines/remove-an-engine.md): Remove a Cortex XSOAR 6.14 engine from a supported operating system. - [Troubleshoot Cortex XSOAR Engines](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.14/onboard-cortex-xsoar/engines/troubleshoot-cortex-xsoar-engines.md): Troubleshoot Cortex XSOAR 6.14 engines with logs, errors, and diagnostics. - [Customize and Configure Cortex XSOAR](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.14/customize-cortex-xsoar/customize-and-configure-cortex-xsoar.md): Customize and configure Cortex XSOAR 6.14 incidents, playbooks, data, reporting, and system settings. - [Incidents](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.14/customize-cortex-xsoar/customize-and-configure-cortex-xsoar/incidents.md): Configure Cortex XSOAR 6.14 incident types, workflows, fields, layouts, and access controls. - [Incident Lifecycle](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.14/customize-cortex-xsoar/customize-and-configure-cortex-xsoar/incidents/incident-lifecycle.md): Incidents are potential security threats analysts identify and remediate in Cortex XSOAR 6.14. - [Fetch Incidents From an Integration Instance](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.14/customize-cortex-xsoar/customize-and-configure-cortex-xsoar/incidents/incident-lifecycle/fetch-incidents-from-an-integration-instance.md): Fetch incidents from an integration instance in Cortex XSOAR 6.14. - [Receive Notification on an Incident Fetch Error](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.14/customize-cortex-xsoar/customize-and-configure-cortex-xsoar/incidents/incident-lifecycle/receive-notification-on-an-incident-fetch-error.md): Configure Cortex XSOAR 6.14 notifications for incident fetch errors. - [Incident Context Data](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.14/customize-cortex-xsoar/customize-and-configure-cortex-xsoar/incidents/incident-context-data.md): Learn about incident context data in Cortex XSOAR 6.14 and how to access it. - [Incident Customization](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.14/customize-cortex-xsoar/customize-and-configure-cortex-xsoar/incidents/incident-customization.md): Customize incidents in Cortex XSOAR 6.14, including types, fields, layouts, and indicator extraction. - [Create an Incident Type](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.14/customize-cortex-xsoar/customize-and-configure-cortex-xsoar/incidents/incident-customization/create-an-incident-type.md): Create and configure incident types in Cortex XSOAR 6.14. - [Customize Incident Layouts](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.14/customize-cortex-xsoar/customize-and-configure-cortex-xsoar/incidents/incident-customization/customize-incident-layouts.md): Customize incident layouts for Cortex XSOAR 6.14. - [Incident Fields](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.14/customize-cortex-xsoar/customize-and-configure-cortex-xsoar/incidents/incident-customization/incident-fields.md): Configure incident fields for Cortex XSOAR 6.14. - [Create a Custom Incident Field](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.14/customize-cortex-xsoar/customize-and-configure-cortex-xsoar/incidents/incident-customization/incident-fields/create-a-custom-incident-field.md): Create custom incident fields in Cortex XSOAR 6.14. - [Create a Grid Field for an Incident Type](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.14/customize-cortex-xsoar/customize-and-configure-cortex-xsoar/incidents/incident-customization/incident-fields/create-a-grid-field-for-an-incident-type.md): Create grid fields for Cortex XSOAR 6.14 incident types. - [Use Scripts with the Grid Field](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.14/customize-cortex-xsoar/customize-and-configure-cortex-xsoar/incidents/incident-customization/incident-fields/use-scripts-with-the-grid-field.md): Use scripts with Cortex XSOAR 6.14 grid incident fields. - [Incident Field Trigger Scripts](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.14/customize-cortex-xsoar/customize-and-configure-cortex-xsoar/incidents/incident-customization/incident-fields/incident-field-trigger-scripts.md): Configure Cortex XSOAR 6.14 incident field trigger scripts. - [Troubleshoot Closing Case Incident after Changing Field Type](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.14/customize-cortex-xsoar/customize-and-configure-cortex-xsoar/incidents/incident-customization/incident-fields/troubleshoot-closing-case-incident-after-changing-field-type.md): Troubleshoot Cortex XSOAR 6.14 cases after changing an incident field type. - [Create an Evidence Field](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.14/customize-cortex-xsoar/customize-and-configure-cortex-xsoar/incidents/incident-customization/incident-fields/create-an-evidence-field.md): Create evidence fields for Cortex XSOAR 6.14 incidents. - [Incident De-Duplication](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.14/customize-cortex-xsoar/customize-and-configure-cortex-xsoar/incidents/incident-de-duplication.md): De-duplicate Cortex XSOAR 6.14 incidents manually or automatically with rules, scripts, and playbooks. - [Manually De-Duplicate Incidents](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.14/customize-cortex-xsoar/customize-and-configure-cortex-xsoar/incidents/incident-de-duplication/manually-de-duplicate-incidents.md): Manually de-duplicate Cortex XSOAR 6.14 incidents. - [Automatic De-Duplication Using Scripts](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.14/customize-cortex-xsoar/customize-and-configure-cortex-xsoar/incidents/incident-de-duplication/automatic-de-duplication-using-scripts.md): Automate Cortex XSOAR 6.14 incident de-duplication with scripts. - [Pre-Process Rules](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.14/customize-cortex-xsoar/customize-and-configure-cortex-xsoar/incidents/pre-process-rules.md): Create Cortex XSOAR 6.14 pre-process rules to automate actions on incoming incidents. - [Create Pre-Process Rules for Incidents](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.14/customize-cortex-xsoar/customize-and-configure-cortex-xsoar/incidents/pre-process-rules/create-pre-process-rules-for-incidents.md): Create Cortex XSOAR 6.14 pre-process rules for incidents. - [Rule Actions for Pre-Process Rules](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.14/customize-cortex-xsoar/customize-and-configure-cortex-xsoar/incidents/pre-process-rules/create-pre-process-rules-for-incidents/rule-actions-for-pre-process-rules.md): Configure rule actions for Cortex XSOAR 6.14 pre-process rules. - [Post Processing for Incidents](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.14/customize-cortex-xsoar/customize-and-configure-cortex-xsoar/incidents/post-processing-for-incidents.md): Configure Cortex XSOAR 6.14 post-processing scripts to automate actions before incident closure. - [Create a Post-Processing Script](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.14/customize-cortex-xsoar/customize-and-configure-cortex-xsoar/incidents/post-processing-for-incidents/create-a-post-processing-script.md): Create post-processing scripts for Cortex XSOAR 6.14 incidents. - [Add a Post-Processing Script to the Incident Type](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.14/customize-cortex-xsoar/customize-and-configure-cortex-xsoar/incidents/post-processing-for-incidents/add-a-post-processing-script-to-the-incident-type.md): Add post-processing scripts to Cortex XSOAR 6.14 incident types. - [War Room Overview](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.14/customize-cortex-xsoar/customize-and-configure-cortex-xsoar/incidents/war-room-overview.md): Use the Cortex XSOAR 6.14 War Room for real-time incident investigation, commands, and collaboration. - [Schedule a Command](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.14/customize-cortex-xsoar/customize-and-configure-cortex-xsoar/incidents/war-room-overview/schedule-a-command.md): Schedule commands in the Cortex XSOAR 6.14 War Room. - [Add a Custom Widget in the War Room](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.14/customize-cortex-xsoar/customize-and-configure-cortex-xsoar/incidents/war-room-overview/add-a-custom-widget-in-the-war-room.md): Add custom widgets to the Cortex XSOAR 6.14 War Room. - [War Room Indexing](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.14/customize-cortex-xsoar/customize-and-configure-cortex-xsoar/incidents/war-room-overview/war-room-indexing.md): Configure War Room indexing in Cortex XSOAR 6.14. - [Index War Room Entries Using Bolt DB](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.14/customize-cortex-xsoar/customize-and-configure-cortex-xsoar/incidents/war-room-overview/war-room-indexing/index-war-room-entries-using-bolt-db.md): Index Cortex XSOAR 6.14 War Room entries with Bolt DB. - [Index War Room Entries Using Elasticsearch](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.14/customize-cortex-xsoar/customize-and-configure-cortex-xsoar/incidents/war-room-overview/war-room-indexing/index-war-room-entries-using-elasticsearch.md): Index Cortex XSOAR 6.14 War Room entries with Elasticsearch. - [Incident Access Control Configuration](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.14/customize-cortex-xsoar/customize-and-configure-cortex-xsoar/incidents/incident-access-control-configuration.md): Configure Cortex XSOAR 6.14 incident and investigation access with role-based access controls. - [Limit Access to Investigations using RBAC](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.14/customize-cortex-xsoar/customize-and-configure-cortex-xsoar/incidents/incident-access-control-configuration/limit-access-to-investigations-using-rbac.md): Limit Cortex XSOAR 6.14 investigation access with role-based controls. - [Restrict an Investigation](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.14/customize-cortex-xsoar/customize-and-configure-cortex-xsoar/incidents/incident-access-control-configuration/restrict-an-investigation.md): Restrict access to Cortex XSOAR 6.14 investigations. - [Classification and Mapping](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.14/customize-cortex-xsoar/customize-and-configure-cortex-xsoar/incidents/classification-and-mapping.md): Classify and map incoming integration data to Cortex XSOAR 6.14 incidents and indicators. - [Classify Events Using a Classification Key](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.14/customize-cortex-xsoar/customize-and-configure-cortex-xsoar/incidents/classification-and-mapping/classify-events-using-a-classification-key.md): Classify events with a classification key in Cortex XSOAR 6.14. - [Create a Mapper](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.14/customize-cortex-xsoar/customize-and-configure-cortex-xsoar/incidents/classification-and-mapping/create-a-mapper.md): Create mappers for Cortex XSOAR 6.14 incident classification and mapping. - [Incident Mirroring](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.14/customize-cortex-xsoar/customize-and-configure-cortex-xsoar/incidents/incident-mirroring.md): Configure Cortex XSOAR 6.14 incident mirroring with third-party applications and integrations. - [Customize Incident Close Reasons](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.14/customize-cortex-xsoar/customize-and-configure-cortex-xsoar/incidents/customize-incident-close-reasons.md): Customize close reasons for incidents by adding a server configuration in Cortex XSOAR 6.14. - [Change the Display Name of Security Incidents](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.14/customize-cortex-xsoar/customize-and-configure-cortex-xsoar/incidents/change-the-display-name-of-security-incidents.md): Add a Cortex XSOAR 6.14 server configuration to change the name of security incidents from ‘incident’ to another term - cases, issues, etc. - [Playbooks](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.14/customize-cortex-xsoar/customize-and-configure-cortex-xsoar/playbooks.md): Build and manage Cortex XSOAR 6.14 playbooks for security orchestration and response. - [What Are Playbooks?](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.14/customize-cortex-xsoar/customize-and-configure-cortex-xsoar/playbooks/what-are-playbooks.md): Understand Cortex XSOAR 6.14 playbooks for security process automation and incident remediation. - [Playbook Development](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.14/customize-cortex-xsoar/customize-and-configure-cortex-xsoar/playbooks/playbook-development.md): Develop Cortex XSOAR 6.14 playbooks to automate security workflows and response actions. - [Configure IoT Security Playbooks](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.14/customize-cortex-xsoar/customize-and-configure-cortex-xsoar/playbooks/configure-iot-security-playbooks.md): Configure Cortex XSOAR 6.14 IoT Security playbooks for automated security workflows. - [Manage Playbook Settings](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.14/customize-cortex-xsoar/customize-and-configure-cortex-xsoar/playbooks/manage-playbook-settings.md): Configure Cortex XSOAR 6.14 playbook settings, access, triggers, and Quiet Mode. - [Obtain Playbook Metadata](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.14/customize-cortex-xsoar/customize-and-configure-cortex-xsoar/playbooks/manage-playbook-settings/obtain-playbook-metadata.md): Analyze incident playbook task inputs, outputs, storage use, and task types in Cortex XSOAR 6.14. - [Version Control](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.14/customize-cortex-xsoar/customize-and-configure-cortex-xsoar/playbooks/version-control.md): Save and manage Cortex XSOAR 6.14 playbook versions during development. - [Playbook Task Fields](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.14/customize-cortex-xsoar/customize-and-configure-cortex-xsoar/playbooks/playbook-task-fields.md): Reference fields for defining Cortex XSOAR 6.14 playbook tasks. - [Create Section Headers](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.14/customize-cortex-xsoar/customize-and-configure-cortex-xsoar/playbooks/playbook-task-fields/create-section-headers.md): Create section headers to organize Cortex XSOAR 6.14 playbook tasks. - [Create a Conditional Task](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.14/customize-cortex-xsoar/customize-and-configure-cortex-xsoar/playbooks/playbook-task-fields/create-a-conditional-task.md): Create conditional tasks for branching Cortex XSOAR 6.14 playbook workflows. - [Communication Tasks](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.14/customize-cortex-xsoar/customize-and-configure-cortex-xsoar/playbooks/playbook-task-fields/communication-tasks.md): Configure Cortex XSOAR 6.14 playbook communication tasks for analyst interactions. - [Create an Ask Task](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.14/customize-cortex-xsoar/customize-and-configure-cortex-xsoar/playbooks/playbook-task-fields/communication-tasks/create-an-ask-task.md): Create Cortex XSOAR 6.14 Ask tasks to collect analyst responses. - [Ask Task Examples](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.14/customize-cortex-xsoar/customize-and-configure-cortex-xsoar/playbooks/playbook-task-fields/communication-tasks/create-an-ask-task/ask-task-examples.md): Review Cortex XSOAR 6.14 Ask task examples for playbook communication. - [Customize an Ask Task](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.14/customize-cortex-xsoar/customize-and-configure-cortex-xsoar/playbooks/playbook-task-fields/communication-tasks/create-an-ask-task/customize-an-ask-task.md): Customize Cortex XSOAR 6.14 Ask tasks for analyst communication workflows. - [Create a Data Collection Task](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.14/customize-cortex-xsoar/customize-and-configure-cortex-xsoar/playbooks/playbook-task-fields/communication-tasks/create-a-data-collection-task.md): Create Cortex XSOAR 6.14 data collection tasks to gather analyst input. - [Data Collection Task Examples](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.14/customize-cortex-xsoar/customize-and-configure-cortex-xsoar/playbooks/playbook-task-fields/communication-tasks/create-a-data-collection-task/data-collection-task-examples.md): Review Cortex XSOAR 6.14 data collection task examples for playbooks. - [Customize a Data Collection Task](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.14/customize-cortex-xsoar/customize-and-configure-cortex-xsoar/playbooks/playbook-task-fields/communication-tasks/create-a-data-collection-task/customize-a-data-collection-task.md): Customize Cortex XSOAR 6.14 data collection tasks for playbook workflows. - [Customize the SOC Name](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.14/customize-cortex-xsoar/customize-and-configure-cortex-xsoar/playbooks/playbook-task-fields/communication-tasks/customize-the-soc-name.md): Customize the SOC name shown in Cortex XSOAR 6.14 communication tasks. - [Create Communication Task Authentication](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.14/customize-cortex-xsoar/customize-and-configure-cortex-xsoar/playbooks/playbook-task-fields/communication-tasks/create-communication-task-authentication.md): Configure authentication for Cortex XSOAR 6.14 communication tasks. - [Add Ad Hoc Tasks to a Work Plan](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.14/customize-cortex-xsoar/customize-and-configure-cortex-xsoar/playbooks/playbook-task-fields/communication-tasks/add-ad-hoc-tasks-to-a-work-plan.md): Add ad hoc tasks to Cortex XSOAR 6.14 incident work plans. - [Handle Errors in a Playbook](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.14/customize-cortex-xsoar/customize-and-configure-cortex-xsoar/playbooks/playbook-task-fields/communication-tasks/handle-errors-in-a-playbook.md): Handle task errors in Cortex XSOAR 6.14 playbooks and automation workflows. - [Playbook Task Fields](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.14/customize-cortex-xsoar/customize-and-configure-cortex-xsoar/playbooks/playbook-task-fields/communication-tasks/playbook-task-fields.md): Reference Cortex XSOAR 6.14 fields for communication playbook tasks. - [Playbook Inputs and Outputs](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.14/customize-cortex-xsoar/customize-and-configure-cortex-xsoar/playbooks/playbook-inputs-and-outputs.md): Configure Cortex XSOAR 6.14 playbook inputs and outputs for task data flow. - [Task Cheat Sheet](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.14/customize-cortex-xsoar/customize-and-configure-cortex-xsoar/playbooks/playbook-inputs-and-outputs/task-cheat-sheet.md): Use this Cortex XSOAR 6.14 cheat sheet for playbook task configuration. - [Extend Context](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.14/customize-cortex-xsoar/customize-and-configure-cortex-xsoar/playbooks/extend-context.md): Extend Cortex XSOAR 6.14 context with integration and command output data. - [Extend Context in a Playbook Task](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.14/customize-cortex-xsoar/customize-and-configure-cortex-xsoar/playbooks/extend-context/extend-context-in-a-playbook-task.md): Extend context within a Cortex XSOAR 6.14 playbook task. - [Extend Context using the Command Line](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.14/customize-cortex-xsoar/customize-and-configure-cortex-xsoar/playbooks/extend-context/extend-context-using-the-command-line.md): Extend Cortex XSOAR 6.14 context using command-line commands. - [Use DT syntax to get select keys from a list of dictionaries](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.14/customize-cortex-xsoar/customize-and-configure-cortex-xsoar/playbooks/extend-context/use-dt-syntax-to-get-select-keys-from-a-list-of-dictionaries.md): Use DT syntax in Cortex XSOAR 6.14 to select dictionary list keys. - [Filters and Transformers](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.14/customize-cortex-xsoar/customize-and-configure-cortex-xsoar/playbooks/filters-and-transformers.md): Use Cortex XSOAR 6.14 filters and transformers to manipulate playbook data. - [Create Filters and Transformers in a Playbook](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.14/customize-cortex-xsoar/customize-and-configure-cortex-xsoar/playbooks/filters-and-transformers/create-filters-and-transformers-in-a-playbook.md): Create filters and transformers for Cortex XSOAR 6.14 playbook tasks. - [Create a Filter Example](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.14/customize-cortex-xsoar/customize-and-configure-cortex-xsoar/playbooks/filters-and-transformers/create-filters-and-transformers-in-a-playbook/create-a-filter-example.md): Create a Cortex XSOAR 6.14 playbook filter with this example. - [Create a Filter (Advanced) Example](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.14/customize-cortex-xsoar/customize-and-configure-cortex-xsoar/playbooks/filters-and-transformers/create-filters-and-transformers-in-a-playbook/create-a-filter-advanced-example.md): Create advanced Cortex XSOAR 6.14 playbook filters with this example. - [Filter Operators](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.14/customize-cortex-xsoar/customize-and-configure-cortex-xsoar/playbooks/filters-and-transformers/filter-operators.md): Reference filter operators for Cortex XSOAR 6.14 playbook data processing. - [Built-in Filters](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.14/customize-cortex-xsoar/customize-and-configure-cortex-xsoar/playbooks/filters-and-transformers/filter-operators/built-in-filters.md): Use built-in filters to transform Cortex XSOAR 6.14 playbook data. - [Transformers Operators](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.14/customize-cortex-xsoar/customize-and-configure-cortex-xsoar/playbooks/filters-and-transformers/filter-operators/transformers-operators.md): Reference transformer operators for Cortex XSOAR 6.14 playbook data. - [Create Custom Filter and Transformer Operators](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.14/customize-cortex-xsoar/customize-and-configure-cortex-xsoar/playbooks/filters-and-transformers/filter-operators/create-custom-filter-and-transformer-operators.md): Create custom filters and transformers for Cortex XSOAR 6.14 playbooks. - [Automations](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.14/customize-cortex-xsoar/customize-and-configure-cortex-xsoar/playbooks/automations.md): Create and manage Cortex XSOAR 6.14 automations for playbook workflows. - [Special Automation Tags](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.14/customize-cortex-xsoar/customize-and-configure-cortex-xsoar/playbooks/automations/special-automation-tags.md): Reference special automation tags in Cortex XSOAR 6.14. - [Common Scripts to use in Automations](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.14/customize-cortex-xsoar/customize-and-configure-cortex-xsoar/playbooks/automations/common-scripts-to-use-in-automations.md): Use common Cortex XSOAR 6.14 scripts in automation workflows. - [Configure a Sub-playbook Loop](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.14/customize-cortex-xsoar/customize-and-configure-cortex-xsoar/playbooks/configure-a-sub-playbook-loop.md): Configure a Cortex XSOAR 6.14 sub-playbook to run in a loop. - [Playbook Polling](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.14/customize-cortex-xsoar/customize-and-configure-cortex-xsoar/playbooks/playbook-polling.md): Use the Cortex XSOAR 6.14 Generic Polling playbook to check remote process status. - [Create Incident Fields in a Playbook](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.14/customize-cortex-xsoar/customize-and-configure-cortex-xsoar/playbooks/create-incident-fields-in-a-playbook.md): Use the Cortex XSOAR 6.14 setIncident automation to update system incident fields. - [Playbook Testing](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.14/customize-cortex-xsoar/customize-and-configure-cortex-xsoar/playbooks/playbook-testing.md): Test Cortex XSOAR 6.14 playbooks with ingested incidents. - [Debug a Playbook](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.14/customize-cortex-xsoar/customize-and-configure-cortex-xsoar/playbooks/playbook-testing/debug-a-playbook.md): Debug Cortex XSOAR 6.14 playbooks to inspect tasks and execution flow. - [Debugger Troubleshooting](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.14/customize-cortex-xsoar/customize-and-configure-cortex-xsoar/playbooks/playbook-testing/debugger-troubleshooting.md): Troubleshoot the Cortex XSOAR 6.14 playbook debugger. - [Best Practices](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.14/customize-cortex-xsoar/customize-and-configure-cortex-xsoar/playbooks/best-practices.md): Follow best practices for developing and managing Cortex XSOAR 6.14 playbooks. - [Jobs](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.14/customize-cortex-xsoar/customize-and-configure-cortex-xsoar/jobs.md): Schedule Cortex XSOAR 6.14 playbooks with time-triggered and feed-triggered jobs. - [Create a Time Triggered Job](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.14/customize-cortex-xsoar/customize-and-configure-cortex-xsoar/jobs/create-a-time-triggered-job.md): Create a time-triggered Cortex XSOAR 6.14 job to run a playbook. - [Create a Job Triggered by a Delta in Feed](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.14/customize-cortex-xsoar/customize-and-configure-cortex-xsoar/jobs/create-a-job-triggered-by-a-delta-in-feed.md): Create a Cortex XSOAR 6.14 job triggered by feed changes. - [Time Triggered Job Parameters](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.14/customize-cortex-xsoar/customize-and-configure-cortex-xsoar/jobs/time-triggered-job-parameters.md): Describe parameters for creating a time-triggered job in Cortex XSOAR 6.14. - [Process Indicators Using a Job Triggered By Delta](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.14/customize-cortex-xsoar/customize-and-configure-cortex-xsoar/jobs/process-indicators-using-a-job-triggered-by-delta.md): Process indicators with a feed-triggered Cortex XSOAR 6.14 job. - [Add Indicators to SIEM Using a Time Triggered Job](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.14/customize-cortex-xsoar/customize-and-configure-cortex-xsoar/jobs/add-indicators-to-siem-using-a-time-triggered-job.md): Send indicators to a SIEM with a time-triggered Cortex XSOAR 6.14 job. - [Work with SLAs](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.14/customize-cortex-xsoar/customize-and-configure-cortex-xsoar/work-with-slas.md): Create and manage Cortex XSOAR 6.14 SLAs, timers, triggers, scripts, and risk thresholds. - [SLA Overview](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.14/customize-cortex-xsoar/customize-and-configure-cortex-xsoar/work-with-slas/sla-overview.md): Understand SLA fields, timers, and actions in Cortex XSOAR 6.14. - [Create an SLA Field](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.14/customize-cortex-xsoar/customize-and-configure-cortex-xsoar/work-with-slas/create-an-sla-field.md): Create SLA and timer fields in Cortex XSOAR 6.14. - [Manage SLA and Timer Fields in an Incident](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.14/customize-cortex-xsoar/customize-and-configure-cortex-xsoar/work-with-slas/manage-sla-and-timer-fields-in-an-incident.md): Manage incident SLA and timer fields in Cortex XSOAR 6.14. - [Create an SLA Trigger](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.14/customize-cortex-xsoar/customize-and-configure-cortex-xsoar/work-with-slas/create-an-sla-trigger.md): Create SLA triggers for Cortex XSOAR 6.14 playbook tasks. - [Customize SLA Scripts](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.14/customize-cortex-xsoar/customize-and-configure-cortex-xsoar/work-with-slas/customize-sla-scripts.md): Customize SLA scripts for Cortex XSOAR 6.14. - [Search Incidents using SLA and Timer Fields](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.14/customize-cortex-xsoar/customize-and-configure-cortex-xsoar/work-with-slas/search-incidents-using-sla-and-timer-fields.md): Search Cortex XSOAR 6.14 incidents by SLA and timer fields. - [Configure the Global Risk Threshold](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.14/customize-cortex-xsoar/customize-and-configure-cortex-xsoar/work-with-slas/configure-the-global-risk-threshold.md): Configure the global SLA risk threshold in Cortex XSOAR 6.14. - [Machine Learning](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.14/customize-cortex-xsoar/customize-and-configure-cortex-xsoar/machine-learning.md): Use Cortex XSOAR 6.14 machine learning models for phishing classification and automation. - [Machine Learning Capabilities](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.14/customize-cortex-xsoar/customize-and-configure-cortex-xsoar/machine-learning/machine-learning-capabilities.md): Explore Cortex XSOAR 6.14 machine learning and phishing classifier capabilities. - [Machine Learning Models](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.14/customize-cortex-xsoar/customize-and-configure-cortex-xsoar/machine-learning/machine-learning-models.md): Use Cortex XSOAR 6.14 machine learning models for incident analysis. - [Use the Phishing Classifier in Production](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.14/customize-cortex-xsoar/customize-and-configure-cortex-xsoar/machine-learning/use-the-phishing-classifier-in-production.md): Use the Cortex XSOAR 6.14 phishing classifier in production. - [Create a Machine Learning Model](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.14/customize-cortex-xsoar/customize-and-configure-cortex-xsoar/machine-learning/create-a-machine-learning-model.md): Create a Cortex XSOAR 6.14 machine learning model for phishing classification. - [Phishing Classifier Demo](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.14/customize-cortex-xsoar/customize-and-configure-cortex-xsoar/machine-learning/phishing-classifier-demo.md): Try the Cortex XSOAR 6.14 phishing classifier demonstration. - [Train a Phishing Classifier on Non-English Languages](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.14/customize-cortex-xsoar/customize-and-configure-cortex-xsoar/machine-learning/train-a-phishing-classifier-on-non-english-languages.md): Train a Cortex XSOAR 6.14 phishing classifier for non-English language emails. - [Additional Machine Learning Scripts](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.14/customize-cortex-xsoar/customize-and-configure-cortex-xsoar/machine-learning/additional-machine-learning-scripts.md): Reference additional Cortex XSOAR 6.14 machine learning scripts. - [Lists](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.14/customize-cortex-xsoar/customize-and-configure-cortex-xsoar/lists.md): Create and manage Cortex XSOAR 6.14 lists for playbooks and automations. - [Work With Lists](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.14/customize-cortex-xsoar/customize-and-configure-cortex-xsoar/lists/work-with-lists.md): Manage lists in Cortex XSOAR 6.14 that automations and playbooks can access. - [Work with JSON Lists](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.14/customize-cortex-xsoar/customize-and-configure-cortex-xsoar/lists/work-with-lists/work-with-json-lists.md): Extract, filter, and transform JSON list data in Cortex XSOAR 6.14 playbooks. - [Create a List](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.14/customize-cortex-xsoar/customize-and-configure-cortex-xsoar/lists/create-a-list.md): Create Cortex XSOAR 6.14 lists that scripts can parse and modify. - [Set the List Separator Character](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.14/customize-cortex-xsoar/customize-and-configure-cortex-xsoar/lists/set-the-list-separator-character.md): Set the list separator character in Cortex XSOAR 6.14. The default is a comma. - [Transform a List into an Array](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.14/customize-cortex-xsoar/customize-and-configure-cortex-xsoar/lists/transform-a-list-into-an-array.md): Transform a list into an array for playbook tasks and instance mapping in Cortex XSOAR 6.14. - [Indicators](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.14/customize-cortex-xsoar/customize-and-configure-cortex-xsoar/indicators.md): Manage Cortex XSOAR 6.14 threat indicators, including types, fields, extraction, enrichment, expiration, and feeds. - [Indicator Concepts](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.14/customize-cortex-xsoar/customize-and-configure-cortex-xsoar/indicators/indicator-concepts.md): Learn Cortex XSOAR 6.14 threat intelligence concepts, including fetching, configuring, enriching, and exporting indicators. - [Indicator Verdict](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.14/customize-cortex-xsoar/customize-and-configure-cortex-xsoar/indicators/indicator-verdict.md): Understand how Cortex XSOAR 6.14 assigns and uses indicator verdicts from the most reliable reputation source. - [Indicator Ingestion](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.14/customize-cortex-xsoar/customize-and-configure-cortex-xsoar/indicators/indicator-ingestion.md): Understand how Cortex XSOAR 6.14 detects, ingests, and processes threat indicators from supported sources. - [Indicator Customization](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.14/customize-cortex-xsoar/customize-and-configure-cortex-xsoar/indicators/indicator-customization.md): Customize Cortex XSOAR 6.14 indicator types, fields, scripts, profiles, and layouts for threat intelligence workflows. - [Indicator Types](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.14/customize-cortex-xsoar/customize-and-configure-cortex-xsoar/indicators/indicator-customization/indicator-types.md): Configure Cortex XSOAR 6.14 indicator types, associated fields, profiles, and scripts for threat intelligence data. - [File Indicators](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.14/customize-cortex-xsoar/customize-and-configure-cortex-xsoar/indicators/indicator-customization/indicator-types/file-indicators.md): Manage Cortex XSOAR 6.14 file indicators and their associated hash values for threat intelligence workflows. - [File Indicator Merging Strategy](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.14/customize-cortex-xsoar/customize-and-configure-cortex-xsoar/indicators/indicator-customization/indicator-types/file-indicators/file-indicator-merging-strategy.md): Understand how Cortex XSOAR 6.14 merges file indicators using their hash values. - [Create an Indicator Type](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.14/customize-cortex-xsoar/customize-and-configure-cortex-xsoar/indicators/indicator-customization/indicator-types/create-an-indicator-type.md): Create a custom Cortex XSOAR 6.14 indicator type for structured threat intelligence data. - [Indicator Type Profile](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.14/customize-cortex-xsoar/customize-and-configure-cortex-xsoar/indicators/indicator-customization/indicator-types/indicator-type-profile.md): Configure Cortex XSOAR 6.14 indicator type profiles to control indicator fields and behavior. - [Map Custom Indicator Fields](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.14/customize-cortex-xsoar/customize-and-configure-cortex-xsoar/indicators/indicator-customization/indicator-types/map-custom-indicator-fields.md): Map custom fields to Cortex XSOAR 6.14 indicator data for consistent threat intelligence management. - [Formatting Scripts](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.14/customize-cortex-xsoar/customize-and-configure-cortex-xsoar/indicators/indicator-customization/indicator-types/formatting-scripts.md): Configure Cortex XSOAR 6.14 formatting scripts to normalize indicator values and output. - [Enhancement Scripts](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.14/customize-cortex-xsoar/customize-and-configure-cortex-xsoar/indicators/indicator-customization/indicator-types/enhancement-scripts.md): Configure Cortex XSOAR 6.14 enhancement scripts to enrich indicators on demand. - [Reputation Scripts](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.14/customize-cortex-xsoar/customize-and-configure-cortex-xsoar/indicators/indicator-customization/indicator-types/reputation-scripts.md): Configure Cortex XSOAR 6.14 reputation scripts that calculate and update indicator verdicts. - [Reputation Commands](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.14/customize-cortex-xsoar/customize-and-configure-cortex-xsoar/indicators/indicator-customization/indicator-types/reputation-commands.md): Configure Cortex XSOAR 6.14 reputation commands that calculate and update indicator verdicts. - [Indicator Fields](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.14/customize-cortex-xsoar/customize-and-configure-cortex-xsoar/indicators/indicator-customization/indicator-fields.md): Create and configure Cortex XSOAR 6.14 indicator fields for structured threat intelligence data. - [Create a Custom Indicator Field](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.14/customize-cortex-xsoar/customize-and-configure-cortex-xsoar/indicators/indicator-customization/indicator-fields/create-a-custom-indicator-field.md): Create a custom Cortex XSOAR 6.14 indicator field for tailored threat intelligence data. - [Configure the HTML Field](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.14/customize-cortex-xsoar/customize-and-configure-cortex-xsoar/indicators/indicator-customization/indicator-fields/create-a-custom-indicator-field/configure-the-html-field.md): Configure HTML indicator fields in Cortex XSOAR 6.14 to display rich threat intelligence content. - [Indicator Field Trigger Scripts](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.14/customize-cortex-xsoar/customize-and-configure-cortex-xsoar/indicators/indicator-customization/indicator-fields/indicator-field-trigger-scripts.md): Run Cortex XSOAR 6.14 scripts automatically when indicator field values change. - [Indicator Layouts](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.14/customize-cortex-xsoar/customize-and-configure-cortex-xsoar/indicators/indicator-customization/indicator-layouts.md): Customize Cortex XSOAR 6.14 layouts for indicator types and threat intelligence investigations. - [Customize an Indicator Type Layout](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.14/customize-cortex-xsoar/customize-and-configure-cortex-xsoar/indicators/indicator-customization/indicator-layouts/customize-an-indicator-type-layout.md): Customize a Cortex XSOAR 6.14 layout for an indicator type and its threat intelligence data. - [Add a Script in the Indicator Layout](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.14/customize-cortex-xsoar/customize-and-configure-cortex-xsoar/indicators/indicator-customization/indicator-layouts/add-a-script-in-the-indicator-layout.md): Add dynamic script output to a Cortex XSOAR 6.14 indicator layout. - [Indicator Extraction](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.14/customize-cortex-xsoar/customize-and-configure-cortex-xsoar/indicators/indicator-extraction.md): Configure Cortex XSOAR 6.14 indicator extraction and enrichment from incident fields, playbook tasks, and CLI commands. - [Indicator Extraction Modes](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.14/customize-cortex-xsoar/customize-and-configure-cortex-xsoar/indicators/indicator-extraction/indicator-extraction-modes.md): Understand Cortex XSOAR 6.14 indicator extraction modes and their behavior for incident data. - [Create Indicator Extraction Rules for an Incident Type](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.14/customize-cortex-xsoar/customize-and-configure-cortex-xsoar/indicators/indicator-extraction/create-indicator-extraction-rules-for-an-incident-type.md): Configure Cortex XSOAR 6.14 indicator extraction rules for incident types and fields. - [Run Indicator Extraction in the CLI](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.14/customize-cortex-xsoar/customize-and-configure-cortex-xsoar/indicators/indicator-extraction/run-indicator-extraction-in-the-cli.md): Extract and enrich Cortex XSOAR 6.14 indicators from the command-line interface. - [Create Indicator Extract Rules for a Playbook Task](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.14/customize-cortex-xsoar/customize-and-configure-cortex-xsoar/indicators/indicator-extraction/create-indicator-extract-rules-for-a-playbook-task.md): Configure Cortex XSOAR 6.14 indicator extraction rules for playbook tasks. - [Disable Indicator Extraction for Automations or Integrations](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.14/customize-cortex-xsoar/customize-and-configure-cortex-xsoar/indicators/indicator-extraction/disable-indicator-extraction-for-automations-or-integrations.md): Disable Cortex XSOAR 6.14 indicator extraction for selected automations or integrations. - [Indicator Expiration](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.14/customize-cortex-xsoar/customize-and-configure-cortex-xsoar/indicators/indicator-expiration.md): Configure Cortex XSOAR 6.14 indicator expiration statuses, default methods, and retention periods. - [Feed Integrations](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.14/customize-cortex-xsoar/customize-and-configure-cortex-xsoar/indicators/feed-integrations.md): Use Cortex XSOAR 6.14 feed integrations to fetch and process threat indicators from intelligence sources. - [Set the Source Reliability of Enrichment Integrations](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.14/customize-cortex-xsoar/customize-and-configure-cortex-xsoar/indicators/feed-integrations/set-the-source-reliability-of-enrichment-integrations.md): Set Cortex XSOAR 6.14 source reliability for enrichment integrations and indicator reputation data. - [Dashboards](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.14/customize-cortex-xsoar/customize-and-configure-cortex-xsoar/dashboards.md): Create, customize, share, and manage Cortex XSOAR 6.14 dashboards and widgets for security operations data. - [Dashboard Overview](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.14/customize-cortex-xsoar/customize-and-configure-cortex-xsoar/dashboards/dashboard-overview.md): Explore Cortex XSOAR 6.14 dashboards, customizable widgets, filters, sharing, imports, exports, and dashboard management. - [Create a Dashboard](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.14/customize-cortex-xsoar/customize-and-configure-cortex-xsoar/dashboards/create-a-dashboard.md): Create and customize a Cortex XSOAR 6.14 dashboard with widgets, data views, and security operations insights. - [Add a Widget to a Dashboard](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.14/customize-cortex-xsoar/customize-and-configure-cortex-xsoar/dashboards/add-a-widget-to-a-dashboard.md): Add and configure widgets on Cortex XSOAR 6.14 dashboards, including widget parameters and date ranges. - [Share a Dashboard](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.14/customize-cortex-xsoar/customize-and-configure-cortex-xsoar/dashboards/share-a-dashboard.md): Share Cortex XSOAR 6.14 dashboards with users by role and manage permissions for shared dashboard access. - [Edit a Dashboard](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.14/customize-cortex-xsoar/customize-and-configure-cortex-xsoar/dashboards/edit-a-dashboard.md): Edit Cortex XSOAR 6.14 dashboards by managing widgets, date ranges, layout, size, and position. - [Reports](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.14/customize-cortex-xsoar/customize-and-configure-cortex-xsoar/reports.md): Create, customize, schedule, and troubleshoot Cortex XSOAR 6.14 reports for security operations data. - [Reports Overview](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.14/customize-cortex-xsoar/customize-and-configure-cortex-xsoar/reports/reports-overview.md): Explore Cortex XSOAR 6.14 reporting features, including report creation, customization, scheduling, formats, and branding. - [Create a Report](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.14/customize-cortex-xsoar/customize-and-configure-cortex-xsoar/reports/create-a-report.md): Create and customize Cortex XSOAR 6.14 reports with widgets, schedules, recipients, and PDF, CSV, or Word output. - [Schedule a report](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.14/customize-cortex-xsoar/customize-and-configure-cortex-xsoar/reports/schedule-a-report.md): Schedule Cortex XSOAR 6.14 reports with email recipients, role restrictions, start dates, and Cron expressions. - [Customize the Email When Sending a Report](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.14/customize-cortex-xsoar/customize-and-configure-cortex-xsoar/reports/customize-the-email-when-sending-a-report.md): Customize Cortex XSOAR 6.14 report email subjects, message bodies, and HTML content for scheduled delivery. - [Create an Incident Summary Report](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.14/customize-cortex-xsoar/customize-and-configure-cortex-xsoar/reports/create-an-incident-summary-report.md): Create Cortex XSOAR 6.14 incident summary reports from incident pages and save report templates. - [Select and Customize Sections to Export to a Summary Report](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.14/customize-cortex-xsoar/customize-and-configure-cortex-xsoar/reports/select-and-customize-sections-to-export-to-a-summary-report.md): Select and customize Cortex XSOAR 6.14 summary report sections, then save the report as a reusable template. - [Add a Widget to a Report](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.14/customize-cortex-xsoar/customize-and-configure-cortex-xsoar/reports/add-a-widget-to-a-report.md): Add and configure widgets in Cortex XSOAR 6.14 reports to visualize security operations data. - [Edit a report](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.14/customize-cortex-xsoar/customize-and-configure-cortex-xsoar/reports/edit-a-report.md): Edit Cortex XSOAR 6.14 report widgets, layout, and output type for custom reports. - [Change the Report Logo](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.14/customize-cortex-xsoar/customize-and-configure-cortex-xsoar/reports/change-the-report-logo.md): Add and customize a company logo in Cortex XSOAR 6.14 reports using server configuration settings. - [Configure the Time Zone and Format in a Report](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.14/customize-cortex-xsoar/customize-and-configure-cortex-xsoar/reports/configure-the-time-zone-and-format-in-a-report.md): Configure Cortex XSOAR 6.14 report time zones and date formats, and resolve related display issues. - [Troubleshoot Reports](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.14/customize-cortex-xsoar/customize-and-configure-cortex-xsoar/reports/troubleshoot-reports.md): Troubleshoot Cortex XSOAR 6.14 reports by downloading and reviewing report JSON output. - [Widgets](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.14/customize-cortex-xsoar/customize-and-configure-cortex-xsoar/widgets.md): Create, customize, and manage Cortex XSOAR 6.14 widgets for dashboards, reports, and security operations data. - [Widgets Overview](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.14/customize-cortex-xsoar/customize-and-configure-cortex-xsoar/widgets/widgets-overview.md): Explore Cortex XSOAR 6.14 widgets and learn how to create, configure, and use them in dashboards and reports. - [Create a Widget using the Widget Builder](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.14/customize-cortex-xsoar/customize-and-configure-cortex-xsoar/widgets/create-a-widget-using-the-widget-builder.md): Create Cortex XSOAR 6.14 widgets with the Widget Builder for dashboards and reports. - [Create a Custom Widget Using a JSON File](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.14/customize-cortex-xsoar/customize-and-configure-cortex-xsoar/widgets/create-a-custom-widget-using-a-json-file.md): Create custom Cortex XSOAR 6.14 widgets from JSON files for dashboards and reports. - [Create a Custom Widget Using an Automation Script](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.14/customize-cortex-xsoar/customize-and-configure-cortex-xsoar/widgets/create-a-custom-widget-using-an-automation-script.md): Create custom Cortex XSOAR 6.14 widgets with automation scripts for dashboards and reports. - [Edit a Widget](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.14/customize-cortex-xsoar/customize-and-configure-cortex-xsoar/widgets/edit-a-widget.md): Edit Cortex XSOAR 6.14 widgets in the Widgets Library, dashboards, and reports. - [Create a Used Percentage Widget for a Disk Partition](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.14/customize-cortex-xsoar/customize-and-configure-cortex-xsoar/widgets/create-a-used-percentage-widget-for-a-disk-partition.md): Create a Cortex XSOAR 6.14 disk partition usage widget with server configuration and a dashboard. - [Saved By Dbot (ROI) Widget](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.14/customize-cortex-xsoar/customize-and-configure-cortex-xsoar/widgets/saved-by-dbot-roi-widget.md): Configure the Cortex XSOAR 6.14 Saved by Dbot widget to calculate security operations return on investment. - [Manage Data](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.14/customize-cortex-xsoar/customize-and-configure-cortex-xsoar/manage-data.md): Manage Cortex XSOAR 6.14 data with reindexing, archiving, migration, storage, and restoration procedures. - [Reindex the Entire Database](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.14/customize-cortex-xsoar/customize-and-configure-cortex-xsoar/manage-data/reindex-the-entire-database.md): Reindex the entire Cortex XSOAR 6.14 database to rebuild searchable data and indexes. - [Reindex a Specific Index Database](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.14/customize-cortex-xsoar/customize-and-configure-cortex-xsoar/manage-data/reindex-a-specific-index-database.md): Reindex specific Cortex XSOAR 6.14 index databases, including multiple selected indexes. - [Reindex the Audit Log](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.14/customize-cortex-xsoar/customize-and-configure-cortex-xsoar/manage-data/reindex-the-audit-log.md): Reindex the Cortex XSOAR 6.14 audit log to restore searchable historical audit trail data. - [Free up Disk Space with Data Archiving](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.14/customize-cortex-xsoar/customize-and-configure-cortex-xsoar/manage-data/free-up-disk-space-with-data-archiving.md): Free Cortex XSOAR 6.14 disk space by archiving unused incident, entry, and indicator data. - [Archive Artifacts and Attachments](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.14/customize-cortex-xsoar/customize-and-configure-cortex-xsoar/manage-data/archive-artifacts-and-attachments.md): Archive Cortex XSOAR 6.14 artifacts and attachment folders to reduce storage use. - [Store Incident/Artifact Files in the Cloud](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.14/customize-cortex-xsoar/customize-and-configure-cortex-xsoar/manage-data/store-incidentartifact-files-in-the-cloud.md): Store Cortex XSOAR 6.14 incident attachments, artifacts, and War Room files in cloud storage. - [Migrate Data to Another Server](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.14/customize-cortex-xsoar/customize-and-configure-cortex-xsoar/manage-data/migrate-data-to-another-server.md): Migrate Cortex XSOAR 6.14 data, files, and directories to another server. - [Migrate Data to Another Server for Multi-Tenant](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.14/customize-cortex-xsoar/customize-and-configure-cortex-xsoar/manage-data/migrate-data-to-another-server-for-multi-tenant.md): Migrate Cortex XSOAR 6.14 data to another server in a multi-tenant environment. - [Move Data Folders to Another Location on the Server](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.14/customize-cortex-xsoar/customize-and-configure-cortex-xsoar/manage-data/move-data-folders-to-another-location-on-the-server.md): Move Cortex XSOAR 6.14 data folders to a different server location for storage management. - [Restore an Archived Folder](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.14/customize-cortex-xsoar/customize-and-configure-cortex-xsoar/manage-data/restore-an-archived-folder.md): Restore an archived Cortex XSOAR 6.14 data folder when access to archived data is required. - [Logs](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.14/customize-cortex-xsoar/customize-and-configure-cortex-xsoar/logs.md): Configure Cortex XSOAR 6.14 server logs, access logs, audit trails, and diagnostic log bundles. - [Logs Overview](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.14/customize-cortex-xsoar/customize-and-configure-cortex-xsoar/logs/logs-overview.md): Understand Cortex XSOAR 6.14 logs and use log data for system monitoring and troubleshooting. - [Configure the Server Log](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.14/customize-cortex-xsoar/customize-and-configure-cortex-xsoar/logs/configure-the-server-log.md): Configure Cortex XSOAR 6.14 server log levels, file sizes, backups, and retention periods. - [Configure the Access Log for HTTPS Requests](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.14/customize-cortex-xsoar/customize-and-configure-cortex-xsoar/logs/configure-the-access-log-for-https-requests.md): Configure Cortex XSOAR 6.14 access logs to view HTTP and HTTPS requests. - [Create a Log Bundle](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.14/customize-cortex-xsoar/customize-and-configure-cortex-xsoar/logs/create-a-log-bundle.md): Create a Cortex XSOAR 6.14 diagnostic log bundle for troubleshooting and support investigations. - [Audit Trail](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.14/customize-cortex-xsoar/customize-and-configure-cortex-xsoar/logs/audit-trail.md): View, export, extract, and purge Cortex XSOAR 6.14 audit trail records for administrative user actions. - [Send the Audit Trail to an External Log Service](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.14/customize-cortex-xsoar/customize-and-configure-cortex-xsoar/logs/send-the-audit-trail-to-an-external-log-service.md): Send Cortex XSOAR 6.14 audit trail records to an external log service using server configurations. - [System Settings](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.14/customize-cortex-xsoar/customize-and-configure-cortex-xsoar/system-settings.md): Configure Cortex XSOAR 6.14 branding, login messages, system emails, and notification delivery settings. - [Customize the Logo](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.14/customize-cortex-xsoar/customize-and-configure-cortex-xsoar/system-settings/customize-the-logo.md): Customize full-size and minimized logos in Cortex XSOAR 6.14. - [Customize the Login Message](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.14/customize-cortex-xsoar/customize-and-configure-cortex-xsoar/system-settings/customize-the-login-message.md): Customize the login page message displayed to Cortex XSOAR 6.14 users before authentication. - [Customize System Emails](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.14/customize-cortex-xsoar/customize-and-configure-cortex-xsoar/system-settings/customize-system-emails.md): Customize Cortex XSOAR 6.14 system email subjects and message bodies in HTML or plain-text formats. - [Configure System Notifications](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.14/customize-cortex-xsoar/customize-and-configure-cortex-xsoar/system-settings/configure-system-notifications.md): Configure Cortex XSOAR 6.14 email notifications and mail sender settings with server configurations. - [Day to Day Tasks in Cortex XSOAR](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.14/investigate-and-respond-to-threats/day-to-day-tasks-in-cortex-xsoar.md): Manage daily Cortex XSOAR 6.14 incidents and threat indicators with investigation and response workflows. - [Incident Management](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.14/investigate-and-respond-to-threats/day-to-day-tasks-in-cortex-xsoar/incident-management.md): Open, investigate, manage, and resolve security incidents in Cortex XSOAR 6.14. - [Create an Incident](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.14/investigate-and-respond-to-threats/day-to-day-tasks-in-cortex-xsoar/incident-management/create-an-incident.md): Create Cortex XSOAR 6.14 incidents manually, from feeds, or by importing JSON files. - [Create a Search Query for Incidents](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.14/investigate-and-respond-to-threats/day-to-day-tasks-in-cortex-xsoar/incident-management/create-a-search-query-for-incidents.md): Create and save Cortex XSOAR 6.14 incident search queries to filter displayed results. - [Create a Widget From an Incident](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.14/investigate-and-respond-to-threats/day-to-day-tasks-in-cortex-xsoar/incident-management/create-a-widget-from-an-incident.md): Create custom Cortex XSOAR 6.14 widgets from incident search results. - [Export an Incident to CSV Using the UTF8-BOM Format](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.14/investigate-and-respond-to-threats/day-to-day-tasks-in-cortex-xsoar/incident-management/export-an-incident-to-csv-using-the-utf8-bom-format.md): Export Cortex XSOAR 6.14 incidents to UTF-8 BOM CSV files for Cyrillic characters. - [Incident Investigation](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.14/investigate-and-respond-to-threats/day-to-day-tasks-in-cortex-xsoar/incident-management/incident-investigation.md): Open Cortex XSOAR 6.14 incidents to review details and investigate security events. - [Work Plan](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.14/investigate-and-respond-to-threats/day-to-day-tasks-in-cortex-xsoar/incident-management/work-plan.md): Monitor and manage Cortex XSOAR 6.14 incident playbook workflows in the Work Plan. - [Investigate an Incident Using the Canvas](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.14/investigate-and-respond-to-threats/day-to-day-tasks-in-cortex-xsoar/incident-management/investigate-an-incident-using-the-canvas.md): Visually map and investigate Cortex XSOAR 6.14 incident relationships with the investigation canvas. - [Auto Populate the Canvas](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.14/investigate-and-respond-to-threats/day-to-day-tasks-in-cortex-xsoar/incident-management/investigate-an-incident-using-the-canvas/auto-populate-the-canvas.md): Automatically add related Cortex XSOAR 6.14 incidents and entities to an investigation canvas. - [Dbot Suggestions: Quick View Window](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.14/investigate-and-respond-to-threats/day-to-day-tasks-in-cortex-xsoar/incident-management/investigate-an-incident-using-the-canvas/dbot-suggestions-quick-view-window.md): Review DBot incident and indicator suggestions in the Cortex XSOAR 6.14 canvas quick view. - [Edit Dbot Incident and Indicator Suggestions](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.14/investigate-and-respond-to-threats/day-to-day-tasks-in-cortex-xsoar/incident-management/investigate-an-incident-using-the-canvas/edit-dbot-incident-and-indicator-suggestions.md): Configure DBot incident and indicator suggestions for Cortex XSOAR 6.14 investigations. - [Incident Actions](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.14/investigate-and-respond-to-threats/day-to-day-tasks-in-cortex-xsoar/incident-management/incident-actions.md): Perform Cortex XSOAR 6.14 incident actions, including tasks, notes, reports, editing, and deletion. - [Evidence Handling](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.14/investigate-and-respond-to-threats/day-to-day-tasks-in-cortex-xsoar/incident-management/evidence-handling.md): Add and manage investigation evidence in the Cortex XSOAR 6.14 War Room. - [Incident Tasks](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.14/investigate-and-respond-to-threats/day-to-day-tasks-in-cortex-xsoar/incident-management/incident-tasks.md): Create and complete Cortex XSOAR 6.14 playbook and to-do tasks during investigations. - [Link Incidents](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.14/investigate-and-respond-to-threats/day-to-day-tasks-in-cortex-xsoar/incident-management/link-incidents.md): Link related Cortex XSOAR 6.14 incidents from the interface, pre-process rules, or CLI. - [Manage Related Incidents](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.14/investigate-and-respond-to-threats/day-to-day-tasks-in-cortex-xsoar/incident-management/link-incidents/manage-related-incidents.md): View and manage related incidents during Cortex XSOAR 6.14 investigations. - [Link and Unlink incidents in the CLI](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.14/investigate-and-respond-to-threats/day-to-day-tasks-in-cortex-xsoar/incident-management/link-incidents/link-and-unlink-incidents-in-the-cli.md): Link and unlink related Cortex XSOAR 6.14 incidents using the command-line interface. - [Configure Incident Fields for Related Incidents](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.14/investigate-and-respond-to-threats/day-to-day-tasks-in-cortex-xsoar/incident-management/configure-incident-fields-for-related-incidents.md): Configure related Cortex XSOAR 6.14 incident fields using allow and ignore list settings. - [Indicator Management](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.14/investigate-and-respond-to-threats/day-to-day-tasks-in-cortex-xsoar/indicator-management.md): Create, search, edit, export, and manage threat indicators in Cortex XSOAR 6.14. - [Indicator Query](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.14/investigate-and-respond-to-threats/day-to-day-tasks-in-cortex-xsoar/indicator-management/indicator-query.md): Search, create, edit, export, and delete threat indicators in Cortex XSOAR 6.14. - [Configure the Indicator Timeline](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.14/investigate-and-respond-to-threats/day-to-day-tasks-in-cortex-xsoar/indicator-management/configure-the-indicator-timeline.md): Configure the Cortex XSOAR 6.14 indicator timeline and improve timeline performance. - [Exclusion List](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.14/investigate-and-respond-to-threats/day-to-day-tasks-in-cortex-xsoar/indicator-management/exclusion-list.md): Add threat indicators to Cortex XSOAR 6.14 exclusion lists to prevent system processing. - [Export Indicators](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.14/investigate-and-respond-to-threats/day-to-day-tasks-in-cortex-xsoar/indicator-management/export-indicators.md): Export Cortex XSOAR 6.14 threat indicators as lists or files for security tools. - [Manually Export Indicators](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.14/investigate-and-respond-to-threats/day-to-day-tasks-in-cortex-xsoar/indicator-management/export-indicators/manually-export-indicators.md): Manually export Cortex XSOAR 6.14 threat indicators for external security tools. - [Export Indicators Integrations](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.14/investigate-and-respond-to-threats/day-to-day-tasks-in-cortex-xsoar/indicator-management/export-indicators/export-indicators-integrations.md): Export Cortex XSOAR 6.14 threat indicators through supported integrations. - [Export an Indicator to CSV Using the UTF8-BOM Format](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.14/investigate-and-respond-to-threats/day-to-day-tasks-in-cortex-xsoar/indicator-management/export-indicators/export-an-indicator-to-csv-using-the-utf8-bom-format.md): Export Cortex XSOAR 6.14 threat indicators to UTF-8 BOM CSV files. - [Reference](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.14/reference-docs/reference.md): Find Cortex XSOAR 6.14 reference information for configuration, diagnostics, security, and operations. - [Navigation Cheat Sheet](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.14/reference-docs/reference/navigation-cheat-sheet.md): Use the Cortex XSOAR 6.14navigation cheat sheet to access common features quickly. - [Server Configurations](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.14/reference-docs/reference/server-configurations.md): Reference Cortex XSOAR 6.14 server configurations for customization, administration, and troubleshooting. - [Modify Server Configurations](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.14/reference-docs/reference/server-configurations/modify-server-configurations.md): Modify Cortex XSOAR 6.14 server configurations for customization and troubleshooting. - [Active Directory Server Configurations](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.14/reference-docs/reference/server-configurations/active-directory-server-configurations.md): Reference Cortex XSOAR 6.14 server configurations for Active Directory authentication. - [Automation Server Configurations](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.14/reference-docs/reference/server-configurations/automation-server-configurations.md): Reference Cortex XSOAR 6.14 server configurations for automation behavior. - [Dashboard Server Configurations](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.14/reference-docs/reference/server-configurations/dashboard-server-configurations.md): Reference Cortex XSOAR 6.14 server configurations for dashboards. - [Database Server Configurations](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.14/reference-docs/reference/server-configurations/database-server-configurations.md): Server configurations for the database in Cortex XSOAR 6.14. - [Disaster Recovery Server Configurations](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.14/reference-docs/reference/server-configurations/disaster-recovery-server-configurations.md): Reference Cortex XSOAR 6.14 server configurations for disaster recovery. - [Docker Server Configurations](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.14/reference-docs/reference/server-configurations/docker-server-configurations.md): Reference Cortex XSOAR 6.14 server configurations for Docker. - [Elasticsearch Server Configurations](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.14/reference-docs/reference/server-configurations/elasticsearch-server-configurations.md): Reference Cortex XSOAR 6.14 server configurations for Elasticsearch. - [Engine Server Configurations](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.14/reference-docs/reference/server-configurations/engine-server-configurations.md): Reference Cortex XSOAR 6.14 server configurations for engines. - [General Server Configurations](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.14/reference-docs/reference/server-configurations/general-server-configurations.md): Reference general Cortex XSOAR 6.14 server configuration settings. - [Google API Server Configuration](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.14/reference-docs/reference/server-configurations/google-api-server-configuration.md): Reference Cortex XSOAR 6.14 server configuration settings for Google APIs. - [Incident Server Configurations](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.14/reference-docs/reference/server-configurations/incident-server-configurations.md): Reference Cortex XSOAR 6.14 server configurations for incident management. - [Indicator Server Configurations](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.14/reference-docs/reference/server-configurations/indicator-server-configurations.md): Server configurations for indicators in Cortex XSOAR 6.14. - [Integration Server Configurations](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.14/reference-docs/reference/server-configurations/integration-server-configurations.md): Server configurations for integrations in Cortex XSOAR 6.14. - [List Server Configurations](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.14/reference-docs/reference/server-configurations/list-server-configurations.md): Reference Cortex XSOAR 6.14 server configurations for lists. - [Logs Server Configurations](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.14/reference-docs/reference/server-configurations/logs-server-configurations.md): Server configurations for logs in Cortex XSOAR 6.14. - [Marketplace Server Configurations](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.14/reference-docs/reference/server-configurations/marketplace-server-configurations.md): Reference Cortex XSOAR 6.14 server configurations for Marketplace. - [Multi-Tenant Server Configurations](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.14/reference-docs/reference/server-configurations/multi-tenant-server-configurations.md): Server configurations for multi-tenant deployments in Cortex XSOAR 6.14. - [Notification Server Configurations](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.14/reference-docs/reference/server-configurations/notification-server-configurations.md): Reference Cortex XSOAR 6.14 server configurations for notifications. - [Playbook Server Configurations](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.14/reference-docs/reference/server-configurations/playbook-server-configurations.md): Server configurations for playbooks in Cortex XSOAR 6.14. - [Proxy Server Configurations](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.14/reference-docs/reference/server-configurations/proxy-server-configurations.md): Reference Cortex XSOAR 6.14 server configurations for proxy servers. - [Remote Repository Server Configurations](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.14/reference-docs/reference/server-configurations/remote-repository-server-configurations.md): Server configurations for remote repositories in Cortex XSOAR 6.14. - [Report Server Configurations](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.14/reference-docs/reference/server-configurations/report-server-configurations.md): Reference Cortex XSOAR 6.14 server configurations for reports. - [Security Headers Server Configurations](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.14/reference-docs/reference/server-configurations/security-headers-server-configurations.md): Reference Cortex XSOAR 6.14 server configurations for security headers. - [SLA Server Configuration](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.14/reference-docs/reference/server-configurations/sla-server-configuration.md): Server configuration for SLAs in Cortex XSOAR 6.14. - [System Diagnostics Server Configurations](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.14/reference-docs/reference/server-configurations/system-diagnostics-server-configurations.md): Reference Cortex XSOAR 6.14 server configurations for system diagnostics. - [Users and Roles Server Configurations](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.14/reference-docs/reference/server-configurations/users-and-roles-server-configurations.md): Reference Cortex XSOAR 6.14 server configurations for users and roles. - [War Room Server Configurations](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.14/reference-docs/reference/server-configurations/war-room-server-configurations.md): Server configurations for the War Room in Cortex XSOAR 6.14. - [Widget Server Configurations](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.14/reference-docs/reference/server-configurations/widget-server-configurations.md): Server configurations for widgets in Cortex XSOAR 6.14. - [System Diagnostics](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.14/reference-docs/reference/system-diagnostics.md): Monitor Cortex XSOAR 6.14 system health and resolve performance and diagnostic alerts. - [Fix System Diagnostics Issues](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.14/reference-docs/reference/system-diagnostics/fix-system-diagnostics-issues.md): Resolve Cortex XSOAR 6.14 alerts reported on the System Diagnostics page. - [Performance Tuning for Cortex XSOAR](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.14/reference-docs/reference/performance-tuning-for-cortex-xsoar.md): Tune Cortex XSOAR 6.14 performance for reliable and scalable security operations. - [Supported Ciphers](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.14/reference-docs/reference/supported-ciphers.md): Review TLS 1.2 and TLS 1.3 cipher suites supported by Cortex XSOAR 6.14 servers and engines. - [Telemetry](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.14/reference-docs/reference/telemetry.md): Configure Cortex XSOAR 6.14 telemetry collection and control product usage data sharing. - [Keyboard Shortcuts](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.14/reference-docs/reference/keyboard-shortcuts.md): Use Cortex XSOAR 6.14 keyboard shortcuts for playbooks, scripts, the CLI, and incident pages. - [Indicator Fields Structure](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.14/reference-docs/reference/indicator-fields-structure.md): Reference Cortex XSOAR 6.14 indicator field structures aligned with STIX standards. * [Navigate the Cortex XSOAR 6.13 Administrator Guide](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.13/learn-about-cortex-xsoar/readme.md): Start here for a visual overview of the main Cortex XSOAR 6.13 documentation areas. * [Overview](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.13/learn-about-cortex-xsoar/readme-1.md): Cortex XSOAR 6.13 provides security orchestration, incident management, and interactive investigation. Overview of Cortex XSOAR 6.13 features and concepts. * [Get Started in Cortex XSOAR](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.13/learn-about-cortex-xsoar/get-started-in-cortex-xsoar.md): Learn about Cortex XSOAR 6.13 concepts, licenses, and the product lifecycle, as well as basic functionality including the command line, API keys, search, CLI, etc. * [Licenses](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.13/learn-about-cortex-xsoar/get-started-in-cortex-xsoar/licenses.md): The Cortex XSOAR 6.13 license type determines which components users can utilize. License types are community, starter, or enterprise. Users include audit and full. * [FIPS Version](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.13/learn-about-cortex-xsoar/get-started-in-cortex-xsoar/fips-version.md): Cortex XSOAR 6.13 offers a FIPS version using a software library validated against FIPS 140-3. * [Concepts](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.13/learn-about-cortex-xsoar/get-started-in-cortex-xsoar/concepts.md): Cortex XSOAR 6.13 concepts, including incidents, integrations, playbokos, automations, commands, war room, indicators, playground. * [Product Support Lifecycle](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.13/learn-about-cortex-xsoar/get-started-in-cortex-xsoar/product-support-lifecycle.md): Cortex XSOAR 6.13 major releases product support lifecycle. * [API Keys](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.13/learn-about-cortex-xsoar/get-started-in-cortex-xsoar/api-keys.md): Generate and manage API keys in Cortex XSOAR 6.13. * [Use the Command Line Interface](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.13/learn-about-cortex-xsoar/get-started-in-cortex-xsoar/use-the-command-line-interface.md): Cortex XSOAR 6.13 enables you to run system commands, integration commands, automations, and more, from an integrated CLI. * [Common Arguments](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.13/learn-about-cortex-xsoar/get-started-in-cortex-xsoar/use-the-command-line-interface/common-arguments.md): Cortex XSOAR 6.13 enables you to run system commands, integration commands, automations, and more, from an integrated CLI. * [How to Search](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.13/learn-about-cortex-xsoar/get-started-in-cortex-xsoar/how-to-search.md): Search Cortex XSOAR 6.13 using Lucene query syntax, the search box, or general search. * [Using the Search Query](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.13/learn-about-cortex-xsoar/get-started-in-cortex-xsoar/how-to-search/using-the-search-query.md): Search Cortex XSOAR 6.13 using Lucene query syntax, the search box, or general search. * [How to Use Markdown](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.13/learn-about-cortex-xsoar/get-started-in-cortex-xsoar/how-to-use-markdown.md): Use markdown to add basic formatting to text in multiple contexts within Cortex XSOAR 6.13. * [New User FAQ](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.13/learn-about-cortex-xsoar/get-started-in-cortex-xsoar/new-user-faq.md): New User FAQ for Cortex XSOAR 6.13. * [Onboarding in Cortex XSOAR](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.13/onboard-cortex-xsoar/onboarding-in-cortex-xsoar.md): Onboarding process for Cortex XSOAR 6.13. * [Deployment Checklist - Best Practices](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.13/onboard-cortex-xsoar/deployment-checklist-best-practices.md): Overview of the deployment process, including best practices for Cortex XSOAR installation and maintenance. * [Single Server Deployment](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.13/onboard-cortex-xsoar/single-server-deployment.md): Install Cortex XSOAR 6.13 for a single server deployment. * [System Requirements](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.13/onboard-cortex-xsoar/single-server-deployment/system-requirements.md): Verify that your Cortex XSOAR 6.13 deployment meets the minimum system requirements. * [Deployment Guidelines](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.13/onboard-cortex-xsoar/single-server-deployment/deployment-guidelines.md): Review Cortex XSOAR 6.13 deployment guidelines for AWS EC2, Azure, or GCP. * [Install the Server for a Single Server Deployment](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.13/onboard-cortex-xsoar/single-server-deployment/install-the-server-for-a-single-server-deployment.md): Installation instructions and requirements for standard Cortex XSOAR 6.13 single server deployments, with the app server and database server on the same machine. * [Install the Server with Elasticsearch](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.13/onboard-cortex-xsoar/single-server-deployment/install-the-server-with-elasticsearch.md): Install Cortex XSOAR 6.13 with Elasticsearch as the database. Prerequisites and instructions for installing a new Cortex XSOAR 6.13 environment with Elasticsearch. * [Install the Server Offline](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.13/onboard-cortex-xsoar/single-server-deployment/install-the-server-offline.md): Install Cortex XSOAR 6.13 when you do not have internet access. Instructions for offline installation. * [Dependencies for Offline Installation](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.13/onboard-cortex-xsoar/single-server-deployment/install-the-server-offline/dependencies-for-offline-installation.md): Review required dependencies for an offline Cortex XSOAR 6.13 server or engine installation. * [Add a License](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.13/onboard-cortex-xsoar/single-server-deployment/add-a-license.md): Add a Cortex XSOAR 6.13 license file through the UI or directly on the server. * [Post-Installation Checklist](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.13/onboard-cortex-xsoar/single-server-deployment/post-installation-checklist.md): Common post-installation steps to perform after installing Cortex XSOAR 6.13. Cortex XSOAR 6.13 installation troubleshooting. * [Monitor Components](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.13/onboard-cortex-xsoar/single-server-deployment/post-installation-checklist/monitor-components.md): Monitor components in a Cortex XSOAR 6.13 single server deployment. * [HTTPS with a Signed Certificate](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.13/onboard-cortex-xsoar/single-server-deployment/post-installation-checklist/https-with-a-signed-certificate.md): Configure HTTPS with a signed certificate in Cortex XSOAR 6.13. * [Install or Renew a Custom Certificate](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.13/onboard-cortex-xsoar/single-server-deployment/post-installation-checklist/https-with-a-signed-certificate/install-or-renew-a-custom-certificate.md): Install or renew a custom certificate in Cortex XSOAR 6.13. * [Create a Self-Signed Certificate](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.13/onboard-cortex-xsoar/single-server-deployment/post-installation-checklist/https-with-a-signed-certificate/create-a-self-signed-certificate.md): Create a self-signed certificate for Cortex XSOAR 6.13. * [Configure the Server to Listen on HTTP](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.13/onboard-cortex-xsoar/single-server-deployment/post-installation-checklist/configure-the-server-to-listen-on-http.md): Configure a Cortex XSOAR 6.13 server to listen on HTTP. * [Troubleshoot WebSockets](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.13/onboard-cortex-xsoar/single-server-deployment/post-installation-checklist/troubleshoot-websockets.md): Troubleshoot WebSocket connectivity in Cortex XSOAR 6.13. * [Upgrade the Cortex XSOAR Server](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.13/onboard-cortex-xsoar/single-server-deployment/upgrade-the-cortex-xsoar-server.md): Upgrade the Cortex XSOAR 6.13 server, including preparation, upgrade, and post-upgrade steps. * [Uninstall the Server](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.13/onboard-cortex-xsoar/single-server-deployment/uninstall-the-server.md): Uninstall Cortex XSOAR 6.13. Configuration files and files created by engines are not removed. * [Elasticsearch](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.13/onboard-cortex-xsoar/elasticsearch.md): Implement Cortex XSOAR 6.13 with Elasticsearch for setup, security, migration, and troubleshooting. * [Elasticsearch Overview](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.13/onboard-cortex-xsoar/elasticsearch/elasticsearch-overview.md): Migrate Cortex XSOAR 6.13 data to Elasticsearch. Object information in an existing Cortex XSOAR 6.13 instance is copied to a designated Elasticsearch index. * [Elasticsearch Setup](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.13/onboard-cortex-xsoar/elasticsearch/elasticsearch-setup.md): Elasticsearch best practices, sizing requirements, and configuration options for Cortex XSOAR 6.13. * [Elasticsearch System Requirements](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.13/onboard-cortex-xsoar/elasticsearch/elasticsearch-setup/elasticsearch-system-requirements.md): Review Elasticsearch system requirements for Cortex XSOAR 6.13. * [Elasticsearch Configurations](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.13/onboard-cortex-xsoar/elasticsearch/elasticsearch-setup/elasticsearch-configurations.md): Configure Elasticsearch for a Cortex XSOAR 6.13 deployment. * [Elasticsearch Data Management](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.13/onboard-cortex-xsoar/elasticsearch/elasticsearch-setup/elasticsearch-data-management.md): Manage Elasticsearch data in Cortex XSOAR 6.13. * [Elasticsearch Security](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.13/onboard-cortex-xsoar/elasticsearch/elasticsearch-security.md): Elasticsearch security and best practices guidelines for Cortex XSOAR 6.13 single server and multi-tenant deployments. * [Elasticsearch General Security Guidelines](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.13/onboard-cortex-xsoar/elasticsearch/elasticsearch-security/elasticsearch-general-security-guidelines.md): Apply general Elasticsearch security guidelines for Cortex XSOAR 6.13. * [Elasticsearch Security Guidelines - Multi-tenant Deployments](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.13/onboard-cortex-xsoar/elasticsearch/elasticsearch-security/elasticsearch-security-guidelines-multi-tenant-deployments.md): Apply Elasticsearch security guidelines for Cortex XSOAR 6.13 multi-tenant deployments. * [Migration](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.13/onboard-cortex-xsoar/elasticsearch/migration.md): Learn about migrating Cortex XSOAR 6.13 data to Elasticsearch for a single server or multi-tenant environment. * [Elasticsearch Migration Overview](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.13/onboard-cortex-xsoar/elasticsearch/migration/elasticsearch-migration-overview.md): Review Elasticsearch migration options for Cortex XSOAR 6.13. * [Migrate Objects to Elasticsearch for a Single Server](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.13/onboard-cortex-xsoar/elasticsearch/migration/migrate-objects-to-elasticsearch-for-a-single-server.md): Migrate objects to Elasticsearch for a Cortex XSOAR 6.13 single server. * [Migrate Objects to Elasticsearch for Multi-Tenant](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.13/onboard-cortex-xsoar/elasticsearch/migration/migrate-objects-to-elasticsearch-for-multi-tenant.md): Migrate objects to Elasticsearch for Cortex XSOAR 6.13 multi-tenant deployments. * [Migrate an Existing Elasticsearch Deployment](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.13/onboard-cortex-xsoar/elasticsearch/migration/migrate-an-existing-elasticsearch-deployment.md): Migrate an existing Elasticsearch deployment to Cortex XSOAR 6.13. * [Migrate Objects to Elasticsearch for a Distributed Database](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.13/onboard-cortex-xsoar/elasticsearch/migration/migrate-objects-to-elasticsearch-for-a-distributed-database.md): Migrate objects to Elasticsearch for a Cortex XSOAR 6.13 distributed database. * [Manage Partial Migration to Elasticsearch](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.13/onboard-cortex-xsoar/elasticsearch/migration/manage-partial-migration-to-elasticsearch.md): Manage a partial Elasticsearch migration in Cortex XSOAR 6.13. * [Validate the Migration to Elasticsearch](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.13/onboard-cortex-xsoar/elasticsearch/migration/validate-the-migration-to-elasticsearch.md): Validate an Elasticsearch migration in Cortex XSOAR 6.13. * [Elasticsearch Post Migration Health Check](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.13/onboard-cortex-xsoar/elasticsearch/migration/elasticsearch-post-migration-health-check.md): Perform an Elasticsearch post-migration health check in Cortex XSOAR 6.13. * [Disaster Recovery for Elasticsearch](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.13/onboard-cortex-xsoar/elasticsearch/disaster-recovery-for-elasticsearch.md): Back up and restore a Cortex XSOAR 6.13 Elasticsearch deployment using snapshots. * [Create Elasticsearch Snapshots](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.13/onboard-cortex-xsoar/elasticsearch/disaster-recovery-for-elasticsearch/create-elasticsearch-snapshots.md): Create Elasticsearch snapshots for Cortex XSOAR 6.13 disaster recovery. * [Restore Elasticsearch Snapshots](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.13/onboard-cortex-xsoar/elasticsearch/disaster-recovery-for-elasticsearch/restore-elasticsearch-snapshots.md): Restore Elasticsearch snapshots for Cortex XSOAR 6.13 disaster recovery. * [Archive Data with Elasticsearch](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.13/onboard-cortex-xsoar/elasticsearch/archive-data-with-elasticsearch.md): Archive Cortex XSOAR 6.13 data using Elasticsearch index lifecycle management. * [Troubleshoot Elasticsearch](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.13/onboard-cortex-xsoar/elasticsearch/troubleshoot-elasticsearch.md): Troubleshoot common issues in Cortex XSOAR 6.13 Elasticsearch deployments. * [Docker](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.13/onboard-cortex-xsoar/docker.md): Cortex XSOAR 6.13 Docker installation, configuration, security, and troubleshooting guides. * [Docker Overview](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.13/onboard-cortex-xsoar/docker/docker-overview.md): Overview of how Cortex XSOAR 6.13 uses Docker for security and predictability. * [Docker Installation](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.13/onboard-cortex-xsoar/docker/docker-installation.md): Install Docker for Cortex XSOAR 6.13 on Enterprise Linux platforms and troubleshoot installation. * [Configure Python Docker Integrations to Trust Custom Certificates](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.13/onboard-cortex-xsoar/docker/configure-python-docker-integrations-to-trust-custom-certificates.md): Configure CA-signed and custom certificates for Docker. Trust custom certificates for Python integrations in Cortex XSOAR 6.13. * [Docker Images in Cortex XSOAR](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.13/onboard-cortex-xsoar/docker/docker-images-in-cortex-xsoar.md): Use Docker to run Python scripts and integrations in a controlled environment in Cortex XSOAR 6.13. * [Create a Docker Image In Cortex XSOAR](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.13/onboard-cortex-xsoar/docker/docker-images-in-cortex-xsoar/create-a-docker-image-in-cortex-xsoar.md): Create a Docker image for Cortex XSOAR 6.13. * [Install Docker Images Offline](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.13/onboard-cortex-xsoar/docker/docker-images-in-cortex-xsoar/install-docker-images-offline.md): Install Docker images offline for Cortex XSOAR 6.13. * [Docker Image Security](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.13/onboard-cortex-xsoar/docker/docker-images-in-cortex-xsoar/docker-image-security.md): Secure Docker images used by Cortex XSOAR 6.13. * [Manage Docker Images](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.13/onboard-cortex-xsoar/docker/docker-images-in-cortex-xsoar/manage-docker-images.md): Manage Docker images in Cortex XSOAR 6.13. * [Change the Docker Image for Automations and Integrations](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.13/onboard-cortex-xsoar/docker/docker-images-in-cortex-xsoar/change-the-docker-image-for-automations-and-integrations.md): Change Docker images for Cortex XSOAR 6.13 automations and integrations. * [Use the Cortex XSOAR Container Registry](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.13/onboard-cortex-xsoar/docker/docker-images-in-cortex-xsoar/use-the-cortex-xsoar-container-registry.md): Use the Cortex XSOAR 6.13 container registry. * [Docker Hardening Guide](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.13/onboard-cortex-xsoar/docker/docker-hardening-guide.md): Use the Docker Hardening Guide to configure Cortex XSOAR 6.13 settings when running Docker containers. * [Run Docker with Non-Root Internal Users](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.13/onboard-cortex-xsoar/docker/docker-hardening-guide/run-docker-with-non-root-internal-users.md): Run Docker with non-root internal users in Cortex XSOAR 6.13. * [Configure Memory Limit Support Without Swap Limit Capabilities](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.13/onboard-cortex-xsoar/docker/docker-hardening-guide/configure-memory-limit-support-without-swap-limit-capabilities.md): Configure Docker memory limit support for Cortex XSOAR 6.13 without swap limits. * [Configure the Memory Limitation](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.13/onboard-cortex-xsoar/docker/docker-hardening-guide/configure-the-memory-limitation.md): Configure Docker memory limits in Cortex XSOAR 6.13. * [Test the Memory Limit](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.13/onboard-cortex-xsoar/docker/docker-hardening-guide/test-the-memory-limit.md): Test Docker memory limits in Cortex XSOAR 6.13. * [Limit Available CPU](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.13/onboard-cortex-xsoar/docker/docker-hardening-guide/limit-available-cpu.md): Limit Docker CPU resources in Cortex XSOAR 6.13. * [Configure the PIDs Limit](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.13/onboard-cortex-xsoar/docker/docker-hardening-guide/configure-the-pids-limit.md): Configure Docker process limits in Cortex XSOAR 6.13. * [Configure the Open File Descriptors Limit](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.13/onboard-cortex-xsoar/docker/docker-hardening-guide/configure-the-open-file-descriptors-limit.md): Configure Docker open file descriptor limits in Cortex XSOAR 6.13. * [Docker Network Hardening](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.13/onboard-cortex-xsoar/docker/docker-hardening-guide/docker-network-hardening.md): Harden Docker networking for Cortex XSOAR 6.13. * [Docker FAQs](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.13/onboard-cortex-xsoar/docker/docker-faqs.md): Frequently asked questions about Docker in Cortex XSOAR 6.13. * [Troubleshoot Docker Networking Issues](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.13/onboard-cortex-xsoar/docker/troubleshoot-docker-networking-issues.md): Troubleshoot Docker networking issues in Cortex XSOAR 6.13. * [Troubleshoot Docker Performance Issues](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.13/onboard-cortex-xsoar/docker/troubleshoot-docker-performance-issues.md): Troubleshoot Docker performance issues in Cortex XSOAR 6.13. Update Docker packages and dependencies. * [Configure Docker Pull Rate Limit](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.13/onboard-cortex-xsoar/docker/configure-docker-pull-rate-limit.md): Configure Docker pull rate limits on public images in Cortex XSOAR 6.13. * [Change the Docker Installation Folder](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.13/onboard-cortex-xsoar/docker/change-the-docker-installation-folder.md): Change the default Docker installation folder for Cortex XSOAR 6.13. * [Podman](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.13/onboard-cortex-xsoar/podman.md): Run Podman containers instead of Docker on RHEL v8 in Cortex XSOAR 6.13. * [Podman Overview](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.13/onboard-cortex-xsoar/podman/podman-overview.md): Run Podman containers instead of Docker on RHEL v8 in Cortex XSOAR 6.13. * [Change container storage directory](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.13/onboard-cortex-xsoar/podman/change-container-storage-directory.md): Change the Podman container storage directory in Cortex XSOAR 6.13. * [Podman Installation](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.13/onboard-cortex-xsoar/podman/podman-installation.md): Install Podman in Cortex XSOAR 6.13. * [Configure the SELinux Policy for PowerShell Integrations](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.13/onboard-cortex-xsoar/podman/configure-the-selinux-policy-for-powershell-integrations.md): Configure the SELinux policy for PowerShell integrations in Cortex XSOAR 6.13. * [Migrate From Docker to Podman](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.13/onboard-cortex-xsoar/podman/migrate-from-docker-to-podman.md): Migrate from Docker to Podman in Cortex XSOAR 6.13 on RHEL 8 or later. * [Troubleshoot Podman](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.13/onboard-cortex-xsoar/podman/troubleshoot-podman.md): Troubleshoot Podman in Cortex XSOAR 6.13. * [Proxy](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.13/onboard-cortex-xsoar/proxy.md): Configure proxy settings in Cortex XSOAR 6.13. * [Configure Proxy Settings](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.13/onboard-cortex-xsoar/proxy/configure-proxy-settings.md): Configure global proxy settings in Cortex XSOAR 6.13 using a server configuration. * [Configure how to bypass proxy settings](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.13/onboard-cortex-xsoar/proxy/configure-how-to-bypass-proxy-settings.md): Configure proxy bypass settings in Cortex XSOAR 6.13 using a server configuration. * [Use NGINX as a Reverse Proxy to the Server](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.13/onboard-cortex-xsoar/proxy/use-nginx-as-a-reverse-proxy-to-the-server.md): Use NGINX as a reverse proxy for the Cortex XSOAR 6.13 server. * [High Availability](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.13/onboard-cortex-xsoar/high-availability.md): Configure high availability in Cortex XSOAR 6.13 using Elasticsearch, additional app servers, and signed certificates. * [High Availability Overview](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.13/onboard-cortex-xsoar/high-availability/high-availability-overview.md): Review high availability deployment architectures in Cortex XSOAR 6.13. * [Set Up High Availability](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.13/onboard-cortex-xsoar/high-availability/set-up-high-availability.md): Set up high availability for Cortex XSOAR 6.13. * [Sizing Requirements for High Availability Deployments](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.13/onboard-cortex-xsoar/high-availability/sizing-requirements-for-high-availability-deployments.md): Review sizing requirements for Cortex XSOAR 6.13 high availability deployments. * [Monitor the Health of the App Servers](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.13/onboard-cortex-xsoar/high-availability/monitor-the-health-of-the-app-servers.md): Monitor app server health in a Cortex XSOAR 6.13 high availability environment. * [Migrate a Single Instance for High Availability](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.13/onboard-cortex-xsoar/high-availability/migrate-a-single-instance-for-high-availability.md): Migrate a Cortex XSOAR 6.13 single-instance deployment for high availability. * [Migrate a Multi-Tenant Deployment for High Availability](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.13/onboard-cortex-xsoar/high-availability/migrate-a-multi-tenant-deployment-for-high-availability.md): Migrate a Cortex XSOAR 6.13 multi-tenant deployment for high availability. * [Install Additional App Servers](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.13/onboard-cortex-xsoar/high-availability/install-additional-app-servers.md): Install additional app servers for Cortex XSOAR 6.13 high availability. * [Deploy Engines in a High Availability Environment](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.13/onboard-cortex-xsoar/high-availability/deploy-engines-in-a-high-availability-environment.md): Deploy engines in a Cortex XSOAR 6.13 high availability environment. * [Use a Signed Certificate](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.13/onboard-cortex-xsoar/high-availability/use-a-signed-certificate.md): Use a signed certificate in a Cortex XSOAR 6.13 high availability deployment. * [Disaster Recovery and Live Backup](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.13/onboard-cortex-xsoar/disaster-recovery-and-live-backup.md): Configure live backup and disaster recovery in Cortex XSOAR 6.13. * [Disaster Recovery and Live Backup Overview](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.13/onboard-cortex-xsoar/disaster-recovery-and-live-backup/disaster-recovery-and-live-backup-overview.md): Review live backup and disaster recovery options in Cortex XSOAR 6.13. * [Host Names, DNS, and Disaster Recovery](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.13/onboard-cortex-xsoar/disaster-recovery-and-live-backup/host-names-dns-and-disaster-recovery.md): Configure host names and DNS for Cortex XSOAR 6.13 disaster recovery. * [Configure the Live Backup Environment](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.13/onboard-cortex-xsoar/disaster-recovery-and-live-backup/configure-the-live-backup-environment.md): Configure a live backup environment in Cortex XSOAR 6.13. * [Configure Live Backup for Multiple SAMLs](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.13/onboard-cortex-xsoar/disaster-recovery-and-live-backup/configure-the-live-backup-environment/configure-live-backup-for-multiple-samls.md): Configure live backup for multiple SAMLs in Cortex XSOAR 6.13. * [DR Scenario: Testing the DR Environment](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.13/onboard-cortex-xsoar/disaster-recovery-and-live-backup/configure-the-live-backup-environment/dr-scenario-testing-the-dr-environment.md): Test a disaster recovery environment in Cortex XSOAR 6.13. * [DR Scenario: Unrecoverable Active Server Failure](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.13/onboard-cortex-xsoar/disaster-recovery-and-live-backup/configure-the-live-backup-environment/dr-scenario-unrecoverable-active-server-failure.md): Recover from an active server failure in Cortex XSOAR 6.13. * [DR Scenario: Unrecoverable Standby Server Failure](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.13/onboard-cortex-xsoar/disaster-recovery-and-live-backup/configure-the-live-backup-environment/dr-scenario-unrecoverable-standby-server-failure.md): Recover from a standby server failure in Cortex XSOAR 6.13. * [Transition an Active Server to Standby Mode](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.13/onboard-cortex-xsoar/disaster-recovery-and-live-backup/transition-an-active-server-to-standby-mode.md): Transition an active server to standby mode in Cortex XSOAR 6.13. * [Transition a Standby Server to Active Mode](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.13/onboard-cortex-xsoar/disaster-recovery-and-live-backup/transition-a-standby-server-to-active-mode.md): Transition a standby server to active mode in Cortex XSOAR 6.13. * [Transition Between DR States Through the Configuration File](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.13/onboard-cortex-xsoar/disaster-recovery-and-live-backup/transition-between-dr-states-through-the-configuration-file.md): Transition disaster recovery states through configuration in Cortex XSOAR 6.13. * [Upgrade the Live Backup Environment](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.13/onboard-cortex-xsoar/disaster-recovery-and-live-backup/upgrade-the-live-backup-environment.md): Upgrade the live backup environment for Cortex XSOAR 6.13. * [Engines and Disaster Recovery Troubleshooting](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.13/onboard-cortex-xsoar/disaster-recovery-and-live-backup/engines-and-disaster-recovery-troubleshooting.md): Troubleshoot engine failover during Cortex XSOAR 6.13 disaster recovery. * [Back up the Database](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.13/onboard-cortex-xsoar/disaster-recovery-and-live-backup/back-up-the-database.md): Back up the Cortex XSOAR 6.13 database manually or automatically. * [Restore the Database](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.13/onboard-cortex-xsoar/disaster-recovery-and-live-backup/restore-the-database.md): Restore the database from a backup in Cortex XSOAR 6.13. * [Restore a Partition](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.13/onboard-cortex-xsoar/disaster-recovery-and-live-backup/restore-a-partition.md): Restore database partitions in Cortex XSOAR 6.13. * [Troubleshoot Live Backup](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.13/onboard-cortex-xsoar/disaster-recovery-and-live-backup/troubleshoot-live-backup.md): Troubleshoot live backup scenarios in Cortex XSOAR 6.13. * [Users and Roles](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.13/onboard-cortex-xsoar/users-and-roles.md): Manage users, roles, permissions, and authentication in Cortex XSOAR 6.13. * [Users and Roles Overview](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.13/onboard-cortex-xsoar/users-and-roles/users-and-roles-overview.md): Review user, role, invitation, and password policy management in Cortex XSOAR 6.13. * [Roles in Cortex XSOAR](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.13/onboard-cortex-xsoar/users-and-roles/roles-in-cortex-xsoar.md): Configure user roles and access levels in Cortex XSOAR 6.13. * [Pre-set Query per Role](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.13/onboard-cortex-xsoar/users-and-roles/roles-in-cortex-xsoar/pre-set-query-per-role.md): Configure pre-set queries for roles in Cortex XSOAR 6.13. * [Define a Role](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.13/onboard-cortex-xsoar/users-and-roles/roles-in-cortex-xsoar/define-a-role.md): Define a user role in Cortex XSOAR 6.13. * [Role-based Permission Levels](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.13/onboard-cortex-xsoar/users-and-roles/roles-in-cortex-xsoar/role-based-permission-levels.md): Configure role-based permission levels in Cortex XSOAR 6.13. * [Shift Management](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.13/onboard-cortex-xsoar/users-and-roles/roles-in-cortex-xsoar/shift-management.md): Manage user shifts in Cortex XSOAR 6.13. * [Managing Shifts](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.13/onboard-cortex-xsoar/users-and-roles/roles-in-cortex-xsoar/shift-management/managing-shifts.md): Create and manage shifts in Cortex XSOAR 6.13. * [User Management](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.13/onboard-cortex-xsoar/users-and-roles/user-management.md): Invite and manage users in Cortex XSOAR 6.13. * [User Invitations](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.13/onboard-cortex-xsoar/users-and-roles/user-management/user-invitations.md): Manage user invitations in Cortex XSOAR 6.13. * [Invite a User](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.13/onboard-cortex-xsoar/users-and-roles/user-management/user-invitations/invite-a-user.md): Invite a user to Cortex XSOAR 6.13. * [Set the User as Default Administrator](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.13/onboard-cortex-xsoar/users-and-roles/user-management/set-the-user-as-default-administrator.md): Set a user as the default administrator in Cortex XSOAR 6.13. * [Self-Service Read-Only Users](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.13/onboard-cortex-xsoar/users-and-roles/user-management/self-service-read-only-users.md): Configure self-service read-only users in Cortex XSOAR 6.13. * [Configure the Server for Self-Service Read-Only Users](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.13/onboard-cortex-xsoar/users-and-roles/user-management/self-service-read-only-users/configure-the-server-for-self-service-read-only-users.md): Configure the server for self-service read-only users in Cortex XSOAR 6.13. * [Create the Self-Service Read-Only Users](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.13/onboard-cortex-xsoar/users-and-roles/user-management/self-service-read-only-users/create-the-self-service-read-only-users.md): Create self-service read-only users in Cortex XSOAR 6.13. * [Create the Read-Only Dashboard](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.13/onboard-cortex-xsoar/users-and-roles/user-management/self-service-read-only-users/create-the-read-only-dashboard.md): Create a read-only dashboard in Cortex XSOAR 6.13. * [Create the Read-Only Incident Type and Layout](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.13/onboard-cortex-xsoar/users-and-roles/user-management/self-service-read-only-users/create-the-read-only-incident-type-and-layout.md): Create a read-only incident type and layout in Cortex XSOAR 6.13. * [Disable a User](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.13/onboard-cortex-xsoar/users-and-roles/user-management/disable-a-user.md): Disable a user in Cortex XSOAR 6.13. * [Remove a User](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.13/onboard-cortex-xsoar/users-and-roles/user-management/remove-a-user.md): Remove a user from Cortex XSOAR 6.13. * [Clear Users Data Using the CLI](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.13/onboard-cortex-xsoar/users-and-roles/user-management/clear-users-data-using-the-cli.md): Clear user data using the CLI in Cortex XSOAR 6.13. * [Clear Users Data Using a Playbook](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.13/onboard-cortex-xsoar/users-and-roles/user-management/clear-users-data-using-a-playbook.md): Clear user data using a playbook in Cortex XSOAR 6.13. * [Configure Users Data Using Server Configurations](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.13/onboard-cortex-xsoar/users-and-roles/user-management/configure-users-data-using-server-configurations.md): Configure user data using server configurations in Cortex XSOAR 6.13. * [User Settings and Preferences](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.13/onboard-cortex-xsoar/users-and-roles/user-management/user-settings-and-preferences.md): Manage user settings and preferences in Cortex XSOAR 6.13. * [Configure User Settings](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.13/onboard-cortex-xsoar/users-and-roles/user-management/configure-user-settings.md): Configure user settings in Cortex XSOAR 6.13. * [Manually Refresh the Number of Licenses in Use](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.13/onboard-cortex-xsoar/users-and-roles/user-management/manually-refresh-the-number-of-licenses-in-use.md): Refresh the number of licenses in use in Cortex XSOAR 6.13. * [Integration Permissions](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.13/onboard-cortex-xsoar/users-and-roles/integration-permissions.md): Configure integration command permissions in Cortex XSOAR 6.13. * [Password Policy](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.13/onboard-cortex-xsoar/users-and-roles/password-policy.md): Configure password policies in Cortex XSOAR 6.13. * [Create a Password Policy](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.13/onboard-cortex-xsoar/users-and-roles/password-policy/create-a-password-policy.md): Create a password policy in Cortex XSOAR 6.13. * [Edit a Default Password Policy](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.13/onboard-cortex-xsoar/users-and-roles/password-policy/edit-a-default-password-policy.md): Edit the default password policy in Cortex XSOAR 6.13. * [Default Password Policy Keys](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.13/onboard-cortex-xsoar/users-and-roles/password-policy/edit-a-default-password-policy/default-password-policy-keys.md): Review default password policy keys in Cortex XSOAR 6.13. * [Change the Administrator Password](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.13/onboard-cortex-xsoar/users-and-roles/change-the-administrator-password.md): Change the administrator password in Cortex XSOAR 6.13. * [Authenticate Users with SAML 2.0](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.13/onboard-cortex-xsoar/users-and-roles/authenticate-users-with-saml-2.0.md): Authenticate users with SAML 2.0 in Cortex XSOAR 6.13. * [Set up Okta as the Identity Provider Using SAML 2.0](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.13/onboard-cortex-xsoar/users-and-roles/authenticate-users-with-saml-2.0/set-up-okta-as-the-identity-provider-using-saml-2.0.md): Set up Okta as a SAML 2.0 identity provider in Cortex XSOAR 6.13. * [Create Okta Groups for Cortex XSOAR Users](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.13/onboard-cortex-xsoar/users-and-roles/authenticate-users-with-saml-2.0/set-up-okta-as-the-identity-provider-using-saml-2.0/create-okta-groups-for-cortex-xsoar-users.md): Create Okta groups for Cortex XSOAR 6.13 users. * [Define the Okta Application to authenticate Cortex XSOAR](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.13/onboard-cortex-xsoar/users-and-roles/authenticate-users-with-saml-2.0/set-up-okta-as-the-identity-provider-using-saml-2.0/define-the-okta-application-to-authenticate-cortex-xsoar.md): Define an Okta application to authenticate Cortex XSOAR 6.13. * [SAML Settings for the Okta Application](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.13/onboard-cortex-xsoar/users-and-roles/authenticate-users-with-saml-2.0/set-up-okta-as-the-identity-provider-using-saml-2.0/define-the-okta-application-to-authenticate-cortex-xsoar/saml-settings-for-the-okta-application.md): Configure SAML settings for an Okta application in Cortex XSOAR 6.13. * [Configure the SAML 2.0 Integration for Okta](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.13/onboard-cortex-xsoar/users-and-roles/authenticate-users-with-saml-2.0/set-up-okta-as-the-identity-provider-using-saml-2.0/configure-the-saml-2.0-integration-for-okta.md): Configure the SAML 2.0 integration for Okta in Cortex XSOAR 6.13. * [SAML 2.0 Okta Parameters](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.13/onboard-cortex-xsoar/users-and-roles/authenticate-users-with-saml-2.0/set-up-okta-as-the-identity-provider-using-saml-2.0/configure-the-saml-2.0-integration-for-okta/saml-2.0-okta-parameters.md): Configure SAML 2.0 Okta parameters in Cortex XSOAR 6.13. * [Map Okta Groups to Cortex XSOAR Roles](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.13/onboard-cortex-xsoar/users-and-roles/authenticate-users-with-saml-2.0/set-up-okta-as-the-identity-provider-using-saml-2.0/map-okta-groups-to-cortex-xsoar-roles.md): Map Okta groups to Cortex XSOAR 6.13 roles. * [Set Up Microsoft Entra ID as the Identity Provider Using SAML 2.0](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.13/onboard-cortex-xsoar/users-and-roles/authenticate-users-with-saml-2.0/set-up-microsoft-entra-id-as-the-identity-provider-using-saml-2.0.md): Set up Microsoft Entra ID as a SAML 2.0 identity provider in Cortex XSOAR 6.13. * [Configure Microsoft Entra ID to Authenticate Cortex XSOAR](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.13/onboard-cortex-xsoar/users-and-roles/authenticate-users-with-saml-2.0/set-up-microsoft-entra-id-as-the-identity-provider-using-saml-2.0/configure-microsoft-entra-id-to-authenticate-cortex-xsoar.md): Configure Microsoft Entra ID to authenticate Cortex XSOAR 6.13. * [Configure the SAML 2.0 Integration for Microsoft Entra ID](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.13/onboard-cortex-xsoar/users-and-roles/authenticate-users-with-saml-2.0/set-up-microsoft-entra-id-as-the-identity-provider-using-saml-2.0/configure-the-saml-2.0-integration-for-microsoft-entra-id.md): Configure the SAML 2.0 integration for Microsoft Entra ID in Cortex XSOAR 6.13. * [SAML 2.0 Microsoft Entra ID Parameters](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.13/onboard-cortex-xsoar/users-and-roles/authenticate-users-with-saml-2.0/set-up-microsoft-entra-id-as-the-identity-provider-using-saml-2.0/configure-the-saml-2.0-integration-for-microsoft-entra-id/saml-2.0-microsoft-entra-id-parameters.md): Configure SAML 2.0 Microsoft Entra ID parameters in Cortex XSOAR 6.13. * [Set up ADFS as the Identity Provider Using SAML 2.0](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.13/onboard-cortex-xsoar/users-and-roles/authenticate-users-with-saml-2.0/set-up-adfs-as-the-identity-provider-using-saml-2.0.md): Set up ADFS as a SAML 2.0 identity provider in Cortex XSOAR 6.13. * [Create Relying Party Trust in ADFS](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.13/onboard-cortex-xsoar/users-and-roles/authenticate-users-with-saml-2.0/set-up-adfs-as-the-identity-provider-using-saml-2.0/create-relying-party-trust-in-adfs.md): Create a relying party trust in ADFS for Cortex XSOAR 6.13. * [Define the Claim Issuance Policy](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.13/onboard-cortex-xsoar/users-and-roles/authenticate-users-with-saml-2.0/set-up-adfs-as-the-identity-provider-using-saml-2.0/define-the-claim-issuance-policy.md): Define a claim issuance policy for Cortex XSOAR 6.13. * [Configure the SAML 2.0 Integration for ADFS](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.13/onboard-cortex-xsoar/users-and-roles/authenticate-users-with-saml-2.0/set-up-adfs-as-the-identity-provider-using-saml-2.0/configure-the-saml-2.0-integration-for-adfs.md): Configure the SAML 2.0 integration for ADFS in Cortex XSOAR 6.13. * [SAML 2.0 ADFS Parameters](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.13/onboard-cortex-xsoar/users-and-roles/authenticate-users-with-saml-2.0/set-up-adfs-as-the-identity-provider-using-saml-2.0/configure-the-saml-2.0-integration-for-adfs/saml-2.0-adfs-parameters.md): Configure SAML 2.0 ADFS parameters in Cortex XSOAR 6.13. * [Map ADFS Groups to Cortex XSOAR Roles](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.13/onboard-cortex-xsoar/users-and-roles/authenticate-users-with-saml-2.0/set-up-adfs-as-the-identity-provider-using-saml-2.0/map-adfs-groups-to-cortex-xsoar-roles.md): Map ADFS groups to Cortex XSOAR 6.13 roles. * [Duo for Single Sign-On](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.13/onboard-cortex-xsoar/users-and-roles/authenticate-users-with-saml-2.0/duo-for-single-sign-on.md): Configure Duo single sign-on in Cortex XSOAR 6.13. * [Create Duo Groups for Cortex XSOAR Users](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.13/onboard-cortex-xsoar/users-and-roles/authenticate-users-with-saml-2.0/duo-for-single-sign-on/create-duo-groups-for-cortex-xsoar-users.md): Create Duo groups for Cortex XSOAR 6.13 users. * [Define Duo to authenticate Cortex XSOAR](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.13/onboard-cortex-xsoar/users-and-roles/authenticate-users-with-saml-2.0/duo-for-single-sign-on/define-duo-to-authenticate-cortex-xsoar.md): Define Duo to authenticate Cortex XSOAR 6.13. * [Configure the SAML 2.0 Integration for Duo](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.13/onboard-cortex-xsoar/users-and-roles/authenticate-users-with-saml-2.0/duo-for-single-sign-on/configure-the-saml-2.0-integration-for-duo.md): Configure the SAML 2.0 integration for Duo in Cortex XSOAR 6.13. * [Map Duo Groups to Cortex XSOAR Roles](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.13/onboard-cortex-xsoar/users-and-roles/authenticate-users-with-saml-2.0/duo-for-single-sign-on/map-duo-groups-to-cortex-xsoar-roles.md): Map Duo groups to Cortex XSOAR 6.13 roles. * [Set the Default Theme for New Users](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.13/onboard-cortex-xsoar/users-and-roles/set-the-default-theme-for-new-users.md): Set the default theme for new users in Cortex XSOAR 6.13. * [Authenticate Users with Active Directory](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.13/onboard-cortex-xsoar/users-and-roles/authenticate-users-with-active-directory.md): Authenticate users with Active Directory in Cortex XSOAR 6.13. * [Marketplace](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.13/onboard-cortex-xsoar/marketplace.md): Access Marketplace content packs in Cortex XSOAR 6.13. * [Marketplace Overview](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.13/onboard-cortex-xsoar/marketplace/marketplace-overview.md): Use Marketplace to manage content in Cortex XSOAR 6.13. * [Content Packs Support Types](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.13/onboard-cortex-xsoar/marketplace/content-packs-support-types.md): Review Marketplace content pack support types in Cortex XSOAR 6.13. * [Marketplace FAQs](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.13/onboard-cortex-xsoar/marketplace/marketplace-faqs.md): Find Marketplace content pack answers for Cortex XSOAR 6.13. * [Search and Navigate in the Marketplace](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.13/onboard-cortex-xsoar/marketplace/search-and-navigate-in-the-marketplace.md): Search Marketplace content in Cortex XSOAR 6.13. * [Convert Existing Content to Content Pack Format](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.13/onboard-cortex-xsoar/marketplace/convert-existing-content-to-content-pack-format.md): Convert existing content to content packs in Cortex XSOAR 6.13. * [Use Cases](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.13/onboard-cortex-xsoar/marketplace/use-cases.md): Explore Marketplace use cases in Cortex XSOAR 6.13. * [Content Pack Installation](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.13/onboard-cortex-xsoar/marketplace/content-pack-installation.md): Install and manage content packs in Cortex XSOAR 6.13. * [Install a Content Pack](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.13/onboard-cortex-xsoar/marketplace/content-pack-installation/install-a-content-pack.md): Install Marketplace content packs in Cortex XSOAR 6.13. * [Set up Your Use Case with the Deployment Wizard](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.13/onboard-cortex-xsoar/marketplace/content-pack-installation/install-a-content-pack/set-up-your-use-case-with-the-deployment-wizard.md): Configure a content pack with Deployment Wizard in Cortex XSOAR 6.13. * [Update a Content Pack](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.13/onboard-cortex-xsoar/marketplace/content-pack-installation/update-a-content-pack.md): Update Marketplace content packs in Cortex XSOAR 6.13. * [Delete a Content Pack](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.13/onboard-cortex-xsoar/marketplace/content-pack-installation/delete-a-content-pack.md): Delete Marketplace content packs in Cortex XSOAR 6.13. * [Revert a Content Pack](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.13/onboard-cortex-xsoar/marketplace/content-pack-installation/revert-a-content-pack.md): Revert Marketplace content packs in Cortex XSOAR 6.13. * [Install a Content Pack Offline](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.13/onboard-cortex-xsoar/marketplace/install-a-content-pack-offline.md): Install Marketplace content packs offline in Cortex XSOAR 6.13. * [Content Pack Update Notifications](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.13/onboard-cortex-xsoar/marketplace/content-pack-update-notifications.md): Enable content pack update notifications in Cortex XSOAR 6.13. * [Marketplace Troubleshooting](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.13/onboard-cortex-xsoar/marketplace/marketplace-troubleshooting.md): Troubleshoot Marketplace issues in Cortex XSOAR 6.13. * [Content Pack Contributions](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.13/onboard-cortex-xsoar/marketplace/content-pack-contributions.md): Contribute Marketplace content packs in Cortex XSOAR 6.13. * [Create a Content Pack](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.13/onboard-cortex-xsoar/marketplace/content-pack-contributions/create-a-content-pack.md): Create a Marketplace content pack in Cortex XSOAR 6.13. * [Resubmit a Content Pack](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.13/onboard-cortex-xsoar/marketplace/content-pack-contributions/resubmit-a-content-pack.md): Resubmit a Marketplace content pack in Cortex XSOAR 6.13. * [Remote Repositories in Cortex XSOAR](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.13/onboard-cortex-xsoar/remote-repositories-in-cortex-xsoar.md): Configure remote repositories in Cortex XSOAR 6.13. * [Content Management in Cortex XSOAR](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.13/onboard-cortex-xsoar/remote-repositories-in-cortex-xsoar/content-management-in-cortex-xsoar.md): Manage content development in Cortex XSOAR 6.13. * [Remote Repositories Overview](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.13/onboard-cortex-xsoar/remote-repositories-in-cortex-xsoar/remote-repositories-overview.md): Review remote repository workflows in Cortex XSOAR 6.13. * [Configure a Remote Repository on a Development Machine](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.13/onboard-cortex-xsoar/remote-repositories-in-cortex-xsoar/configure-a-remote-repository-on-a-development-machine.md): Configure a development remote repository in Cortex XSOAR 6.13. * [Configure a Remote Repository on the Production Machine](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.13/onboard-cortex-xsoar/remote-repositories-in-cortex-xsoar/configure-a-remote-repository-on-the-production-machine.md): Configure a production remote repository in Cortex XSOAR 6.13. * [Edit and Push Content to a Remote Repository](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.13/onboard-cortex-xsoar/remote-repositories-in-cortex-xsoar/edit-and-push-content-to-a-remote-repository.md): Edit and push remote repository content in Cortex XSOAR 6.13. * [Upgrade Remote Repositories from Versions 5.5 and below](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.13/onboard-cortex-xsoar/remote-repositories-in-cortex-xsoar/upgrade-remote-repositories-from-versions-5.5-and-below.md): Upgrade remote repositories in Cortex XSOAR 6.13. * [Troubleshoot a Remote Repository Configuration](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.13/onboard-cortex-xsoar/remote-repositories-in-cortex-xsoar/troubleshoot-a-remote-repository-configuration.md): Troubleshoot remote repositories in Cortex XSOAR 6.13. * [Engines](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.13/onboard-cortex-xsoar/engines.md): Install and manage engines in Cortex XSOAR 6.13. * [Cortex XSOAR Engines Overview](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.13/onboard-cortex-xsoar/engines/cortex-xsoar-engines-overview.md): Review engine architecture in Cortex XSOAR 6.13. * [Engine Installation](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.13/onboard-cortex-xsoar/engines/engine-installation.md): Review engine installation options in Cortex XSOAR 6.13. * [Install a Cortex XSOAR Engine](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.13/onboard-cortex-xsoar/engines/engine-installation/install-a-cortex-xsoar-engine.md): Install an engine in Cortex XSOAR 6.13. * [Install a Signed Engine](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.13/onboard-cortex-xsoar/engines/engine-installation/install-a-signed-engine.md): Install a signed engine in Cortex XSOAR 6.13. * [Install a Cortex XSOAR Engine Offline](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.13/onboard-cortex-xsoar/engines/engine-installation/install-a-cortex-xsoar-engine-offline.md): Install an engine offline in Cortex XSOAR 6.13. * [Use an Engine in an Integration](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.13/onboard-cortex-xsoar/engines/use-an-engine-in-an-integration.md): Use an engine with integrations in Cortex XSOAR 6.13. * [Run a Script using an Engine](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.13/onboard-cortex-xsoar/engines/run-a-script-using-an-engine.md): Run scripts using engines in Cortex XSOAR 6.13. * [Manage Engines](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.13/onboard-cortex-xsoar/engines/manage-engines.md): Manage engines and load balancing groups in Cortex XSOAR 6.13. * [Configure Engines](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.13/onboard-cortex-xsoar/engines/configure-engines.md): Configure engines in Cortex XSOAR 6.13. * [Edit the Engine Configuration](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.13/onboard-cortex-xsoar/engines/configure-engines/edit-the-engine-configuration.md): Edit an engine configuration in Cortex XSOAR 6.13. * [Common Properties When Editing an Engine Configuration](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.13/onboard-cortex-xsoar/engines/configure-engines/common-properties-when-editing-an-engine-configuration.md): Review engine configuration properties in Cortex XSOAR 6.13. * [Configure the Engine to Use a Web Proxy](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.13/onboard-cortex-xsoar/engines/configure-engines/configure-the-engine-to-use-a-web-proxy.md): Configure an engine web proxy in Cortex XSOAR 6.13. * [Configure the Engine to Call the Server Without Using a Proxy](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.13/onboard-cortex-xsoar/engines/configure-engines/configure-the-engine-to-call-the-server-without-using-a-proxy.md): Configure direct engine server calls in Cortex XSOAR 6.13. * [Configure the Number of Workers for the Server](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.13/onboard-cortex-xsoar/engines/configure-engines/configure-the-number-of-workers-for-the-server.md): Configure engine workers in Cortex XSOAR 6.13. * [Configure Access to Communication Tasks through an Engine](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.13/onboard-cortex-xsoar/engines/configure-engines/configure-access-to-communication-tasks-through-an-engine.md): Configure engine communication task access in Cortex XSOAR 6.13. * [Configure an Engine to Use Custom Certificates](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.13/onboard-cortex-xsoar/engines/configure-engines/configure-an-engine-to-use-custom-certificates.md): Configure custom engine certificates in Cortex XSOAR 6.13. * [Notify Users When an Engine Disconnects](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.13/onboard-cortex-xsoar/engines/configure-engines/notify-users-when-an-engine-disconnects.md): Configure engine disconnect notifications in Cortex XSOAR 6.13. * [Remove an Engine](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.13/onboard-cortex-xsoar/engines/remove-an-engine.md): Remove an engine in Cortex XSOAR 6.13. * [Troubleshoot Cortex XSOAR Engines](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.13/onboard-cortex-xsoar/engines/troubleshoot-cortex-xsoar-engines.md): Troubleshoot engines in Cortex XSOAR 6.13. * [Troubleshoot Engine Installation](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.13/onboard-cortex-xsoar/engines/troubleshoot-cortex-xsoar-engines/troubleshoot-engine-installation.md): Troubleshoot engine installation in Cortex XSOAR 6.13. * [Troubleshoot Engine Upgrades](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.13/onboard-cortex-xsoar/engines/troubleshoot-cortex-xsoar-engines/troubleshoot-engine-upgrades.md): Troubleshoot engine upgrades in Cortex XSOAR 6.13. * [Troubleshoot Engine Connectivity](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.13/onboard-cortex-xsoar/engines/troubleshoot-cortex-xsoar-engines/troubleshoot-engine-connectivity.md): Troubleshoot engine connectivity in Cortex XSOAR 6.13. * [Troubleshoot Integrations Running on Engines](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.13/onboard-cortex-xsoar/engines/troubleshoot-cortex-xsoar-engines/troubleshoot-integrations-running-on-engines.md): Troubleshoot engine integration issues in Cortex XSOAR 6.13. * [Customize and Configure Cortex XSOAR](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.13/customize-cortex-xsoar/customize-and-configure-cortex-xsoar.md): Customize and configure your Cortex XSOAR 6.13 deployment. * [Incidents](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.13/customize-cortex-xsoar/customize-and-configure-cortex-xsoar/incidents.md): Manage and investigate incidents in Cortex XSOAR 6.13. * [Incident Lifecycle](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.13/customize-cortex-xsoar/customize-and-configure-cortex-xsoar/incidents/incident-lifecycle.md): Manage the incident lifecycle in Cortex XSOAR 6.13. * [Fetch Incidents From an Integration Instance](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.13/customize-cortex-xsoar/customize-and-configure-cortex-xsoar/incidents/incident-lifecycle/fetch-incidents-from-an-integration-instance.md): Fetch incidents from an integration instance in Cortex XSOAR 6.13. * [Receive Notification on an Incident Fetch Error](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.13/customize-cortex-xsoar/customize-and-configure-cortex-xsoar/incidents/incident-lifecycle/receive-notification-on-an-incident-fetch-error.md): Configure incident fetch error notifications in Cortex XSOAR 6.13. * [Incident Context Data](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.13/customize-cortex-xsoar/customize-and-configure-cortex-xsoar/incidents/incident-context-data.md): Manage incident context data in Cortex XSOAR 6.13. * [Incident Customization](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.13/customize-cortex-xsoar/customize-and-configure-cortex-xsoar/incidents/incident-customization.md): Customize incidents in Cortex XSOAR 6.13. * [Create an Incident Type](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.13/customize-cortex-xsoar/customize-and-configure-cortex-xsoar/incidents/incident-customization/create-an-incident-type.md): Create an incident type in Cortex XSOAR 6.13. * [Customize Incident Layouts](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.13/customize-cortex-xsoar/customize-and-configure-cortex-xsoar/incidents/incident-customization/customize-incident-layouts.md): Customize incident layouts in Cortex XSOAR 6.13. * [Incident Fields](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.13/customize-cortex-xsoar/customize-and-configure-cortex-xsoar/incidents/incident-customization/incident-fields.md): Manage incident fields in Cortex XSOAR 6.13. * [Create a Custom Incident Field](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.13/customize-cortex-xsoar/customize-and-configure-cortex-xsoar/incidents/incident-customization/incident-fields/create-a-custom-incident-field.md): Create a custom incident field in Cortex XSOAR 6.13. * [Create a Grid Field for an Incident Type](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.13/customize-cortex-xsoar/customize-and-configure-cortex-xsoar/incidents/incident-customization/incident-fields/create-a-grid-field-for-an-incident-type.md): Create a grid field for an incident type in Cortex XSOAR 6.13. * [Use Scripts with the Grid Field](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.13/customize-cortex-xsoar/customize-and-configure-cortex-xsoar/incidents/incident-customization/incident-fields/use-scripts-with-the-grid-field.md): Use scripts with grid fields in Cortex XSOAR 6.13. * [Incident Field Trigger Scripts](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.13/customize-cortex-xsoar/customize-and-configure-cortex-xsoar/incidents/incident-customization/incident-fields/incident-field-trigger-scripts.md): Configure incident field trigger scripts in Cortex XSOAR 6.13. * [Troubleshoot Closing Case Incident after Changing Field Type](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.13/customize-cortex-xsoar/customize-and-configure-cortex-xsoar/incidents/incident-customization/incident-fields/troubleshoot-closing-case-incident-after-changing-field-type.md): Resolve incident closing issues after changing a field type in Cortex XSOAR 6.13. * [Create an Evidence Field](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.13/customize-cortex-xsoar/customize-and-configure-cortex-xsoar/incidents/incident-customization/incident-fields/create-an-evidence-field.md): Create an evidence field in Cortex XSOAR 6.13. * [Incident De-Duplication](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.13/customize-cortex-xsoar/customize-and-configure-cortex-xsoar/incidents/incident-de-duplication.md): De-duplicate incidents in Cortex XSOAR 6.13. * [Manually De-Duplicate Incidents](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.13/customize-cortex-xsoar/customize-and-configure-cortex-xsoar/incidents/incident-de-duplication/manually-de-duplicate-incidents.md): Manually de-duplicate incidents in Cortex XSOAR 6.13. * [Automatic De-Duplication Using Scripts](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.13/customize-cortex-xsoar/customize-and-configure-cortex-xsoar/incidents/incident-de-duplication/automatic-de-duplication-using-scripts.md): Automate incident de-duplication with scripts in Cortex XSOAR 6.13. * [Pre-Process Rules](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.13/customize-cortex-xsoar/customize-and-configure-cortex-xsoar/incidents/pre-process-rules.md): Configure incident pre-process rules in Cortex XSOAR 6.13. * [Create Pre-Process Rules for Incidents](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.13/customize-cortex-xsoar/customize-and-configure-cortex-xsoar/incidents/pre-process-rules/create-pre-process-rules-for-incidents.md): Create incident pre-process rules in Cortex XSOAR 6.13. * [Rule Actions for Pre-Process Rules](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.13/customize-cortex-xsoar/customize-and-configure-cortex-xsoar/incidents/pre-process-rules/rule-actions-for-pre-process-rules.md): Configure pre-process rule actions in Cortex XSOAR 6.13. * [Post Processing for Incidents](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.13/customize-cortex-xsoar/customize-and-configure-cortex-xsoar/incidents/post-processing-for-incidents.md): Configure incident post-processing in Cortex XSOAR 6.13. * [Create a Post-Processing Script](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.13/customize-cortex-xsoar/customize-and-configure-cortex-xsoar/incidents/post-processing-for-incidents/create-a-post-processing-script.md): Create a post-processing script in Cortex XSOAR 6.13. * [Add a Post-Processing Script to the Incident Type](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.13/customize-cortex-xsoar/customize-and-configure-cortex-xsoar/incidents/post-processing-for-incidents/add-a-post-processing-script-to-the-incident-type.md): Add a post-processing script to an incident type in Cortex XSOAR 6.13. * [War Room Overview](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.13/customize-cortex-xsoar/customize-and-configure-cortex-xsoar/incidents/war-room-overview.md): Use the War Room for incident investigations in Cortex XSOAR 6.13. * [Schedule a Command](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.13/customize-cortex-xsoar/customize-and-configure-cortex-xsoar/incidents/war-room-overview/schedule-a-command.md): Schedule a command in Cortex XSOAR 6.13. * [Add a Custom Widget in the War Room](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.13/customize-cortex-xsoar/customize-and-configure-cortex-xsoar/incidents/war-room-overview/add-a-custom-widget-in-the-war-room.md): Add a custom War Room widget in Cortex XSOAR 6.13. * [War Room Indexing](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.13/customize-cortex-xsoar/customize-and-configure-cortex-xsoar/incidents/war-room-overview/war-room-indexing.md): Configure War Room indexing in Cortex XSOAR 6.13. * [Index War Room Entries Using Bolt DB](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.13/customize-cortex-xsoar/customize-and-configure-cortex-xsoar/incidents/war-room-overview/war-room-indexing/index-war-room-entries-using-bolt-db.md): Index War Room entries using Bolt DB in Cortex XSOAR 6.13. * [Index War Room Entries Using Elasticsearch](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.13/customize-cortex-xsoar/customize-and-configure-cortex-xsoar/incidents/war-room-overview/war-room-indexing/index-war-room-entries-using-elasticsearch.md): Index War Room entries using Elasticsearch in Cortex XSOAR 6.13. * [Incident Access Control Configuration](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.13/customize-cortex-xsoar/customize-and-configure-cortex-xsoar/incidents/incident-access-control-configuration.md): Configure incident access control in Cortex XSOAR 6.13. * [Limit Access to Investigations using RBAC](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.13/customize-cortex-xsoar/customize-and-configure-cortex-xsoar/incidents/incident-access-control-configuration/limit-access-to-investigations-using-rbac.md): Limit investigation access with RBAC in Cortex XSOAR 6.13. * [Restrict an Investigation](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.13/customize-cortex-xsoar/customize-and-configure-cortex-xsoar/incidents/incident-access-control-configuration/restrict-an-investigation.md): Restrict an investigation in Cortex XSOAR 6.13. * [Classification and Mapping](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.13/customize-cortex-xsoar/customize-and-configure-cortex-xsoar/incidents/classification-and-mapping.md): Classify and map integration data in Cortex XSOAR 6.13. * [Classify Events Using a Classification Key](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.13/customize-cortex-xsoar/customize-and-configure-cortex-xsoar/incidents/classification-and-mapping/classify-events-using-a-classification-key.md): Classify events using a classification key in Cortex XSOAR 6.13. * [Create a Mapper](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.13/customize-cortex-xsoar/customize-and-configure-cortex-xsoar/incidents/classification-and-mapping/create-a-mapper.md): Create a mapper in Cortex XSOAR 6.13. * [Incident Mirroring](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.13/customize-cortex-xsoar/customize-and-configure-cortex-xsoar/incidents/incident-mirroring.md): Configure incident mirroring in Cortex XSOAR 6.13. * [Customize Incident Close Reasons](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.13/customize-cortex-xsoar/customize-and-configure-cortex-xsoar/incidents/customize-incident-close-reasons.md): Customize incident close reasons in Cortex XSOAR 6.13. * [Change the Display Name of Security Incidents](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.13/customize-cortex-xsoar/customize-and-configure-cortex-xsoar/incidents/change-the-display-name-of-security-incidents.md): Change security incident display names in Cortex XSOAR 6.13. * [Playbooks](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.13/customize-cortex-xsoar/customize-and-configure-cortex-xsoar/playbooks.md): Create and manage playbooks in Cortex XSOAR 6.13. * [What Are Playbooks?](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.13/customize-cortex-xsoar/customize-and-configure-cortex-xsoar/playbooks/what-are-playbooks.md): Learn about playbooks in Cortex XSOAR 6.13. * [Playbook Development](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.13/customize-cortex-xsoar/customize-and-configure-cortex-xsoar/playbooks/playbook-development.md): Develop playbooks in Cortex XSOAR 6.13. * [Configure IoT Security Playbooks](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.13/customize-cortex-xsoar/customize-and-configure-cortex-xsoar/playbooks/configure-iot-security-playbooks.md): Configure IoT Security playbooks in Cortex XSOAR 6.13. * [Manage Playbook Settings](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.13/customize-cortex-xsoar/customize-and-configure-cortex-xsoar/playbooks/manage-playbook-settings.md): Manage playbook settings in Cortex XSOAR 6.13. * [Obtain Playbook Metadata](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.13/customize-cortex-xsoar/customize-and-configure-cortex-xsoar/playbooks/manage-playbook-settings/obtain-playbook-metadata.md): Obtain playbook metadata in Cortex XSOAR 6.13. * [Version Control](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.13/customize-cortex-xsoar/customize-and-configure-cortex-xsoar/playbooks/version-control.md): Manage playbook versions in Cortex XSOAR 6.13. * [Playbook Task Fields](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.13/customize-cortex-xsoar/customize-and-configure-cortex-xsoar/playbooks/playbook-task-fields.md): Configure playbook task fields in Cortex XSOAR 6.13. * [Create Section Headers](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.13/customize-cortex-xsoar/customize-and-configure-cortex-xsoar/playbooks/playbook-task-fields/create-section-headers.md): Create playbook section headers in Cortex XSOAR 6.13. * [Create a Conditional Task](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.13/customize-cortex-xsoar/customize-and-configure-cortex-xsoar/playbooks/playbook-task-fields/create-a-conditional-task.md): Create conditional playbook tasks in Cortex XSOAR 6.13. * [Communication Tasks](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.13/customize-cortex-xsoar/customize-and-configure-cortex-xsoar/playbooks/playbook-task-fields/communication-tasks.md): Configure communication tasks in Cortex XSOAR 6.13. * [Create an Ask Task](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.13/customize-cortex-xsoar/customize-and-configure-cortex-xsoar/playbooks/playbook-task-fields/communication-tasks/create-an-ask-task.md): Create Ask tasks in Cortex XSOAR 6.13. * [Ask Task Examples](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.13/customize-cortex-xsoar/customize-and-configure-cortex-xsoar/playbooks/playbook-task-fields/communication-tasks/create-an-ask-task/ask-task-examples.md): Review Ask task examples in Cortex XSOAR 6.13. * [Customize an Ask Task](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.13/customize-cortex-xsoar/customize-and-configure-cortex-xsoar/playbooks/playbook-task-fields/communication-tasks/create-an-ask-task/customize-an-ask-task.md): Customize Ask tasks in Cortex XSOAR 6.13. * [Create a Data Collection Task](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.13/customize-cortex-xsoar/customize-and-configure-cortex-xsoar/playbooks/playbook-task-fields/communication-tasks/create-a-data-collection-task.md): Create data collection tasks in Cortex XSOAR 6.13. * [Data Collection Task Examples](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.13/customize-cortex-xsoar/customize-and-configure-cortex-xsoar/playbooks/playbook-task-fields/communication-tasks/create-a-data-collection-task/data-collection-task-examples.md): Review data collection task examples in Cortex XSOAR 6.13. * [Customize a Data Collection Task](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.13/customize-cortex-xsoar/customize-and-configure-cortex-xsoar/playbooks/playbook-task-fields/communication-tasks/create-a-data-collection-task/customize-a-data-collection-task.md): Customize data collection tasks in Cortex XSOAR 6.13. * [Customize the SOC Name](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.13/customize-cortex-xsoar/customize-and-configure-cortex-xsoar/playbooks/playbook-task-fields/communication-tasks/customize-the-soc-name.md): Customize the SOC name in Cortex XSOAR 6.13. * [Create Communication Task Authentication](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.13/customize-cortex-xsoar/customize-and-configure-cortex-xsoar/playbooks/playbook-task-fields/communication-tasks/create-communication-task-authentication.md): Configure communication task authentication in Cortex XSOAR 6.13. * [Add Ad Hoc Tasks to a Work Plan](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.13/customize-cortex-xsoar/customize-and-configure-cortex-xsoar/playbooks/playbook-task-fields/communication-tasks/add-ad-hoc-tasks-to-a-work-plan.md): Add ad hoc work plan tasks in Cortex XSOAR 6.13. * [Handle Errors in a Playbook](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.13/customize-cortex-xsoar/customize-and-configure-cortex-xsoar/playbooks/playbook-task-fields/communication-tasks/handle-errors-in-a-playbook.md): Handle playbook errors in Cortex XSOAR 6.13. * [Playbook Task Fields](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.13/customize-cortex-xsoar/customize-and-configure-cortex-xsoar/playbooks/playbook-task-fields/communication-tasks/playbook-task-fields.md): Review playbook task fields in Cortex XSOAR 6.13. * [Playbook Inputs and Outputs](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.13/customize-cortex-xsoar/customize-and-configure-cortex-xsoar/playbooks/playbook-inputs-and-outputs.md): Configure playbook inputs and outputs in Cortex XSOAR 6.13. * [Extend Context](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.13/customize-cortex-xsoar/customize-and-configure-cortex-xsoar/playbooks/extend-context.md): Extend context in Cortex XSOAR 6.13. * [Extend Context in a Playbook Task](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.13/customize-cortex-xsoar/customize-and-configure-cortex-xsoar/playbooks/extend-context/extend-context-in-a-playbook-task.md): Extend context in a playbook task in Cortex XSOAR 6.13. * [Extend Context using the Command Line](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.13/customize-cortex-xsoar/customize-and-configure-cortex-xsoar/playbooks/extend-context/extend-context-using-the-command-line.md): Extend context from the command line in Cortex XSOAR 6.13. * [Use DT syntax to get select keys from a list of dictionaries](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.13/customize-cortex-xsoar/customize-and-configure-cortex-xsoar/playbooks/extend-context/use-dt-syntax-to-get-select-keys-from-a-list-of-dictionaries.md): Use DT syntax in Cortex XSOAR 6.13. * [Filters and Transformers](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.13/customize-cortex-xsoar/customize-and-configure-cortex-xsoar/playbooks/filters-and-transformers.md): Use filters and transformers in Cortex XSOAR 6.13. * [Create Filters and Transformers in a Playbook](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.13/customize-cortex-xsoar/customize-and-configure-cortex-xsoar/playbooks/filters-and-transformers/create-filters-and-transformers-in-a-playbook.md): Create playbook filters and transformers in Cortex XSOAR 6.13. * [Create a Filter Example](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.13/customize-cortex-xsoar/customize-and-configure-cortex-xsoar/playbooks/filters-and-transformers/create-filters-and-transformers-in-a-playbook/create-a-filter-example.md): Create a filter example in Cortex XSOAR 6.13. * [Create a Filter (Advanced) Example](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.13/customize-cortex-xsoar/customize-and-configure-cortex-xsoar/playbooks/filters-and-transformers/create-filters-and-transformers-in-a-playbook/create-a-filter-advanced-example.md): Create an advanced filter example in Cortex XSOAR 6.13. * [Filter Operators](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.13/customize-cortex-xsoar/customize-and-configure-cortex-xsoar/playbooks/filters-and-transformers/filter-operators.md): Review filter operators in Cortex XSOAR 6.13. * [Built-in Filters](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.13/customize-cortex-xsoar/customize-and-configure-cortex-xsoar/playbooks/filters-and-transformers/filter-operators/built-in-filters.md): Use built-in filters in Cortex XSOAR 6.13. * [Transformers Operators](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.13/customize-cortex-xsoar/customize-and-configure-cortex-xsoar/playbooks/filters-and-transformers/filter-operators/transformers-operators.md): Use transformer operators in Cortex XSOAR 6.13. * [Create Custom Filter and Transformer Operators](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.13/customize-cortex-xsoar/customize-and-configure-cortex-xsoar/playbooks/filters-and-transformers/filter-operators/create-custom-filter-and-transformer-operators.md): Create custom filter and transformer operators in Cortex XSOAR 6.13. * [Automations](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.13/customize-cortex-xsoar/customize-and-configure-cortex-xsoar/playbooks/automations.md): Create and edit automations in Cortex XSOAR 6.13. * [Special Automation Tags](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.13/customize-cortex-xsoar/customize-and-configure-cortex-xsoar/playbooks/automations/special-automation-tags.md): Use special automation tags in Cortex XSOAR 6.13. * [Common Scripts to use in Automations](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.13/customize-cortex-xsoar/customize-and-configure-cortex-xsoar/playbooks/automations/common-scripts-to-use-in-automations.md): Use common automation scripts in Cortex XSOAR 6.13. * [Configure a Sub-playbook Loop](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.13/customize-cortex-xsoar/customize-and-configure-cortex-xsoar/playbooks/configure-a-sub-playbook-loop.md): Configure a sub-playbook loop in Cortex XSOAR 6.13. * [Playbook Polling](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.13/customize-cortex-xsoar/customize-and-configure-cortex-xsoar/playbooks/playbook-polling.md): Configure playbook polling in Cortex XSOAR 6.13. * [Create Incident Fields in a Playbook](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.13/customize-cortex-xsoar/customize-and-configure-cortex-xsoar/playbooks/create-incident-fields-in-a-playbook.md): Create incident fields in a playbook in Cortex XSOAR 6.13. * [Playbook Testing](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.13/customize-cortex-xsoar/customize-and-configure-cortex-xsoar/playbooks/playbook-testing.md): Test playbooks in Cortex XSOAR 6.13. * [Debug a Playbook](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.13/customize-cortex-xsoar/customize-and-configure-cortex-xsoar/playbooks/playbook-testing/debug-a-playbook.md): Debug a playbook in Cortex XSOAR 6.13. * [Debugger Troubleshooting](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.13/customize-cortex-xsoar/customize-and-configure-cortex-xsoar/playbooks/playbook-testing/debugger-troubleshooting.md): Troubleshoot the playbook debugger in Cortex XSOAR 6.13. * [Best Practices](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.13/customize-cortex-xsoar/customize-and-configure-cortex-xsoar/playbooks/best-practices.md): Apply playbook best practices in Cortex XSOAR 6.13. * [Jobs](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.13/customize-cortex-xsoar/customize-and-configure-cortex-xsoar/jobs.md): Configure jobs in Cortex XSOAR 6.13. * [Create a Time Triggered Job](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.13/customize-cortex-xsoar/customize-and-configure-cortex-xsoar/jobs/create-a-time-triggered-job.md): Create time-triggered jobs in Cortex XSOAR 6.13. * [Create a Job Triggered by a Delta in Feed](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.13/customize-cortex-xsoar/customize-and-configure-cortex-xsoar/jobs/create-a-job-triggered-by-a-delta-in-feed.md): Create feed delta-triggered jobs in Cortex XSOAR 6.13. * [Time Triggered Job Parameters](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.13/customize-cortex-xsoar/customize-and-configure-cortex-xsoar/jobs/time-triggered-job-parameters.md): Review time-triggered job parameters in Cortex XSOAR 6.13. * [Process Indicators Using a Job Triggered By Delta](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.13/customize-cortex-xsoar/customize-and-configure-cortex-xsoar/jobs/process-indicators-using-a-job-triggered-by-delta.md): Process indicators with feed delta jobs in Cortex XSOAR 6.13. * [Add Indicators to SIEM Using a Time Triggered Job](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.13/customize-cortex-xsoar/customize-and-configure-cortex-xsoar/jobs/add-indicators-to-siem-using-a-time-triggered-job.md): Send indicators to SIEM with jobs in Cortex XSOAR 6.13. * [Work with SLAs](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.13/customize-cortex-xsoar/customize-and-configure-cortex-xsoar/work-with-slas.md): Configure SLAs and timers in Cortex XSOAR 6.13. * [SLA Overview](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.13/customize-cortex-xsoar/customize-and-configure-cortex-xsoar/work-with-slas/sla-overview.md): Learn about SLA fields and timers in Cortex XSOAR 6.13. * [Create an SLA Field](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.13/customize-cortex-xsoar/customize-and-configure-cortex-xsoar/work-with-slas/create-an-sla-field.md): Create SLA and timer fields in Cortex XSOAR 6.13. * [Manage SLA and Timer Fields in an Incident](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.13/customize-cortex-xsoar/customize-and-configure-cortex-xsoar/work-with-slas/manage-sla-and-timer-fields-in-an-incident.md): Manage incident SLA and timer fields in Cortex XSOAR 6.13. * [Create an SLA Trigger](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.13/customize-cortex-xsoar/customize-and-configure-cortex-xsoar/work-with-slas/create-an-sla-trigger.md): Create SLA triggers for playbooks in Cortex XSOAR 6.13. * [Customize SLA Scripts](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.13/customize-cortex-xsoar/customize-and-configure-cortex-xsoar/work-with-slas/customize-sla-scripts.md): Customize SLA breach scripts in Cortex XSOAR 6.13. * [Search Incidents using SLA and Timer Fields](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.13/customize-cortex-xsoar/customize-and-configure-cortex-xsoar/work-with-slas/search-incidents-using-sla-and-timer-fields.md): Search incidents by SLA and timer fields in Cortex XSOAR 6.13. * [Configure the Global Risk Threshold](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.13/customize-cortex-xsoar/customize-and-configure-cortex-xsoar/work-with-slas/configure-the-global-risk-threshold.md): Configure the global SLA risk threshold in Cortex XSOAR 6.13. * [Machine Learning](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.13/customize-cortex-xsoar/customize-and-configure-cortex-xsoar/machine-learning.md): Understand machine learning models in Cortex XSOAR 6.13. * [Machine Learning Capabilities](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.13/customize-cortex-xsoar/customize-and-configure-cortex-xsoar/machine-learning/machine-learning-capabilities.md): Explore machine learning capabilities in Cortex XSOAR 6.13. * [Machine Learning Models](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.13/customize-cortex-xsoar/customize-and-configure-cortex-xsoar/machine-learning/machine-learning-models.md): Use machine learning models in Cortex XSOAR 6.13 to predict phishing incidents. * [Use the Phishing Classifier in Production](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.13/customize-cortex-xsoar/customize-and-configure-cortex-xsoar/machine-learning/use-the-phishing-classifier-in-production.md): Use the phishing classifier in production in Cortex XSOAR 6.13. * [Create a Machine Learning Model](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.13/customize-cortex-xsoar/customize-and-configure-cortex-xsoar/machine-learning/create-a-machine-learning-model.md): Create a machine learning model in Cortex XSOAR 6.13 for phishing classification. * [Phishing Classifier Demo](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.13/customize-cortex-xsoar/customize-and-configure-cortex-xsoar/machine-learning/phishing-classifier-demo.md): Use the phishing classifier demo in Cortex XSOAR 6.13. * [Train a Phishing Classifier on Non-English Languages](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.13/customize-cortex-xsoar/customize-and-configure-cortex-xsoar/machine-learning/train-a-phishing-classifier-on-non-english-languages.md): Train phishing classifiers for non-English languages in Cortex XSOAR 6.13. * [Additional Machine Learning Scripts](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.13/customize-cortex-xsoar/customize-and-configure-cortex-xsoar/machine-learning/additional-machine-learning-scripts.md): Use additional machine learning scripts in Cortex XSOAR 6.13. * [Lists](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.13/customize-cortex-xsoar/customize-and-configure-cortex-xsoar/lists.md): Create and manage lists in Cortex XSOAR 6.13. * [Work With Lists](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.13/customize-cortex-xsoar/customize-and-configure-cortex-xsoar/lists/work-with-lists.md): Manage lists in Cortex XSOAR 6.13 with automations and playbooks. * [Work with JSON Lists](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.13/customize-cortex-xsoar/customize-and-configure-cortex-xsoar/lists/work-with-lists/work-with-json-lists.md): Work with JSON lists in Cortex XSOAR 6.13 playbooks. * [Create a List](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.13/customize-cortex-xsoar/customize-and-configure-cortex-xsoar/lists/create-a-list.md): Create lists in Cortex XSOAR 6.13 for scripts and War Rooms. * [Set the List Separator Character](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.13/customize-cortex-xsoar/customize-and-configure-cortex-xsoar/lists/set-the-list-separator-character.md): Set the list separator character in Cortex XSOAR 6.13. * [Transform a List into an Array](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.13/customize-cortex-xsoar/customize-and-configure-cortex-xsoar/lists/transform-a-list-into-an-array.md): Transform a list into an array in Cortex XSOAR 6.13. * [Indicators](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.13/customize-cortex-xsoar/customize-and-configure-cortex-xsoar/indicators.md): Cortex XSOAR 6.13 analyzes indicators, including types, layouts, and exclusion lists. * [Indicator Concepts](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.13/customize-cortex-xsoar/customize-and-configure-cortex-xsoar/indicators/indicator-concepts.md): Learn threat intelligence management concepts in Cortex XSOAR 6.13. * [Indicator Verdict](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.13/customize-cortex-xsoar/customize-and-configure-cortex-xsoar/indicators/indicator-verdict.md): Learn how indicator verdicts work in Cortex XSOAR 6.13. * [Indicator Ingestion](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.13/customize-cortex-xsoar/customize-and-configure-cortex-xsoar/indicators/indicator-ingestion.md): Learn how indicators are detected and ingested in Cortex XSOAR 6.13. * [Indicator Customization](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.13/customize-cortex-xsoar/customize-and-configure-cortex-xsoar/indicators/indicator-customization.md): Customize indicator types, fields, and layouts in Cortex XSOAR 6.13. * [Indicator Types](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.13/customize-cortex-xsoar/customize-and-configure-cortex-xsoar/indicators/indicator-customization/indicator-types.md): Configure indicator types and their associated scripts and fields. * [File Indicators](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.13/customize-cortex-xsoar/customize-and-configure-cortex-xsoar/indicators/indicator-customization/indicator-types/file-indicators.md): Manage file indicators and their associated hashes. * [File Indicator Merging Strategy](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.13/customize-cortex-xsoar/customize-and-configure-cortex-xsoar/indicators/indicator-customization/indicator-types/file-indicators/file-indicator-merging-strategy.md): Understand how file indicators merge by hash. * [Create an Indicator Type](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.13/customize-cortex-xsoar/customize-and-configure-cortex-xsoar/indicators/indicator-customization/indicator-types/create-an-indicator-type.md): Create a custom indicator type. * [Indicator Type Profile](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.13/customize-cortex-xsoar/customize-and-configure-cortex-xsoar/indicators/indicator-customization/indicator-types/indicator-type-profile.md): Configure indicator type profile settings. * [Map Custom Indicator Fields](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.13/customize-cortex-xsoar/customize-and-configure-cortex-xsoar/indicators/indicator-customization/indicator-types/map-custom-indicator-fields.md): Map custom fields to indicator data. * [Formatting Scripts](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.13/customize-cortex-xsoar/customize-and-configure-cortex-xsoar/indicators/indicator-customization/indicator-types/formatting-scripts.md): Format indicator values and output. * [Enhancement Scripts](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.13/customize-cortex-xsoar/customize-and-configure-cortex-xsoar/indicators/indicator-customization/indicator-types/enhancement-scripts.md): Configure scripts that enhance indicators on demand. * [Reputation Scripts](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.13/customize-cortex-xsoar/customize-and-configure-cortex-xsoar/indicators/indicator-customization/indicator-types/reputation-scripts.md): Configure scripts that calculate indicator verdicts. * [Reputation Commands](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.13/customize-cortex-xsoar/customize-and-configure-cortex-xsoar/indicators/indicator-customization/indicator-types/reputation-commands.md): Configure commands that calculate indicator verdicts. * [Indicator Fields](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.13/customize-cortex-xsoar/customize-and-configure-cortex-xsoar/indicators/indicator-customization/indicator-fields.md): Create and configure fields for indicators. * [Create a Custom Indicator Field](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.13/customize-cortex-xsoar/customize-and-configure-cortex-xsoar/indicators/indicator-customization/indicator-fields/create-a-custom-indicator-field.md): Create a custom field for indicators. * [Configure the HTML Field](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.13/customize-cortex-xsoar/customize-and-configure-cortex-xsoar/indicators/indicator-customization/indicator-fields/create-a-custom-indicator-field/configure-the-html-field.md): Configure HTML fields for indicators. * [Indicator Field Trigger Scripts](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.13/customize-cortex-xsoar/customize-and-configure-cortex-xsoar/indicators/indicator-customization/indicator-fields/indicator-field-trigger-scripts.md): Run scripts when indicator field values change. * [Indicator Layouts](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.13/customize-cortex-xsoar/customize-and-configure-cortex-xsoar/indicators/indicator-customization/indicator-layouts.md): Customize layouts for indicator types. * [Customize an Indicator Type Layout](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.13/customize-cortex-xsoar/customize-and-configure-cortex-xsoar/indicators/indicator-customization/indicator-layouts/customize-an-indicator-type-layout.md): Customize a layout for an indicator type. * [Add a Script in the Indicator Layout](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.13/customize-cortex-xsoar/customize-and-configure-cortex-xsoar/indicators/indicator-customization/indicator-layouts/add-a-script-in-the-indicator-layout.md): Add dynamic script output to an indicator layout. * [Indicator Extraction](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.13/customize-cortex-xsoar/customize-and-configure-cortex-xsoar/indicators/indicator-extraction.md): Indicator extraction extracts indicators from incident fields and enriches them with commands and scripts defined for the indicator type. * [Indicator Extraction Modes](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.13/customize-cortex-xsoar/customize-and-configure-cortex-xsoar/indicators/indicator-extraction/indicator-extraction-modes.md): Indicator extraction modes and their behavior. * [Create Indicator Extraction Rules for an Incident Type](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.13/customize-cortex-xsoar/customize-and-configure-cortex-xsoar/indicators/indicator-extraction/create-indicator-extraction-rules-for-an-incident-type.md): Configure indicator extraction rules for incident types. * [Run Indicator Extraction in the CLI](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.13/customize-cortex-xsoar/customize-and-configure-cortex-xsoar/indicators/indicator-extraction/run-indicator-extraction-in-the-cli.md): Extract and enrich indicators from the command line. * [Create Indicator Extract Rules for a Playbook Task](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.13/customize-cortex-xsoar/customize-and-configure-cortex-xsoar/indicators/indicator-extraction/create-indicator-extract-rules-for-a-playbook-task.md): Configure indicator extraction for playbook tasks. * [Disable Indicator Extraction for Automations or Integrations](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.13/customize-cortex-xsoar/customize-and-configure-cortex-xsoar/indicators/indicator-extraction/disable-indicator-extraction-for-automations-or-integrations.md): Disable indicator extraction for specific automations or integrations. * [Indicator Expiration](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.13/customize-cortex-xsoar/customize-and-configure-cortex-xsoar/indicators/indicator-expiration.md): Cortex XSOAR indicators have an active or expired status which can be set to expire after a period of time or never to expire. Set default expiration method. * [Feed Integrations](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.13/customize-cortex-xsoar/customize-and-configure-cortex-xsoar/indicators/feed-integrations.md): Feed integrations fetch indicators from a threat intelligence feed and add them to Cortex XSOAR for processing and handling. * [Set the Source Reliability of Enrichment Integrations](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.13/customize-cortex-xsoar/customize-and-configure-cortex-xsoar/indicators/feed-integrations/set-the-source-reliability-of-enrichment-integrations.md) * [Dashboards](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.13/customize-cortex-xsoar/customize-and-configure-cortex-xsoar/dashboards.md): Create, edit, and share dashboards in Cortex XSOAR 6.13. Add widgets and configure a default dashboard. * [Dashboard Overview](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.13/customize-cortex-xsoar/customize-and-configure-cortex-xsoar/dashboards/dashboard-overview.md): Cortex XSOAR 6.13 dashboards provide visual data from customizable widgets. Create, edit, import, share, and delete dashboards. * [Create a Dashboard](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.13/customize-cortex-xsoar/customize-and-configure-cortex-xsoar/dashboards/create-a-dashboard.md): Create and customize dashboards in Cortex XSOAR 6.13. Add widgets to a dashboard. * [Add a Widget to a Dashboard](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.13/customize-cortex-xsoar/customize-and-configure-cortex-xsoar/dashboards/add-a-widget-to-a-dashboard.md): Add widgets to dashboards in Cortex XSOAR 6.13. Configure widget parameters, including date range. * [Share a Dashboard](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.13/customize-cortex-xsoar/customize-and-configure-cortex-xsoar/dashboards/share-a-dashboard.md): Share dashboards with other users by role in Cortex XSOAR 6.13. Set permissions for shared dashboards. * [Edit a Dashboard](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.13/customize-cortex-xsoar/customize-and-configure-cortex-xsoar/dashboards/edit-a-dashboard.md): Edit dashboards in Cortex XSOAR 6.13. Add, delete, or change widgets, dates, size, and position. * [Reports](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.13/customize-cortex-xsoar/customize-and-configure-cortex-xsoar/reports.md): Create, edit, and customize reports in Cortex XSOAR 6.13. Schedule reports with Cron expressions. * [Reports Overview](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.13/customize-cortex-xsoar/customize-and-configure-cortex-xsoar/reports/reports-overview.md): Review reports in Cortex XSOAR 6.13. Create and edit reports, analyze data, and upload logos. * [Create a Report](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.13/customize-cortex-xsoar/customize-and-configure-cortex-xsoar/reports/create-a-report.md): Create reports in Cortex XSOAR 6.13. Add widgets, customize reports, and schedule delivery. * [Schedule a report](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.13/customize-cortex-xsoar/customize-and-configure-cortex-xsoar/reports/schedule-a-report.md): Schedule reports in Cortex XSOAR 6.13. Send reports by email and choose recipients. * [Customize the Email When Sending a Report](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.13/customize-cortex-xsoar/customize-and-configure-cortex-xsoar/reports/customize-the-email-when-sending-a-report.md): Customize scheduled report emails in Cortex XSOAR 6.13. Change the subject and body. * [Create an Incident Summary Report](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.13/customize-cortex-xsoar/customize-and-configure-cortex-xsoar/reports/create-an-incident-summary-report.md): Create incident summary reports in Cortex XSOAR 6.13. Save reports as templates. * [Select and Customize Sections to Export to a Summary Report](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.13/customize-cortex-xsoar/customize-and-configure-cortex-xsoar/reports/select-and-customize-sections-to-export-to-a-summary-report.md): Select sections for summary reports in Cortex XSOAR 6.13. Save reports as templates. * [Add a Widget to a Report](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.13/customize-cortex-xsoar/customize-and-configure-cortex-xsoar/reports/add-a-widget-to-a-report.md): Add widgets to reports in Cortex XSOAR 6.13. * [Edit a report](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.13/customize-cortex-xsoar/customize-and-configure-cortex-xsoar/reports/edit-a-report.md): Edit reports in Cortex XSOAR 6.13. Change widgets, layouts, and output types. * [Change the Report Logo](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.13/customize-cortex-xsoar/customize-and-configure-cortex-xsoar/reports/change-the-report-logo.md): Change report logos in Cortex XSOAR 6.13. Configure logos with server settings. * [Configure the Time Zone and Format in a Report](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.13/customize-cortex-xsoar/customize-and-configure-cortex-xsoar/reports/configure-the-time-zone-and-format-in-a-report.md): Configure time zones and formats for reports in Cortex XSOAR 6.13. * [Troubleshoot Reports](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.13/customize-cortex-xsoar/customize-and-configure-cortex-xsoar/reports/troubleshoot-reports.md): Troubleshoot reports in Cortex XSOAR 6.13. View report JSON files with a temporary server configuration. * [Widgets](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.13/customize-cortex-xsoar/customize-and-configure-cortex-xsoar/widgets.md): Create and edit widgets in Cortex XSOAR 6.13 for reports and dashboards. * [Widgets Overview](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.13/customize-cortex-xsoar/customize-and-configure-cortex-xsoar/widgets/widgets-overview.md): Learn how widgets in Cortex XSOAR 6.13 analyze and display dashboard and report data. * [Create a Widget using the Widget Builder](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.13/customize-cortex-xsoar/customize-and-configure-cortex-xsoar/widgets/create-a-widget-using-the-widget-builder.md): Create widgets in Cortex XSOAR 6.13 with the Widget Builder. Add them to dashboards or reports. * [Create a Custom Widget Using a JSON File](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.13/customize-cortex-xsoar/customize-and-configure-cortex-xsoar/widgets/create-a-custom-widget-using-a-json-file.md): Create custom widgets in Cortex XSOAR 6.13 with JSON files for dashboards and reports. * [Create a Custom Widget Using an Automation Script](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.13/customize-cortex-xsoar/customize-and-configure-cortex-xsoar/widgets/create-a-custom-widget-using-an-automation-script.md): Create custom widgets in Cortex XSOAR 6.13 with automation scripts for dashboards and reports. * [Edit a Widget](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.13/customize-cortex-xsoar/customize-and-configure-cortex-xsoar/widgets/edit-a-widget.md): Edit widgets in Cortex XSOAR 6.13 from the Widgets Library, dashboards, or reports. * [Create a Used Percentage Widget for a Disk Partition](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.13/customize-cortex-xsoar/customize-and-configure-cortex-xsoar/widgets/create-a-used-percentage-widget-for-a-disk-partition.md): Create a disk partition used-percentage widget in Cortex XSOAR 6.13. * [Saved By Dbot (ROI) Widget](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.13/customize-cortex-xsoar/customize-and-configure-cortex-xsoar/widgets/saved-by-dbot-roi-widget.md): Configure the Saved by Dbot ROI widget in Cortex XSOAR 6.13 with a server setting. * [Manage Data](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.13/customize-cortex-xsoar/customize-and-configure-cortex-xsoar/manage-data.md): Manage data in Cortex XSOAR 6.13 by reindexing databases, freeing disk space, migrating data, and restoring archives. * [Reindex the Entire Database](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.13/customize-cortex-xsoar/customize-and-configure-cortex-xsoar/manage-data/reindex-the-entire-database.md): Reindex the entire database in Cortex XSOAR 6.13. * [Reindex a Specific Index Database](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.13/customize-cortex-xsoar/customize-and-configure-cortex-xsoar/manage-data/reindex-a-specific-index-database.md): Reindex one or more index databases in Cortex XSOAR 6.13. * [Reindex the Audit Log](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.13/customize-cortex-xsoar/customize-and-configure-cortex-xsoar/manage-data/reindex-the-audit-log.md): Reindex the audit log in Cortex XSOAR 6.13 to recover historical audit trail data. * [Free up Disk Space with Data Archiving](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.13/customize-cortex-xsoar/customize-and-configure-cortex-xsoar/manage-data/free-up-disk-space-with-data-archiving.md): Free disk space in Cortex XSOAR 6.13 by archiving unused data folders. * [Archive Artifacts and Attachments](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.13/customize-cortex-xsoar/customize-and-configure-cortex-xsoar/manage-data/archive-artifacts-and-attachments.md): Archive artifact and attachment folders in Cortex XSOAR 6.13. * [Store Incident/Artifact Files in the Cloud](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.13/customize-cortex-xsoar/customize-and-configure-cortex-xsoar/manage-data/store-incidentartifact-files-in-the-cloud.md): Store incident attachments and artifact files in the cloud in Cortex XSOAR 6.13. * [Migrate Data to Another Server](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.13/customize-cortex-xsoar/customize-and-configure-cortex-xsoar/manage-data/migrate-data-to-another-server.md): Migrate Cortex XSOAR 6.13 data to another server, including files and directories. * [Migrate Data to Another Server for Multi-Tenant](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.13/customize-cortex-xsoar/customize-and-configure-cortex-xsoar/manage-data/migrate-data-to-another-server-for-multi-tenant.md): Migrate Cortex XSOAR 6.13 data to another server in a multi-tenant environment. * [Move Data Folders to Another Location on the Server](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.13/customize-cortex-xsoar/customize-and-configure-cortex-xsoar/manage-data/move-data-folders-to-another-location-on-the-server.md): Move Cortex XSOAR 6.13 data folders to another server location. * [Restore an Archived Folder](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.13/customize-cortex-xsoar/customize-and-configure-cortex-xsoar/manage-data/restore-an-archived-folder.md): Restore an archived folder in Cortex XSOAR 6.13. * [Logs](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.13/customize-cortex-xsoar/customize-and-configure-cortex-xsoar/logs.md): View server logs, audit trails, and log bundles in Cortex XSOAR 6.13. * [Logs Overview](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.13/customize-cortex-xsoar/customize-and-configure-cortex-xsoar/logs/logs-overview.md): Use Cortex XSOAR 6.13 logs to troubleshoot system activity. * [Configure the Server Log](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.13/customize-cortex-xsoar/customize-and-configure-cortex-xsoar/logs/configure-the-server-log.md): Configure server log size, level, backups, and retention in Cortex XSOAR 6.13. * [Configure the Access Log for HTTPS Requests](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.13/customize-cortex-xsoar/customize-and-configure-cortex-xsoar/logs/configure-the-access-log-for-https-requests.md): Configure access logging for HTTP and HTTPS requests in Cortex XSOAR 6.13. * [Create a Log Bundle](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.13/customize-cortex-xsoar/customize-and-configure-cortex-xsoar/logs/create-a-log-bundle.md): Create a log bundle for troubleshooting in Cortex XSOAR 6.13. * [Audit Trail](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.13/customize-cortex-xsoar/customize-and-configure-cortex-xsoar/logs/audit-trail.md): View, export, extract, and purge administrative audit trail actions in Cortex XSOAR 6.13. * [Send the Audit Trail to an External Log Service](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.13/customize-cortex-xsoar/customize-and-configure-cortex-xsoar/logs/send-the-audit-trail-to-an-external-log-service.md): Send the Cortex XSOAR 6.13 audit trail to an external log service using server configurations. * [System Settings](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.13/customize-cortex-xsoar/customize-and-configure-cortex-xsoar/system-settings.md): Customize logos, login messages, system emails, and notifications in Cortex XSOAR 6.13. * [Customize the Logo](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.13/customize-cortex-xsoar/customize-and-configure-cortex-xsoar/system-settings/customize-the-logo.md): Customize full-size and minimized logos in Cortex XSOAR 6.13. * [Customize the Login Message](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.13/customize-cortex-xsoar/customize-and-configure-cortex-xsoar/system-settings/customize-the-login-message.md): Customize the login-page message in Cortex XSOAR 6.13. * [Customize System Emails](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.13/customize-cortex-xsoar/customize-and-configure-cortex-xsoar/system-settings/customize-system-emails.md): Customize system email subjects, bodies, and formats in Cortex XSOAR 6.13. * [Configure System Notifications](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.13/customize-cortex-xsoar/customize-and-configure-cortex-xsoar/system-settings/configure-system-notifications.md): Configure email system notifications and senders in Cortex XSOAR 6.13. * [Day to Day Tasks in Cortex XSOAR](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.13/investigate-and-respond-to-threats/day-to-day-tasks-in-cortex-xsoar.md): Manage daily incident and indicator management tasks in Cortex XSOAR 6.13. * [Incident Management](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.13/investigate-and-respond-to-threats/day-to-day-tasks-in-cortex-xsoar/incident-management.md): Open, investigate, and manage incidents in Cortex XSOAR 6.13. * [Create an Incident](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.13/investigate-and-respond-to-threats/day-to-day-tasks-in-cortex-xsoar/incident-management/create-an-incident.md): Create incidents manually, from feeds, or by importing JSON in Cortex XSOAR 6.13. * [Create a Search Query for Incidents](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.13/investigate-and-respond-to-threats/day-to-day-tasks-in-cortex-xsoar/incident-management/create-a-search-query-for-incidents.md): Create and save incident search queries in Cortex XSOAR 6.13. * [Create a Widget From an Incident](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.13/investigate-and-respond-to-threats/day-to-day-tasks-in-cortex-xsoar/incident-management/create-a-widget-from-an-incident.md): Create widgets from incident searches in Cortex XSOAR 6.13. * [Export an Incident to CSV Using the UTF8-BOM Format](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.13/investigate-and-respond-to-threats/day-to-day-tasks-in-cortex-xsoar/incident-management/export-an-incident-to-csv-using-the-utf8-bom-format.md): Export incidents to CSV with UTF8-BOM encoding in Cortex XSOAR 6.13. * [Incident Investigation](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.13/investigate-and-respond-to-threats/day-to-day-tasks-in-cortex-xsoar/incident-management/incident-investigation.md): Open incidents and view their details in Cortex XSOAR 6.13. * [Work Plan](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.13/investigate-and-respond-to-threats/day-to-day-tasks-in-cortex-xsoar/incident-management/work-plan.md): Monitor and manage incident Playbook workflows in Cortex XSOAR 6.13. * [Investigate an Incident Using the Canvas](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.13/investigate-and-respond-to-threats/day-to-day-tasks-in-cortex-xsoar/incident-management/investigate-an-incident-using-the-canvas.md): Visually map incident investigations with the canvas in Cortex XSOAR 6.13. * [Auto Populate the Canvas](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.13/investigate-and-respond-to-threats/day-to-day-tasks-in-cortex-xsoar/incident-management/investigate-an-incident-using-the-canvas/auto-populate-the-canvas.md): Automatically populate the investigation canvas in Cortex XSOAR 6.13. * [Dbot Suggestions: Quick View Window](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.13/investigate-and-respond-to-threats/day-to-day-tasks-in-cortex-xsoar/incident-management/investigate-an-incident-using-the-canvas/dbot-suggestions-quick-view-window.md): View Dbot suggestions in the Quick View window in Cortex XSOAR 6.13. * [Edit Dbot Incident and Indicator Suggestions](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.13/investigate-and-respond-to-threats/day-to-day-tasks-in-cortex-xsoar/incident-management/investigate-an-incident-using-the-canvas/edit-dbot-incident-and-indicator-suggestions.md): Edit Dbot incident and indicator suggestions in Cortex XSOAR 6.13. * [Incident Actions](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.13/investigate-and-respond-to-threats/day-to-day-tasks-in-cortex-xsoar/incident-management/incident-actions.md): Manage tasks, notes, reports, and restrictions in Cortex XSOAR 6.13 incidents. * [Evidence Handling](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.13/investigate-and-respond-to-threats/day-to-day-tasks-in-cortex-xsoar/incident-management/evidence-handling.md): Add and manage investigation evidence in the Cortex XSOAR 6.13 War Room. * [Incident Tasks](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.13/investigate-and-respond-to-threats/day-to-day-tasks-in-cortex-xsoar/incident-management/incident-tasks.md): Add and manage Playbook and to-do tasks in Cortex XSOAR 6.13 incidents. * [Link Incidents](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.13/investigate-and-respond-to-threats/day-to-day-tasks-in-cortex-xsoar/incident-management/link-incidents.md): Link related incidents through the UI, rules, or CLI in Cortex XSOAR 6.13. * [Manage Related Incidents](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.13/investigate-and-respond-to-threats/day-to-day-tasks-in-cortex-xsoar/incident-management/link-incidents/manage-related-incidents.md): Manage related incidents in Cortex XSOAR 6.13. * [Link and Unlink incidents in the CLI](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.13/investigate-and-respond-to-threats/day-to-day-tasks-in-cortex-xsoar/incident-management/link-incidents/link-and-unlink-incidents-in-the-cli.md): Link and unlink incidents from the CLI in Cortex XSOAR 6.13. * [Configure Incident Fields for Related Incidents](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.13/investigate-and-respond-to-threats/day-to-day-tasks-in-cortex-xsoar/incident-management/configure-incident-fields-for-related-incidents.md): Configure fields for related incidents in Cortex XSOAR 6.13. * [Indicator Management](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.13/investigate-and-respond-to-threats/day-to-day-tasks-in-cortex-xsoar/indicator-management.md): Manage, search, create, edit, export, and delete indicators in Cortex XSOAR 6.13. * [Indicator Query](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.13/investigate-and-respond-to-threats/day-to-day-tasks-in-cortex-xsoar/indicator-management/indicator-query.md): Search, create, edit, export, and delete indicators in Cortex XSOAR 6.13. * [Configure the Indicator Timeline](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.13/investigate-and-respond-to-threats/day-to-day-tasks-in-cortex-xsoar/indicator-management/configure-the-indicator-timeline.md): Configure and improve the indicator timeline in Cortex XSOAR 6.13. * [Exclusion List](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.13/investigate-and-respond-to-threats/day-to-day-tasks-in-cortex-xsoar/indicator-management/exclusion-list.md): Add indicators to exclusion lists in Cortex XSOAR 6.13. * [Export Indicators](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.13/investigate-and-respond-to-threats/day-to-day-tasks-in-cortex-xsoar/indicator-management/export-indicators.md): Export indicators as lists or files in Cortex XSOAR 6.13. * [Reference](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.13/reference-docs/reference.md): Reference information for Cortex XSOAR 6.13. * [Navigation Cheat Sheet](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.13/reference-docs/reference/navigation-cheat-sheet.md): Learn about commonly used features in Cortex XSOAR 6.13. * [Server Configurations](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.13/reference-docs/reference/server-configurations.md): Server configurations for customization and troubleshooting in Cortex XSOAR 6.13. * [Modify Server Configurations](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.13/reference-docs/reference/server-configurations/modify-server-configurations.md): Customize and troubleshoot Cortex XSOAR 6.13 with server configuration settings. * [Active Directory Server Configurations](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.13/reference-docs/reference/server-configurations/active-directory-server-configurations.md): Review Active Directory server configurations in Cortex XSOAR 6.13. * [Automation Server Configurations](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.13/reference-docs/reference/server-configurations/automation-server-configurations.md): Review automation server configurations in Cortex XSOAR 6.13. * [Dashboard Server Configurations](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.13/reference-docs/reference/server-configurations/dashboard-server-configurations.md): Review dashboard server configurations in Cortex XSOAR 6.13. * [Database Server Configurations](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.13/reference-docs/reference/server-configurations/database-server-configurations.md): Review database server configurations in Cortex XSOAR 6.13. * [Disaster Recovery Server Configurations](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.13/reference-docs/reference/server-configurations/disaster-recovery-server-configurations.md): Review disaster recovery server configurations in Cortex XSOAR 6.13. * [Docker Server Configurations](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.13/reference-docs/reference/server-configurations/docker-server-configurations.md): Review Docker server configurations in Cortex XSOAR 6.13. * [Elasticsearch Server Configurations](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.13/reference-docs/reference/server-configurations/elasticsearch-server-configurations.md): Review Elasticsearch server configurations in Cortex XSOAR 6.13. * [Engine Server Configurations](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.13/reference-docs/reference/server-configurations/engine-server-configurations.md): Review engine server configurations in Cortex XSOAR 6.13. * [General Server Configurations](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.13/reference-docs/reference/server-configurations/general-server-configurations.md): Review general server configurations in Cortex XSOAR 6.13. * [Google API Server Configuration](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.13/reference-docs/reference/server-configurations/google-api-server-configuration.md): Review Google API server configuration in Cortex XSOAR 6.13. * [Incident Server Configurations](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.13/reference-docs/reference/server-configurations/incident-server-configurations.md): Review incident server configurations in Cortex XSOAR 6.13. * [Indicator Server Configurations](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.13/reference-docs/reference/server-configurations/indicator-server-configurations.md): Review indicator server configurations in Cortex XSOAR 6.13. * [Integration Server Configurations](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.13/reference-docs/reference/server-configurations/integration-server-configurations.md): Review integration server configurations in Cortex XSOAR 6.13. * [List Server Configurations](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.13/reference-docs/reference/server-configurations/list-server-configurations.md): Review list server configurations in Cortex XSOAR 6.13. * [Logs Server Configurations](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.13/reference-docs/reference/server-configurations/logs-server-configurations.md): Review log server configurations in Cortex XSOAR 6.13. * [Marketplace Server Configurations](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.13/reference-docs/reference/server-configurations/marketplace-server-configurations.md): Review Marketplace server configurations in Cortex XSOAR 6.13. * [Multi-Tenant Server Configurations](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.13/reference-docs/reference/server-configurations/multi-tenant-server-configurations.md): Review multi-tenant server configurations in Cortex XSOAR 6.13. * [Notification Server Configurations](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.13/reference-docs/reference/server-configurations/notification-server-configurations.md): Review notification server configurations in Cortex XSOAR 6.13. * [Playbook Server Configurations](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.13/reference-docs/reference/server-configurations/playbook-server-configurations.md): Review playbook server configurations in Cortex XSOAR 6.13. * [Proxy Server Configurations](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.13/reference-docs/reference/server-configurations/proxy-server-configurations.md): Review proxy server configurations in Cortex XSOAR 6.13. * [Remote Repository Server Configurations](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.13/reference-docs/reference/server-configurations/remote-repository-server-configurations.md): Review remote repository server configurations in Cortex XSOAR 6.13. * [Report Server Configurations](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.13/reference-docs/reference/server-configurations/report-server-configurations.md): Review report server configurations in Cortex XSOAR 6.13. * [Security Headers Server Configurations](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.13/reference-docs/reference/server-configurations/security-headers-server-configurations.md): Review security header server configurations in Cortex XSOAR 6.13. * [SLA Server Configuration](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.13/reference-docs/reference/server-configurations/sla-server-configuration.md): Review SLA server configuration in Cortex XSOAR 6.13. * [System Diagnostics Server Configurations](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.13/reference-docs/reference/server-configurations/system-diagnostics-server-configurations.md): Review system diagnostics server configurations in Cortex XSOAR 6.13. * [Users and Roles Server Configurations](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.13/reference-docs/reference/server-configurations/users-and-roles-server-configurations.md): Review user and role server configurations in Cortex XSOAR 6.13. * [War Room Server Configurations](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.13/reference-docs/reference/server-configurations/war-room-server-configurations.md): Review War Room server configurations in Cortex XSOAR 6.13. * [Widget Server Configurations](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.13/reference-docs/reference/server-configurations/widget-server-configurations.md): Review widget server configurations in Cortex XSOAR 6.13. * [System Diagnostics](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.13/reference-docs/reference/system-diagnostics.md): Find and fix system performance issues in Cortex XSOAR 6.13. * [Fix System Diagnostics Issues](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.13/reference-docs/reference/system-diagnostics/fix-system-diagnostics-issues.md): Fix System Diagnostics alerts in Cortex XSOAR 6.13. * [Performance Tuning for Cortex XSOAR](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.13/reference-docs/reference/performance-tuning-for-cortex-xsoar.md): Optimize system performance in Cortex XSOAR 6.13. * [Supported Ciphers](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.13/reference-docs/reference/supported-ciphers.md): Review TLS 1.2 and TLS 1.3 cipher suites in Cortex XSOAR 6.13. * [Telemetry](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.13/reference-docs/reference/telemetry.md): Configure telemetry data collection in Cortex XSOAR 6.13. * [Keyboard Shortcuts](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.13/reference-docs/reference/keyboard-shortcuts.md): Use keyboard shortcuts for Cortex XSOAR 6.13. * [Indicator Fields Structure](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.13/reference-docs/reference/indicator-fields-structure.md): Review STIX-aligned indicator field structures in Cortex XSOAR 6.13. - [Navigate the Cortex XSOAR 6.12 Administrator Guide](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.12/learn-about-cortex-xsoar/readme.md): Start here for a visual overview of the main Cortex XSOAR 6.12 (EoL) documentation areas. - [Overview](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.12/learn-about-cortex-xsoar/overview.md): Cortex XSOAR 6.12 provides security orchestration, incident management, and interactive investigation. Overview of Cortex XSOAR 6.12 features and concepts. - [Get Started in Cortex XSOAR](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.12/learn-about-cortex-xsoar/get-started-in-cortex-xsoar.md): Learn Cortex XSOAR 6.12 concepts, licenses, lifecycle details, API keys, search, CLI, and Markdown. - [Licenses](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.12/learn-about-cortex-xsoar/get-started-in-cortex-xsoar/licenses.md): Manage license types, user quotas, and access in Cortex XSOAR 6.12. - [FIPS Version](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.12/learn-about-cortex-xsoar/get-started-in-cortex-xsoar/fips-version.md): Use the vendor-affirmed FIPS version in Cortex XSOAR 6.12 with FIPS 140-3 validated cryptography. - [Concepts](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.12/learn-about-cortex-xsoar/get-started-in-cortex-xsoar/concepts.md): Learn core concepts, including incidents, integrations, playbooks, and automations, in Cortex XSOAR 6.12. - [Product Support Lifecycle](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.12/learn-about-cortex-xsoar/get-started-in-cortex-xsoar/product-support-lifecycle.md): Review the product support lifecycle and end-of-life dates for Cortex XSOAR 6.12. - [API Keys](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.12/learn-about-cortex-xsoar/get-started-in-cortex-xsoar/api-keys.md): Generate, manage, revoke, and secure API keys in Cortex XSOAR 6.12. - [Use the Command Line Interface](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.12/learn-about-cortex-xsoar/get-started-in-cortex-xsoar/use-the-command-line-interface.md): Run system and integration commands from the CLI in Cortex XSOAR 6.12. - [How to Search](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.12/learn-about-cortex-xsoar/get-started-in-cortex-xsoar/how-to-search.md): Search incidents, indicators, and more in Cortex XSOAR 6.12 using query syntax. - [How to Use Markdown](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.12/learn-about-cortex-xsoar/get-started-in-cortex-xsoar/how-to-use-markdown.md): Format text with Markdown in Cortex XSOAR 6.12 across supported contexts. - [New User FAQ](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.12/learn-about-cortex-xsoar/get-started-in-cortex-xsoar/new-user-faq.md): Find answers to common new-user questions in Cortex XSOAR 6.12. - [Onboarding in Cortex XSOAR](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.12/onboard-cortex-xsoar/onboarding-in-cortex-xsoar.md): Onboarding process for Cortex XSOAR 6.12. - [Deployment Checklist - Best Practices](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.12/onboard-cortex-xsoar/deployment-checklist-best-practices.md): Overview of the deployment process, including best practices for Cortex XSOAR 6.12 installation and maintenance. - [Single Server Deployment](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.12/onboard-cortex-xsoar/single-server-deployment.md): Install and configure a single-server deployment in Cortex XSOAR 6.12. - [System Requirements](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.12/onboard-cortex-xsoar/single-server-deployment/system-requirements.md): Verify the software, hardware, and network requirements in Cortex XSOAR 6.12. - [Deployment Guidelines](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.12/onboard-cortex-xsoar/single-server-deployment/deployment-guidelines.md): Review cloud deployment guidelines for Cortex XSOAR 6.12 on AWS, Azure, and GCP. - [AWS EC2 Deployment Guidelines](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.12/onboard-cortex-xsoar/single-server-deployment/deployment-guidelines/aws-ec2-deployment-guidelines.md): Review AWS EC2 deployment guidelines for Cortex XSOAR 6.12. - [Azure Virtual Machines Deployment Guidelines](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.12/onboard-cortex-xsoar/single-server-deployment/deployment-guidelines/azure-virtual-machines-deployment-guidelines.md): Review Azure virtual machine deployment guidelines for Cortex XSOAR 6.12. - [GCP Compute Engine Deployment Guidelines](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.12/onboard-cortex-xsoar/single-server-deployment/deployment-guidelines/gcp-compute-engine-deployment-guidelines.md): Review GCP Compute Engine deployment guidelines for Cortex XSOAR 6.12. - [Install the Server for a Single Server Deployment](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.12/onboard-cortex-xsoar/single-server-deployment/install-the-server-for-a-single-server-deployment.md): Install Cortex XSOAR 6.12 with the application and database servers on one machine. - [Installer Flags](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.12/onboard-cortex-xsoar/single-server-deployment/install-the-server-for-a-single-server-deployment/installer-flags.md): Review installer flags for a single-server deployment in Cortex XSOAR 6.12. - [Install the Server with Elasticsearch](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.12/onboard-cortex-xsoar/single-server-deployment/install-the-server-with-elasticsearch.md): Install Cortex XSOAR 6.12 with Elasticsearch as the database. - [Install the Server Offline](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.12/onboard-cortex-xsoar/single-server-deployment/install-the-server-offline.md): Install Cortex XSOAR 6.12 without internet access. - [Dependencies for Offline Installation](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.12/onboard-cortex-xsoar/single-server-deployment/install-the-server-offline/dependencies-for-offline-installation.md): Prepare required dependencies for an offline installation of Cortex XSOAR 6.12. - [Add a License](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.12/onboard-cortex-xsoar/single-server-deployment/add-a-license.md): Add a license file through the UI or server in Cortex XSOAR 6.12. - [Post-Installation Checklist](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.12/onboard-cortex-xsoar/single-server-deployment/post-installation-checklist.md): Complete post-installation tasks and troubleshoot Cortex XSOAR 6.12. - [Server Post-Installation Health Check](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.12/onboard-cortex-xsoar/single-server-deployment/post-installation-checklist/server-post-installation-health-check.md): Verify server health after installing Cortex XSOAR 6.12. - [Monitor Components](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.12/onboard-cortex-xsoar/single-server-deployment/post-installation-checklist/monitor-components.md): Monitor server components in Cortex XSOAR 6.12. - [HTTPS with a Signed Certificate](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.12/onboard-cortex-xsoar/single-server-deployment/post-installation-checklist/https-with-a-signed-certificate.md): Configure HTTPS with a signed certificate in Cortex XSOAR 6.12. - [Create a Self-Signed Certificate](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.12/onboard-cortex-xsoar/single-server-deployment/post-installation-checklist/https-with-a-signed-certificate/create-a-self-signed-certificate.md): Create a self-signed certificate for Cortex XSOAR 6.12. - [Install or Renew a Custom Certificate](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.12/onboard-cortex-xsoar/single-server-deployment/post-installation-checklist/https-with-a-signed-certificate/install-or-renew-a-custom-certificate.md): Install or renew a custom certificate in Cortex XSOAR 6.12. - [Configure the Server to Listen on HTTP](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.12/onboard-cortex-xsoar/single-server-deployment/post-installation-checklist/configure-the-server-to-listen-on-http.md): Configure an HTTP listener for the server in Cortex XSOAR 6.12. - [Troubleshoot WebSockets](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.12/onboard-cortex-xsoar/single-server-deployment/post-installation-checklist/troubleshoot-websockets.md): Troubleshoot WebSocket connectivity in Cortex XSOAR 6.12. - [Upgrade the Cortex XSOAR Server](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.12/onboard-cortex-xsoar/single-server-deployment/upgrade-the-cortex-xsoar-server.md): Prepare, upgrade, and complete post-upgrade tasks for Cortex XSOAR 6.12. - [Uninstall the Server](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.12/onboard-cortex-xsoar/single-server-deployment/uninstall-the-server.md): Uninstall the server and preserve relevant files in Cortex XSOAR 6.12. - [Elasticsearch](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.12/onboard-cortex-xsoar/elasticsearch.md): Set up, secure, migrate, and troubleshoot Elasticsearch in Cortex XSOAR 6.12. - [Elasticsearch Overview](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.12/onboard-cortex-xsoar/elasticsearch/elasticsearch-overview.md): Understand Elasticsearch data migration and indexing in Cortex XSOAR 6.12. - [Elasticsearch Setup](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.12/onboard-cortex-xsoar/elasticsearch/elasticsearch-setup.md): Configure Elasticsearch sizing, settings, and best practices for Cortex XSOAR 6.12. - [Elasticsearch System Requirements](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.12/onboard-cortex-xsoar/elasticsearch/elasticsearch-setup/elasticsearch-system-requirements.md): Review Elasticsearch system requirements for Cortex XSOAR 6.12. - [Elasticsearch Configurations](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.12/onboard-cortex-xsoar/elasticsearch/elasticsearch-setup/elasticsearch-configurations.md): Configure Elasticsearch settings for Cortex XSOAR 6.12. - [Elasticsearch Data Management](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.12/onboard-cortex-xsoar/elasticsearch/elasticsearch-setup/elasticsearch-data-management.md): Manage Elasticsearch data in Cortex XSOAR 6.12. - [Elasticsearch Security](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.12/onboard-cortex-xsoar/elasticsearch/elasticsearch-security.md): Apply Elasticsearch security guidelines in Cortex XSOAR 6.12 deployments. - [Elasticsearch General Security Guidelines](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.12/onboard-cortex-xsoar/elasticsearch/elasticsearch-security/elasticsearch-general-security-guidelines.md): Apply general Elasticsearch security guidelines in Cortex XSOAR 6.12. - [Elasticsearch Security Guidelines - Multi-tenant Deployments](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.12/onboard-cortex-xsoar/elasticsearch/elasticsearch-security/elasticsearch-security-guidelines-multi-tenant-deployments.md): Secure multi-tenant Elasticsearch deployments in Cortex XSOAR 6.12. - [Migration](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.12/onboard-cortex-xsoar/elasticsearch/migration.md): Migrate Cortex XSOAR 6.12 data to Elasticsearch for single-server or multi-tenant deployments. - [Elasticsearch Migration Overview](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.12/onboard-cortex-xsoar/elasticsearch/migration/elasticsearch-migration-overview.md): Understand Elasticsearch migration in Cortex XSOAR 6.12. - [Migrate Objects to Elasticsearch for a Single Server](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.12/onboard-cortex-xsoar/elasticsearch/migration/migrate-objects-to-elasticsearch-for-a-single-server.md): Migrate single-server objects to Elasticsearch in Cortex XSOAR 6.12. - [Migrate Objects to Elasticsearch for Multi-Tenant](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.12/onboard-cortex-xsoar/elasticsearch/migration/migrate-objects-to-elasticsearch-for-multi-tenant.md): Migrate multi-tenant objects to Elasticsearch in Cortex XSOAR 6.12. - [Migrate an Existing Elasticsearch Deployment](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.12/onboard-cortex-xsoar/elasticsearch/migration/migrate-an-existing-elasticsearch-deployment.md): Migrate an existing Elasticsearch deployment in Cortex XSOAR 6.12. - [Migrate Objects to Elasticsearch for a Distributed Database](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.12/onboard-cortex-xsoar/elasticsearch/migration/migrate-objects-to-elasticsearch-for-a-distributed-database.md): Migrate distributed database objects to Elasticsearch in Cortex XSOAR 6.12. - [Manage Partial Migration to Elasticsearch](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.12/onboard-cortex-xsoar/elasticsearch/migration/manage-partial-migration-to-elasticsearch.md): Manage partial Elasticsearch migration in Cortex XSOAR 6.12. - [Validate the Migration to Elasticsearch](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.12/onboard-cortex-xsoar/elasticsearch/migration/validate-the-migration-to-elasticsearch.md): Validate an Elasticsearch migration in Cortex XSOAR 6.12. - [Elasticsearch Post Migration Health Check](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.12/onboard-cortex-xsoar/elasticsearch/migration/elasticsearch-post-migration-health-check.md): Verify Elasticsearch health after migration in Cortex XSOAR 6.12. - [Disaster Recovery for Elasticsearch](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.12/onboard-cortex-xsoar/elasticsearch/disaster-recovery-for-elasticsearch.md): Back up and restore Elasticsearch deployments in Cortex XSOAR 6.12 using snapshots. - [Create Elasticsearch Snapshots](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.12/onboard-cortex-xsoar/elasticsearch/disaster-recovery-for-elasticsearch/create-elasticsearch-snapshots.md): Create Elasticsearch snapshots in Cortex XSOAR 6.12. - [Restore Elasticsearch Snapshots](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.12/onboard-cortex-xsoar/elasticsearch/disaster-recovery-for-elasticsearch/restore-elasticsearch-snapshots.md): Restore Elasticsearch snapshots in Cortex XSOAR 6.12. - [Archive Data with Elasticsearch](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.12/onboard-cortex-xsoar/elasticsearch/disaster-recovery-for-elasticsearch/archive-data-with-elasticsearch.md): Archive Cortex XSOAR 6.12 data with Elasticsearch index lifecycle management. - [Troubleshoot Elasticsearch](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.12/onboard-cortex-xsoar/elasticsearch/disaster-recovery-for-elasticsearch/troubleshoot-elasticsearch.md): Troubleshoot Elasticsearch deployments in Cortex XSOAR 6.12. - [Docker](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.12/onboard-cortex-xsoar/docker.md): Install, configure, secure, and troubleshoot Docker in Cortex XSOAR 6.12. - [Docker Overview](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.12/onboard-cortex-xsoar/docker/docker-overview.md): Understand Docker usage, security, and predictability in Cortex XSOAR 6.12. - [Docker Installation](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.12/onboard-cortex-xsoar/docker/docker-installation.md): Install and troubleshoot Docker on supported platforms in Cortex XSOAR 6.12. - [Configure Python Docker Integrations to Trust Custom Certificates](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.12/onboard-cortex-xsoar/docker/configure-python-docker-integrations-to-trust-custom-certificates.md): Configure Python Docker integrations to trust custom certificates in Cortex XSOAR 6.12. - [Docker Images in Cortex XSOAR](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.12/onboard-cortex-xsoar/docker/docker-images-in-cortex-xsoar.md): Run scripts and integrations in Docker images in Cortex XSOAR 6.12. - [Create a Docker Image In Cortex XSOAR](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.12/onboard-cortex-xsoar/docker/docker-images-in-cortex-xsoar/create-a-docker-image-in-cortex-xsoar.md): Create a Docker image in Cortex XSOAR 6.12. - [Install Docker Images Offline](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.12/onboard-cortex-xsoar/docker/docker-images-in-cortex-xsoar/install-docker-images-offline.md): Install Docker images offline in Cortex XSOAR 6.12. - [Docker Image Security](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.12/onboard-cortex-xsoar/docker/docker-images-in-cortex-xsoar/docker-image-security.md): Secure Docker images in Cortex XSOAR 6.12. - [Manage Docker Images](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.12/onboard-cortex-xsoar/docker/docker-images-in-cortex-xsoar/manage-docker-images.md): Manage Docker images in Cortex XSOAR 6.12. - [Change the Docker Image for Automations and Integrations](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.12/onboard-cortex-xsoar/docker/docker-images-in-cortex-xsoar/change-the-docker-image-for-automations-and-integrations.md): Change automation and integration Docker images in Cortex XSOAR 6.12. - [Use the Cortex XSOAR Container Registry](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.12/onboard-cortex-xsoar/docker/docker-images-in-cortex-xsoar/use-the-cortex-xsoar-container-registry.md): Use the container registry in Cortex XSOAR 6.12. - [Docker Hardening Guide](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.12/onboard-cortex-xsoar/docker/docker-hardening-guide.md): Apply Docker hardening settings in Cortex XSOAR 6.12. - [Run Docker with Non-Root Internal Users](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.12/onboard-cortex-xsoar/docker/docker-hardening-guide/run-docker-with-non-root-internal-users.md): Run Docker with non-root internal users in Cortex XSOAR 6.12. - [Configure Memory Limit Support Without Swap Limit Capabilities](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.12/onboard-cortex-xsoar/docker/docker-hardening-guide/configure-memory-limit-support-without-swap-limit-capabilities.md): Configure memory limits without swap support in Cortex XSOAR 6.12. - [Configure the Memory Limitation](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.12/onboard-cortex-xsoar/docker/docker-hardening-guide/configure-the-memory-limitation.md): Configure Docker memory limits in Cortex XSOAR 6.12. - [Test the Memory Limit](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.12/onboard-cortex-xsoar/docker/docker-hardening-guide/test-the-memory-limit.md): Test Docker memory limits in Cortex XSOAR 6.12. - [Limit Available CPU](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.12/onboard-cortex-xsoar/docker/docker-hardening-guide/limit-available-cpu.md): Limit Docker CPU resources in Cortex XSOAR 6.12. - [Configure the PIDs Limit](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.12/onboard-cortex-xsoar/docker/docker-hardening-guide/configure-the-pids-limit.md): Configure Docker process limits in Cortex XSOAR 6.12. - [Configure the Open File Descriptors Limit](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.12/onboard-cortex-xsoar/docker/docker-hardening-guide/configure-the-open-file-descriptors-limit.md): Configure Docker open file descriptor limits in Cortex XSOAR 6.12. - [Docker Network Hardening](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.12/onboard-cortex-xsoar/docker/docker-hardening-guide/docker-network-hardening.md): Harden Docker networking in Cortex XSOAR 6.12. - [Docker FAQs](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.12/onboard-cortex-xsoar/docker/docker-faqs.md): Find Docker answers and guidance in Cortex XSOAR 6.12. - [Troubleshoot Docker Networking Issues](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.12/onboard-cortex-xsoar/docker/troubleshoot-docker-networking-issues.md): Troubleshoot Docker networking issues in Cortex XSOAR 6.12. - [Troubleshoot Docker Performance Issues](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.12/onboard-cortex-xsoar/docker/troubleshoot-docker-performance-issues.md): Troubleshoot Docker performance issues in Cortex XSOAR 6.12. - [Configure Docker Pull Rate Limit](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.12/onboard-cortex-xsoar/docker/configure-docker-pull-rate-limit.md): Configure Docker image pull rate limits in Cortex XSOAR 6.12. - [Change the Docker Installation Folder](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.12/onboard-cortex-xsoar/docker/change-the-docker-installation-folder.md): Change the Docker installation folder in Cortex XSOAR 6.12. - [Podman](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.12/onboard-cortex-xsoar/podman.md): Run Podman containers instead of Docker in Cortex XSOAR 6.12. - [Podman Overview](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.12/onboard-cortex-xsoar/podman/podman-overview.md): Understand Podman containers for Cortex XSOAR 6.12 deployments. - [Change container storage directory](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.12/onboard-cortex-xsoar/podman/change-container-storage-directory.md): Change the Podman container storage directory in Cortex XSOAR 6.12. - [Podman Installation](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.12/onboard-cortex-xsoar/podman/podman-installation.md): Install Podman for Cortex XSOAR 6.12. - [Configure the SELinux Policy for PowerShell Integrations](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.12/onboard-cortex-xsoar/podman/configure-the-selinux-policy-for-powershell-integrations.md): Configure the SELinux policy for PowerShell integrations in Cortex XSOAR 6.12. - [Migrate From Docker to Podman](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.12/onboard-cortex-xsoar/podman/migrate-from-docker-to-podman.md): Migrate from Docker to Podman in Cortex XSOAR 6.12. - [Troubleshoot Podman](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.12/onboard-cortex-xsoar/podman/troubleshoot-podman.md): Troubleshoot Podman issues in Cortex XSOAR 6.12. - [Proxy](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.12/onboard-cortex-xsoar/proxy.md): Configure proxy settings in Cortex XSOAR 6.12. - [Configure Proxy Settings](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.12/onboard-cortex-xsoar/proxy/configure-proxy-settings.md): Configure global proxy settings in Cortex XSOAR 6.12. - [Configure how to bypass proxy settings](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.12/onboard-cortex-xsoar/proxy/configure-how-to-bypass-proxy-settings.md): Configure proxy bypass settings in Cortex XSOAR 6.12. - [Use NGINX as a Reverse Proxy to the Server](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.12/onboard-cortex-xsoar/proxy/use-nginx-as-a-reverse-proxy-to-the-server.md): Use NGINX as a reverse proxy in Cortex XSOAR 6.12. - [High Availability](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.12/onboard-cortex-xsoar/high-availability.md): Configure high availability with Elasticsearch in Cortex XSOAR 6.12. - [High Availability Overview](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.12/onboard-cortex-xsoar/high-availability/high-availability-overview.md): Understand high availability deployment architectures in Cortex XSOAR 6.12. - [Set Up High Availability](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.12/onboard-cortex-xsoar/high-availability/set-up-high-availability.md): Set up high availability in Cortex XSOAR 6.12. - [Sizing Requirements for High Availability Deployments](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.12/onboard-cortex-xsoar/high-availability/sizing-requirements-for-high-availability-deployments.md): Review high availability sizing requirements for Cortex XSOAR 6.12. - [Monitor the Health of the App Servers](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.12/onboard-cortex-xsoar/high-availability/monitor-the-health-of-the-app-servers.md): Monitor application server health in Cortex XSOAR 6.12 high availability deployments. - [Migrate a Single Instance for High Availability](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.12/onboard-cortex-xsoar/high-availability/migrate-a-single-instance-for-high-availability.md): Migrate a single instance to high availability in Cortex XSOAR 6.12. - [Migrate a Multi-Tenant Deployment for High Availability](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.12/onboard-cortex-xsoar/high-availability/migrate-a-multi-tenant-deployment-for-high-availability.md): Migrate a multi-tenant deployment to high availability in Cortex XSOAR 6.12. - [Install Additional App Servers](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.12/onboard-cortex-xsoar/high-availability/install-additional-app-servers.md): Install additional application servers in Cortex XSOAR 6.12 high availability deployments. - [Deploy Engines in a High Availability Environment](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.12/onboard-cortex-xsoar/high-availability/deploy-engines-in-a-high-availability-environment.md): Deploy engines in a high availability environment in Cortex XSOAR 6.12. - [Use a Signed Certificate](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.12/onboard-cortex-xsoar/high-availability/use-a-signed-certificate.md): Use a signed certificate in Cortex XSOAR 6.12 high availability deployments. - [Disaster Recovery and Live Backup](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.12/onboard-cortex-xsoar/disaster-recovery-and-live-backup.md): Configure live backup and disaster recovery in Cortex XSOAR 6.12. - [Disaster Recovery and Live Backup Overview](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.12/onboard-cortex-xsoar/disaster-recovery-and-live-backup/disaster-recovery-and-live-backup-overview.md): Understand live backup and disaster recovery in Cortex XSOAR 6.12. - [Host Names, DNS, and Disaster Recovery](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.12/onboard-cortex-xsoar/disaster-recovery-and-live-backup/host-names-dns-and-disaster-recovery.md): Configure host names and DNS for disaster recovery in Cortex XSOAR 6.12. - [Configure the Live Backup Environment](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.12/onboard-cortex-xsoar/disaster-recovery-and-live-backup/configure-the-live-backup-environment.md): Configure a live backup environment in Cortex XSOAR 6.12. - [Transition an Active Server to Standby Mode](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.12/onboard-cortex-xsoar/disaster-recovery-and-live-backup/transition-an-active-server-to-standby-mode.md): Transition an active server to standby mode in Cortex XSOAR 6.12. - [Transition a Standby Server to Active Mode](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.12/onboard-cortex-xsoar/disaster-recovery-and-live-backup/transition-a-standby-server-to-active-mode.md): Transition a standby server to active mode in Cortex XSOAR 6.12. - [Transition Between DR States Through the Configuration File](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.12/onboard-cortex-xsoar/disaster-recovery-and-live-backup/transition-between-dr-states-through-the-configuration-file.md): Transition disaster recovery states using configuration files in Cortex XSOAR 6.12. - [Upgrade the Live Backup Environment](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.12/onboard-cortex-xsoar/disaster-recovery-and-live-backup/upgrade-the-live-backup-environment.md): Upgrade the live backup environment in Cortex XSOAR 6.12. - [Engines and Disaster Recovery Troubleshooting](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.12/onboard-cortex-xsoar/disaster-recovery-and-live-backup/engines-and-disaster-recovery-troubleshooting.md): Troubleshoot engine failover during disaster recovery in Cortex XSOAR 6.12. - [Back up the Database](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.12/onboard-cortex-xsoar/disaster-recovery-and-live-backup/back-up-the-database.md): Back up the database in Cortex XSOAR 6.12. - [Restore the Database](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.12/onboard-cortex-xsoar/disaster-recovery-and-live-backup/restore-the-database.md): Restore the database from a backup in Cortex XSOAR 6.12. - [Restore a Partition](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.12/onboard-cortex-xsoar/disaster-recovery-and-live-backup/restore-a-partition.md): Restore database partitions in Cortex XSOAR 6.12. - [Troubleshoot Live Backup](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.12/onboard-cortex-xsoar/disaster-recovery-and-live-backup/troubleshoot-live-backup.md): Troubleshoot live backup scenarios in Cortex XSOAR 6.12. - [Users and Roles](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.12/onboard-cortex-xsoar/users-and-roles.md): Manage users, roles, and authentication in Cortex XSOAR 6.12. - [Users and Roles Overview](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.12/onboard-cortex-xsoar/users-and-roles/users-and-roles-overview.md): Understand user and role management in Cortex XSOAR 6.12. - [Roles in Cortex XSOAR](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.12/onboard-cortex-xsoar/users-and-roles/roles-in-cortex-xsoar.md): Manage roles and permissions in Cortex XSOAR 6.12. - [Pre-set Query per Role](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.12/onboard-cortex-xsoar/users-and-roles/roles-in-cortex-xsoar/pre-set-query-per-role.md): Configure pre-set queries for roles in Cortex XSOAR 6.12. - [Define a Role](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.12/onboard-cortex-xsoar/users-and-roles/roles-in-cortex-xsoar/define-a-role.md): Define a role and its permissions in Cortex XSOAR 6.12. - [Role-based Permission Levels](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.12/onboard-cortex-xsoar/users-and-roles/roles-in-cortex-xsoar/role-based-permission-levels.md): Understand role-based permission levels in Cortex XSOAR 6.12. - [Shift Management](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.12/onboard-cortex-xsoar/users-and-roles/roles-in-cortex-xsoar/shift-management.md): Manage user shifts in Cortex XSOAR 6.12. - [Managing Shifts](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.12/onboard-cortex-xsoar/users-and-roles/roles-in-cortex-xsoar/shift-management/managing-shifts.md): Manage shift schedules in Cortex XSOAR 6.12. - [User Management](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.12/onboard-cortex-xsoar/users-and-roles/user-management.md): Invite and manage users in Cortex XSOAR 6.12. - [User Invitations](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.12/onboard-cortex-xsoar/users-and-roles/user-management/user-invitations.md): Manage user invitations in Cortex XSOAR 6.12. - [Invite a User](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.12/onboard-cortex-xsoar/users-and-roles/user-management/user-invitations/invite-a-user.md): Invite a user in Cortex XSOAR 6.12. - [Set the User as Default Administrator](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.12/onboard-cortex-xsoar/users-and-roles/user-management/set-the-user-as-default-administrator.md): Set a user as the default administrator in Cortex XSOAR 6.12. - [Self-Service Read-Only Users](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.12/onboard-cortex-xsoar/users-and-roles/user-management/self-service-read-only-users.md): Configure self-service read-only users in Cortex XSOAR 6.12. - [Configure the Server for Self-Service Read-Only Users](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.12/onboard-cortex-xsoar/users-and-roles/user-management/self-service-read-only-users/configure-the-server-for-self-service-read-only-users.md): Configure self-service read-only users in Cortex XSOAR 6.12. - [Create the Self-Service Read-Only Users](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.12/onboard-cortex-xsoar/users-and-roles/user-management/self-service-read-only-users/create-the-self-service-read-only-users.md): Create self-service read-only users in Cortex XSOAR 6.12. - [Create the Read-Only Dashboard](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.12/onboard-cortex-xsoar/users-and-roles/user-management/self-service-read-only-users/create-the-read-only-dashboard.md): Create a read-only dashboard in Cortex XSOAR 6.12. - [Create the Read-Only Incident Type and Layout](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.12/onboard-cortex-xsoar/users-and-roles/user-management/self-service-read-only-users/create-the-read-only-incident-type-and-layout.md): Create read-only incident types and layouts in Cortex XSOAR 6.12. - [Disable a User](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.12/onboard-cortex-xsoar/users-and-roles/user-management/disable-a-user.md): Disable a user in Cortex XSOAR 6.12. - [Remove a User](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.12/onboard-cortex-xsoar/users-and-roles/user-management/remove-a-user.md): Remove a user in Cortex XSOAR 6.12. - [Clear Users Data Using the CLI](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.12/onboard-cortex-xsoar/users-and-roles/user-management/clear-users-data-using-the-cli.md): Clear user data with the CLI in Cortex XSOAR 6.12. - [Clear Users Data Using a Playbook](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.12/onboard-cortex-xsoar/users-and-roles/user-management/clear-users-data-using-a-playbook.md): Clear user data with a playbook in Cortex XSOAR 6.12. - [Configure Users Data Using Server Configurations](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.12/onboard-cortex-xsoar/users-and-roles/user-management/configure-users-data-using-server-configurations.md): Configure user data with server configurations in Cortex XSOAR 6.12. - [User Settings and Preferences](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.12/onboard-cortex-xsoar/users-and-roles/user-management/user-settings-and-preferences.md): Manage user settings and preferences in Cortex XSOAR 6.12. - [Configure User Settings](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.12/onboard-cortex-xsoar/users-and-roles/user-management/configure-user-settings.md): Configure user settings in Cortex XSOAR 6.12. - [Manually Refresh the Number of Licenses in Use](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.12/onboard-cortex-xsoar/users-and-roles/user-management/manually-refresh-the-number-of-licenses-in-use.md): Refresh license usage manually in Cortex XSOAR 6.12. - [Integration Permissions](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.12/onboard-cortex-xsoar/users-and-roles/integration-permissions.md): Assign integration command permissions in Cortex XSOAR 6.12. - [Password Policy](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.12/onboard-cortex-xsoar/users-and-roles/password-policy.md): Configure password policies in Cortex XSOAR 6.12. - [Create a Password Policy](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.12/onboard-cortex-xsoar/users-and-roles/password-policy/create-a-password-policy.md): Create a password policy in Cortex XSOAR 6.12. - [Edit a Default Password Policy](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.12/onboard-cortex-xsoar/users-and-roles/password-policy/edit-a-default-password-policy.md): Edit the default password policy in Cortex XSOAR 6.12. - [Default Password Policy Keys](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.12/onboard-cortex-xsoar/users-and-roles/password-policy/edit-a-default-password-policy/default-password-policy-keys.md): Reference default password policy keys in Cortex XSOAR 6.12. - [Change the Administrator Password](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.12/onboard-cortex-xsoar/users-and-roles/password-policy/change-the-administrator-password.md): Change the administrator password in Cortex XSOAR 6.12. - [Authenticate Users with SAML 2.0](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.12/onboard-cortex-xsoar/users-and-roles/authenticate-users-with-saml-2.0.md): Authenticate users with SAML 2.0 in Cortex XSOAR 6.12. - [Set up Okta as the Identity Provider Using SAML 2.0](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.12/onboard-cortex-xsoar/users-and-roles/authenticate-users-with-saml-2.0/set-up-okta-as-the-identity-provider-using-saml-2.0.md): Set up Okta SAML authentication in Cortex XSOAR 6.12. - [Create Okta Groups for Cortex XSOAR Users](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.12/onboard-cortex-xsoar/users-and-roles/authenticate-users-with-saml-2.0/set-up-okta-as-the-identity-provider-using-saml-2.0/create-okta-groups-for-cortex-xsoar-users.md): Create Okta groups for users in Cortex XSOAR 6.12. - [Define the Okta Application to authenticate Cortex XSOAR](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.12/onboard-cortex-xsoar/users-and-roles/authenticate-users-with-saml-2.0/set-up-okta-as-the-identity-provider-using-saml-2.0/define-the-okta-application-to-authenticate-cortex-xsoar.md): Define an Okta application for Cortex XSOAR 6.12 authentication. - [SAML Settings for the Okta Application](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.12/onboard-cortex-xsoar/users-and-roles/authenticate-users-with-saml-2.0/set-up-okta-as-the-identity-provider-using-saml-2.0/define-the-okta-application-to-authenticate-cortex-xsoar/saml-settings-for-the-okta-application.md): Configure SAML settings for an Okta application in Cortex XSOAR 6.12. - [Configure the SAML 2.0 Integration for Okta](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.12/onboard-cortex-xsoar/users-and-roles/authenticate-users-with-saml-2.0/set-up-okta-as-the-identity-provider-using-saml-2.0/configure-the-saml-2.0-integration-for-okta.md): Configure the Okta SAML 2.0 integration in Cortex XSOAR 6.12. - [SAML 2.0 Okta Parameters](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.12/onboard-cortex-xsoar/users-and-roles/authenticate-users-with-saml-2.0/set-up-okta-as-the-identity-provider-using-saml-2.0/configure-the-saml-2.0-integration-for-okta/saml-2.0-okta-parameters.md): Reference Okta SAML 2.0 parameters in Cortex XSOAR 6.12. - [Map Okta Groups to Cortex XSOAR Roles](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.12/onboard-cortex-xsoar/users-and-roles/authenticate-users-with-saml-2.0/set-up-okta-as-the-identity-provider-using-saml-2.0/map-okta-groups-to-cortex-xsoar-roles.md): Map Okta groups to roles in Cortex XSOAR 6.12. - [Set Up Microsoft Entra ID as the Identity Provider Using SAML 2.0](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.12/onboard-cortex-xsoar/users-and-roles/authenticate-users-with-saml-2.0/set-up-microsoft-entra-id-as-the-identity-provider-using-saml-2.0.md): Set up Microsoft Entra ID SAML authentication in Cortex XSOAR 6.12. - [Configure Microsoft Entra ID to Authenticate Cortex XSOAR](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.12/onboard-cortex-xsoar/users-and-roles/authenticate-users-with-saml-2.0/set-up-microsoft-entra-id-as-the-identity-provider-using-saml-2.0/configure-microsoft-entra-id-to-authenticate-cortex-xsoar.md): Configure Microsoft Entra ID authentication for Cortex XSOAR 6.12. - [Configure the SAML 2.0 Integration for Microsoft Entra ID](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.12/onboard-cortex-xsoar/users-and-roles/authenticate-users-with-saml-2.0/set-up-microsoft-entra-id-as-the-identity-provider-using-saml-2.0/configure-the-saml-2.0-integration-for-microsoft-entra-id.md): Configure Microsoft Entra ID SAML integration in Cortex XSOAR 6.12. - [SAML 2.0 Microsoft Entra ID Parameters](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.12/onboard-cortex-xsoar/users-and-roles/authenticate-users-with-saml-2.0/set-up-microsoft-entra-id-as-the-identity-provider-using-saml-2.0/configure-the-saml-2.0-integration-for-microsoft-entra-id/saml-2.0-microsoft-entra-id-parameters.md): Reference Microsoft Entra ID SAML parameters in Cortex XSOAR 6.12. - [Set up ADFS as the Identity Provider Using SAML 2.0](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.12/onboard-cortex-xsoar/users-and-roles/authenticate-users-with-saml-2.0/set-up-adfs-as-the-identity-provider-using-saml-2.0.md): Set up ADFS SAML authentication in Cortex XSOAR 6.12. - [Create Relying Party Trust in ADFS](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.12/onboard-cortex-xsoar/users-and-roles/authenticate-users-with-saml-2.0/set-up-adfs-as-the-identity-provider-using-saml-2.0/create-relying-party-trust-in-adfs.md): Create an ADFS relying party trust for Cortex XSOAR 6.12. - [Define the Claim Issuance Policy](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.12/onboard-cortex-xsoar/users-and-roles/authenticate-users-with-saml-2.0/set-up-adfs-as-the-identity-provider-using-saml-2.0/define-the-claim-issuance-policy.md): Define an ADFS claim issuance policy for Cortex XSOAR 6.12. - [Configure the SAML 2.0 Integration for ADFS](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.12/onboard-cortex-xsoar/users-and-roles/authenticate-users-with-saml-2.0/set-up-adfs-as-the-identity-provider-using-saml-2.0/configure-the-saml-2.0-integration-for-adfs.md): Configure the ADFS SAML 2.0 integration in Cortex XSOAR 6.12. - [SAML 2.0 ADFS Parameters](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.12/onboard-cortex-xsoar/users-and-roles/authenticate-users-with-saml-2.0/set-up-adfs-as-the-identity-provider-using-saml-2.0/configure-the-saml-2.0-integration-for-adfs/saml-2.0-adfs-parameters.md): Reference ADFS SAML 2.0 parameters in Cortex XSOAR 6.12. - [Map ADFS Groups to Cortex XSOAR Roles](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.12/onboard-cortex-xsoar/users-and-roles/authenticate-users-with-saml-2.0/set-up-adfs-as-the-identity-provider-using-saml-2.0/map-adfs-groups-to-cortex-xsoar-roles.md): Map ADFS groups to roles in Cortex XSOAR 6.12. - [Duo for Single Sign-On](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.12/onboard-cortex-xsoar/users-and-roles/authenticate-users-with-saml-2.0/duo-for-single-sign-on.md): Configure Duo single sign-on in Cortex XSOAR 6.12. - [Create Duo Groups for Cortex XSOAR Users](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.12/onboard-cortex-xsoar/users-and-roles/authenticate-users-with-saml-2.0/duo-for-single-sign-on/create-duo-groups-for-cortex-xsoar-users.md): Create Duo groups for users in Cortex XSOAR 6.12. - [Define Duo to authenticate Cortex XSOAR](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.12/onboard-cortex-xsoar/users-and-roles/authenticate-users-with-saml-2.0/duo-for-single-sign-on/define-duo-to-authenticate-cortex-xsoar.md): Define Duo authentication for Cortex XSOAR 6.12. - [Configure the SAML 2.0 Integration for Duo](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.12/onboard-cortex-xsoar/users-and-roles/authenticate-users-with-saml-2.0/duo-for-single-sign-on/configure-the-saml-2.0-integration-for-duo.md): Configure the Duo SAML 2.0 integration in Cortex XSOAR 6.12. - [Map Duo Groups to Cortex XSOAR Roles](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.12/onboard-cortex-xsoar/users-and-roles/authenticate-users-with-saml-2.0/duo-for-single-sign-on/map-duo-groups-to-cortex-xsoar-roles.md): Map Duo groups to roles in Cortex XSOAR 6.12. - [Set the Default Theme for New Users](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.12/onboard-cortex-xsoar/users-and-roles/set-the-default-theme-for-new-users.md): Set the default theme for new users in Cortex XSOAR 6.12. - [Authenticate Users with Active Directory](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.12/onboard-cortex-xsoar/users-and-roles/authenticate-users-with-active-directory.md): Authenticate users with Active Directory in Cortex XSOAR 6.12. - [Marketplace](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.12/onboard-cortex-xsoar/marketplace.md): Access Marketplace content and manage content packs in Cortex XSOAR 6.12. - [Marketplace Overview](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.12/onboard-cortex-xsoar/marketplace/marketplace-overview.md): Explore and manage Marketplace content in Cortex XSOAR 6.12. - [Content Packs Support Types](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.12/onboard-cortex-xsoar/marketplace/content-packs-support-types.md): Understand content pack support types in Cortex XSOAR 6.12. - [Marketplace FAQs](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.12/onboard-cortex-xsoar/marketplace/marketplace-faqs.md): Find Marketplace answers for Cortex XSOAR 6.12. - [Search and Navigate in the Marketplace](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.12/onboard-cortex-xsoar/marketplace/search-and-navigate-in-the-marketplace.md): Search and navigate Marketplace content in Cortex XSOAR 6.12. - [Convert Existing Content to Content Pack Format](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.12/onboard-cortex-xsoar/marketplace/convert-existing-content-to-content-pack-format.md): Convert existing content to content packs in Cortex XSOAR 6.12. - [Use Cases](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.12/onboard-cortex-xsoar/marketplace/use-cases.md): Explore Marketplace use cases in Cortex XSOAR 6.12. - [Content Pack Installation](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.12/onboard-cortex-xsoar/marketplace/content-pack-installation.md): Install and manage content packs in Cortex XSOAR 6.12. - [Install a Content Pack](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.12/onboard-cortex-xsoar/marketplace/content-pack-installation/install-a-content-pack.md): Install Marketplace content packs in Cortex XSOAR 6.12. - [Set up Your Use Case with the Deployment Wizard](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.12/onboard-cortex-xsoar/marketplace/content-pack-installation/install-a-content-pack/set-up-your-use-case-with-the-deployment-wizard.md): Configure a use case with the Deployment Wizard in Cortex XSOAR 6.12. - [Update a Content Pack](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.12/onboard-cortex-xsoar/marketplace/content-pack-installation/update-a-content-pack.md): Update Marketplace content packs in Cortex XSOAR 6.12. - [Delete a Content Pack](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.12/onboard-cortex-xsoar/marketplace/content-pack-installation/delete-a-content-pack.md): Delete Marketplace content packs in Cortex XSOAR 6.12. - [Revert a Content Pack](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.12/onboard-cortex-xsoar/marketplace/content-pack-installation/revert-a-content-pack.md): Revert content packs to earlier versions in Cortex XSOAR 6.12. - [Install a Content Pack Offline](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.12/onboard-cortex-xsoar/marketplace/install-a-content-pack-offline.md): Install Marketplace content packs offline in Cortex XSOAR 6.12. - [Content Pack Update Notifications](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.12/onboard-cortex-xsoar/marketplace/content-pack-update-notifications.md): Enable content pack update notifications in Cortex XSOAR 6.12. - [Marketplace Troubleshooting](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.12/onboard-cortex-xsoar/marketplace/marketplace-troubleshooting.md): Troubleshoot Marketplace issues in Cortex XSOAR 6.12. - [Content Pack Contributions](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.12/onboard-cortex-xsoar/marketplace/content-pack-contributions.md): Contribute content packs to Marketplace in Cortex XSOAR 6.12. - [Create a Content Pack](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.12/onboard-cortex-xsoar/marketplace/content-pack-contributions/create-a-content-pack.md): Create a content pack in Cortex XSOAR 6.12. - [Resubmit a Content Pack](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.12/onboard-cortex-xsoar/marketplace/content-pack-contributions/resubmit-a-content-pack.md): Resubmit a content pack in Cortex XSOAR 6.12. - [Remote Repositories in Cortex XSOAR](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.12/onboard-cortex-xsoar/remote-repositories-in-cortex-xsoar.md): Configure and manage remote repositories in Cortex XSOAR 6.12. - [Content Management in Cortex XSOAR](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.12/onboard-cortex-xsoar/remote-repositories-in-cortex-xsoar/content-management-in-cortex-xsoar.md): Manage content development and CI/CD in Cortex XSOAR 6.12. - [Remote Repositories Overview](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.12/onboard-cortex-xsoar/remote-repositories-in-cortex-xsoar/remote-repositories-overview.md): Understand remote repositories in Cortex XSOAR 6.12. - [Configure a Remote Repository on a Development Machine](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.12/onboard-cortex-xsoar/remote-repositories-in-cortex-xsoar/configure-a-remote-repository-on-a-development-machine.md): Configure a development remote repository in Cortex XSOAR 6.12. - [Configure a Remote Repository on the Production Machine](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.12/onboard-cortex-xsoar/remote-repositories-in-cortex-xsoar/configure-a-remote-repository-on-the-production-machine.md): Configure a production remote repository in Cortex XSOAR 6.12. - [Edit and Push Content to a Remote Repository](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.12/onboard-cortex-xsoar/remote-repositories-in-cortex-xsoar/edit-and-push-content-to-a-remote-repository.md): Edit and push remote repository content in Cortex XSOAR 6.12. - [Upgrade Remote Repositories from Versions 5.5 and below](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.12/onboard-cortex-xsoar/remote-repositories-in-cortex-xsoar/upgrade-remote-repositories-from-versions-5.5-and-below.md): Upgrade remote repositories for Cortex XSOAR 6.12. - [Troubleshoot a Remote Repository Configuration](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.12/onboard-cortex-xsoar/remote-repositories-in-cortex-xsoar/troubleshoot-a-remote-repository-configuration.md): Troubleshoot remote repository configurations in Cortex XSOAR 6.12. - [Engines](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.12/onboard-cortex-xsoar/engines.md): Install and manage engines in Cortex XSOAR 6.12. - [Cortex XSOAR Engines Overview](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.12/onboard-cortex-xsoar/engines/cortex-xsoar-engines-overview.md): Understand engine architecture in Cortex XSOAR 6.12. - [Engine Installation](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.12/onboard-cortex-xsoar/engines/engine-installation.md): Review engine installation options in Cortex XSOAR 6.12. - [Install a Cortex XSOAR Engine](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.12/onboard-cortex-xsoar/engines/engine-installation/install-a-cortex-xsoar-engine.md): Install an engine in Cortex XSOAR 6.12. - [Install a Signed Engine](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.12/onboard-cortex-xsoar/engines/engine-installation/install-a-signed-engine.md): Install a signed engine in Cortex XSOAR 6.12. - [Install a Cortex XSOAR Engine Offline](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.12/onboard-cortex-xsoar/engines/engine-installation/install-a-cortex-xsoar-engine-offline.md): Install an engine offline in Cortex XSOAR 6.12. - [Use an Engine in an Integration](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.12/onboard-cortex-xsoar/engines/use-an-engine-in-an-integration.md): Use an engine with an integration in Cortex XSOAR 6.12. - [Run a Script using an Engine](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.12/onboard-cortex-xsoar/engines/run-a-script-using-an-engine.md): Run scripts using an engine in Cortex XSOAR 6.12. - [Manage Engines](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.12/onboard-cortex-xsoar/engines/manage-engines.md): Manage engines and load-balancing groups in Cortex XSOAR 6.12. - [Configure Engines](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.12/onboard-cortex-xsoar/engines/configure-engines.md): Configure engines and their settings in Cortex XSOAR 6.12. - [Edit the Engine Configuration](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.12/onboard-cortex-xsoar/engines/configure-engines/edit-the-engine-configuration.md): Edit an engine configuration in Cortex XSOAR 6.12. - [Common Properties When Editing an Engine Configuration](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.12/onboard-cortex-xsoar/engines/configure-engines/edit-the-engine-configuration/common-properties-when-editing-an-engine-configuration.md): Configure common engine properties in Cortex XSOAR 6.12. - [Configure the Engine to Use a Web Proxy](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.12/onboard-cortex-xsoar/engines/configure-engines/edit-the-engine-configuration/common-properties-when-editing-an-engine-configuration/configure-the-engine-to-use-a-web-proxy.md): Configure an engine web proxy in Cortex XSOAR 6.12. - [Configure the Engine to Call the Server Without Using a Proxy](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.12/onboard-cortex-xsoar/engines/configure-engines/edit-the-engine-configuration/configure-the-engine-to-call-the-server-without-using-a-proxy.md): Configure direct engine-server communication in Cortex XSOAR 6.12. - [Configure Access to Communication Tasks through an Engine](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.12/onboard-cortex-xsoar/engines/configure-engines/edit-the-engine-configuration/configure-access-to-communication-tasks-through-an-engine.md): Configure communication task access through an engine in Cortex XSOAR 6.12. - [Configure the Number of Workers for the Server](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.12/onboard-cortex-xsoar/engines/configure-engines/edit-the-engine-configuration/configure-the-number-of-workers-for-the-server.md): Configure server workers through an engine in Cortex XSOAR 6.12. - [Configure an Engine to Use Custom Certificates](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.12/onboard-cortex-xsoar/engines/configure-engines/edit-the-engine-configuration/configure-an-engine-to-use-custom-certificates.md): Configure custom certificates for an engine in Cortex XSOAR 6.12. - [Notify Users When an Engine Disconnects](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.12/onboard-cortex-xsoar/engines/configure-engines/edit-the-engine-configuration/notify-users-when-an-engine-disconnects.md): Configure engine disconnect notifications in Cortex XSOAR 6.12. - [Remove an Engine](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.12/onboard-cortex-xsoar/engines/remove-an-engine.md): Remove an engine in Cortex XSOAR 6.12. - [Troubleshoot Cortex XSOAR Engines](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.12/onboard-cortex-xsoar/engines/troubleshoot-cortex-xsoar-engines.md): Troubleshoot engines in Cortex XSOAR 6.12. - [Customize and Configure Cortex XSOAR](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.12/configure-cortex-xsoar/customize-and-configure-cortex-xsoar.md): Customize and configure your Cortex XSOAR 6.12 deployment. - [Incidents](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.12/configure-cortex-xsoar/customize-and-configure-cortex-xsoar/incidents.md): Manage and investigate incidents in Cortex XSOAR 6.12. - [Incident Lifecycle](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.12/configure-cortex-xsoar/customize-and-configure-cortex-xsoar/incidents/incident-lifecycle.md): Understand the incident lifecycle in Cortex XSOAR 6.12. - [Incident Context Data](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.12/configure-cortex-xsoar/customize-and-configure-cortex-xsoar/incidents/incident-context-data.md): Manage incident context data in Cortex XSOAR 6.12. - [Incident Customization](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.12/configure-cortex-xsoar/customize-and-configure-cortex-xsoar/incidents/incident-customization.md): Customize incidents, fields, and layouts in Cortex XSOAR 6.12. - [Create an Incident Type](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.12/configure-cortex-xsoar/customize-and-configure-cortex-xsoar/incidents/incident-customization/create-an-incident-type.md): Create an incident type in Cortex XSOAR 6.12. - [Customize Incident Layouts](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.12/configure-cortex-xsoar/customize-and-configure-cortex-xsoar/incidents/incident-customization/customize-incident-layouts.md): Customize incident layouts in Cortex XSOAR 6.12. - [Incident Fields](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.12/configure-cortex-xsoar/customize-and-configure-cortex-xsoar/incidents/incident-customization/incident-fields.md): Manage incident fields in Cortex XSOAR 6.12. - [Create a Custom Incident Field](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.12/configure-cortex-xsoar/customize-and-configure-cortex-xsoar/incidents/incident-customization/incident-fields/create-a-custom-incident-field.md): Create a custom incident field in Cortex XSOAR 6.12. - [Create a Grid Field for an Incident Type](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.12/configure-cortex-xsoar/customize-and-configure-cortex-xsoar/incidents/incident-customization/incident-fields/create-a-grid-field-for-an-incident-type.md): Create a grid field for an incident type in Cortex XSOAR 6.12. - [Use Scripts with the Grid Field](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.12/configure-cortex-xsoar/customize-and-configure-cortex-xsoar/incidents/incident-customization/incident-fields/use-scripts-with-the-grid-field.md): Use scripts with grid fields in Cortex XSOAR 6.12. - [Incident Field Trigger Scripts](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.12/configure-cortex-xsoar/customize-and-configure-cortex-xsoar/incidents/incident-customization/incident-fields/incident-field-trigger-scripts.md): Configure incident field trigger scripts in Cortex XSOAR 6.12. - [Troubleshoot Closing Case Incident after Changing Field Type](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.12/configure-cortex-xsoar/customize-and-configure-cortex-xsoar/incidents/incident-customization/incident-fields/troubleshoot-closing-case-incident-after-changing-field-type.md): Troubleshoot case closure after field changes in Cortex XSOAR 6.12. - [Create an Evidence Field](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.12/configure-cortex-xsoar/customize-and-configure-cortex-xsoar/incidents/incident-customization/incident-fields/create-an-evidence-field.md): Create an evidence field in Cortex XSOAR 6.12. - [Incident De-Duplication](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.12/configure-cortex-xsoar/customize-and-configure-cortex-xsoar/incidents/incident-de-duplication.md): De-duplicate incidents in Cortex XSOAR 6.12. - [Pre-Process Rules](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.12/configure-cortex-xsoar/customize-and-configure-cortex-xsoar/incidents/pre-process-rules.md): Create incident pre-process rules in Cortex XSOAR 6.12. - [Post Processing for Incidents](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.12/configure-cortex-xsoar/customize-and-configure-cortex-xsoar/incidents/post-processing-for-incidents.md): Configure incident post-processing in Cortex XSOAR 6.12. - [War Room Overview](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.12/configure-cortex-xsoar/customize-and-configure-cortex-xsoar/incidents/war-room-overview.md): Investigate incidents with the War Room in Cortex XSOAR 6.12. - [Schedule a Command](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.12/configure-cortex-xsoar/customize-and-configure-cortex-xsoar/incidents/war-room-overview/schedule-a-command.md): Schedule a command in Cortex XSOAR 6.12. - [Add a Custom Widget in the War Room](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.12/configure-cortex-xsoar/customize-and-configure-cortex-xsoar/incidents/war-room-overview/add-a-custom-widget-in-the-war-room.md): Add a custom War Room widget in Cortex XSOAR 6.12. - [War Room Indexing](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.12/configure-cortex-xsoar/customize-and-configure-cortex-xsoar/incidents/war-room-overview/war-room-indexing.md): Configure War Room indexing in Cortex XSOAR 6.12. - [Index War Room Entries Using Bolt DB](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.12/configure-cortex-xsoar/customize-and-configure-cortex-xsoar/incidents/war-room-overview/war-room-indexing/index-war-room-entries-using-bolt-db.md): Index War Room entries with Bolt DB in Cortex XSOAR 6.12. - [Index War Room Entries Using Elasticsearch](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.12/configure-cortex-xsoar/customize-and-configure-cortex-xsoar/incidents/war-room-overview/war-room-indexing/index-war-room-entries-using-elasticsearch.md): Index War Room entries with Elasticsearch in Cortex XSOAR 6.12. - [Incident Access Control Configuration](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.12/configure-cortex-xsoar/customize-and-configure-cortex-xsoar/incidents/incident-access-control-configuration.md): Configure incident access control in Cortex XSOAR 6.12. - [Classification and Mapping](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.12/configure-cortex-xsoar/customize-and-configure-cortex-xsoar/incidents/classification-and-mapping.md): Classify and map incident data in Cortex XSOAR 6.12. - [Incident Mirroring](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.12/configure-cortex-xsoar/customize-and-configure-cortex-xsoar/incidents/incident-mirroring.md): Mirror incidents with integrations in Cortex XSOAR 6.12. - [Customize Incident Close Reasons](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.12/configure-cortex-xsoar/customize-and-configure-cortex-xsoar/incidents/customize-incident-close-reasons.md): Customize incident close reasons in Cortex XSOAR 6.12. - [Change the Display Name of Security Incidents](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.12/configure-cortex-xsoar/customize-and-configure-cortex-xsoar/incidents/change-the-display-name-of-security-incidents.md): Change security incident display names in Cortex XSOAR 6.12. - [Playbooks](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.12/configure-cortex-xsoar/customize-and-configure-cortex-xsoar/playbooks.md): Build security workflows with playbooks in Cortex XSOAR 6.12. - [What Are Playbooks?](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.12/configure-cortex-xsoar/customize-and-configure-cortex-xsoar/playbooks/what-are-playbooks.md): Understand playbooks in Cortex XSOAR 6.12. - [Playbook Development](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.12/configure-cortex-xsoar/customize-and-configure-cortex-xsoar/playbooks/playbook-development.md): Develop playbooks in Cortex XSOAR 6.12. - [Configure IoT Security Playbooks](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.12/configure-cortex-xsoar/customize-and-configure-cortex-xsoar/playbooks/configure-iot-security-playbooks.md): Configure IoT Security playbooks in Cortex XSOAR 6.12. - [Manage Playbook Settings](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.12/configure-cortex-xsoar/customize-and-configure-cortex-xsoar/playbooks/manage-playbook-settings.md): Manage playbook settings in Cortex XSOAR 6.12. - [Version Control](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.12/configure-cortex-xsoar/customize-and-configure-cortex-xsoar/playbooks/version-control.md): Manage playbook versions in Cortex XSOAR 6.12. - [Playbook Task Fields](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.12/configure-cortex-xsoar/customize-and-configure-cortex-xsoar/playbooks/playbook-task-fields.md): Configure playbook task fields in Cortex XSOAR 6.12. - [Create Section Headers](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.12/configure-cortex-xsoar/customize-and-configure-cortex-xsoar/playbooks/playbook-task-fields/create-section-headers.md): Create playbook section headers in Cortex XSOAR 6.12. - [Create a Conditional Task](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.12/configure-cortex-xsoar/customize-and-configure-cortex-xsoar/playbooks/playbook-task-fields/create-a-conditional-task.md): Create conditional playbook tasks in Cortex XSOAR 6.12. - [Communication Tasks](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.12/configure-cortex-xsoar/customize-and-configure-cortex-xsoar/playbooks/playbook-task-fields/communication-tasks.md): Configure communication tasks in Cortex XSOAR 6.12. - [Create an Ask Task](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.12/configure-cortex-xsoar/customize-and-configure-cortex-xsoar/playbooks/playbook-task-fields/communication-tasks/create-an-ask-task.md): Create Ask tasks in Cortex XSOAR 6.12. - [Ask Task Examples](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.12/configure-cortex-xsoar/customize-and-configure-cortex-xsoar/playbooks/playbook-task-fields/communication-tasks/create-an-ask-task/ask-task-examples.md): Review Ask task examples in Cortex XSOAR 6.12. - [Customize an Ask Task](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.12/configure-cortex-xsoar/customize-and-configure-cortex-xsoar/playbooks/playbook-task-fields/communication-tasks/create-an-ask-task/customize-an-ask-task.md): Customize Ask tasks in Cortex XSOAR 6.12. - [Create a Data Collection Task](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.12/configure-cortex-xsoar/customize-and-configure-cortex-xsoar/playbooks/playbook-task-fields/communication-tasks/create-a-data-collection-task.md): Create data collection tasks in Cortex XSOAR 6.12. - [Data Collection Task Examples](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.12/configure-cortex-xsoar/customize-and-configure-cortex-xsoar/playbooks/playbook-task-fields/communication-tasks/create-a-data-collection-task/data-collection-task-examples.md): Review data collection task examples in Cortex XSOAR 6.12. - [Customize a Data Collection Task](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.12/configure-cortex-xsoar/customize-and-configure-cortex-xsoar/playbooks/playbook-task-fields/communication-tasks/create-a-data-collection-task/customize-a-data-collection-task.md): Customize data collection tasks in Cortex XSOAR 6.12. - [Customize the SOC Name](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.12/configure-cortex-xsoar/customize-and-configure-cortex-xsoar/playbooks/playbook-task-fields/communication-tasks/customize-the-soc-name.md): Customize the SOC name in Cortex XSOAR 6.12. - [Create Communication Task Authentication](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.12/configure-cortex-xsoar/customize-and-configure-cortex-xsoar/playbooks/playbook-task-fields/communication-tasks/create-communication-task-authentication.md): Configure communication task authentication in Cortex XSOAR 6.12. - [Add Ad Hoc Tasks to a Work Plan](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.12/configure-cortex-xsoar/customize-and-configure-cortex-xsoar/playbooks/playbook-task-fields/communication-tasks/add-ad-hoc-tasks-to-a-work-plan.md): Add ad hoc Work Plan tasks in Cortex XSOAR 6.12. - [Handle Errors in a Playbook](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.12/configure-cortex-xsoar/customize-and-configure-cortex-xsoar/playbooks/playbook-task-fields/communication-tasks/handle-errors-in-a-playbook.md): Handle playbook errors in Cortex XSOAR 6.12. - [Playbook Task Fields](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.12/configure-cortex-xsoar/customize-and-configure-cortex-xsoar/playbooks/playbook-task-fields/communication-tasks/playbook-task-fields.md): Reference playbook task fields in Cortex XSOAR 6.12. - [Playbook Inputs and Outputs](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.12/configure-cortex-xsoar/customize-and-configure-cortex-xsoar/playbooks/playbook-inputs-and-outputs.md): Configure playbook inputs and outputs in Cortex XSOAR 6.12. - [Extend Context](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.12/configure-cortex-xsoar/customize-and-configure-cortex-xsoar/playbooks/extend-context.md): Extend context data in Cortex XSOAR 6.12. - [Filters and Transformers](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.12/configure-cortex-xsoar/customize-and-configure-cortex-xsoar/playbooks/filters-and-transformers.md): Use filters and transformers in Cortex XSOAR 6.12. - [Create Filters and Transformers in a Playbook](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.12/configure-cortex-xsoar/customize-and-configure-cortex-xsoar/playbooks/filters-and-transformers/create-filters-and-transformers-in-a-playbook.md): Create playbook filters and transformers in Cortex XSOAR 6.12. - [Create a Filter Example](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.12/configure-cortex-xsoar/customize-and-configure-cortex-xsoar/playbooks/filters-and-transformers/create-filters-and-transformers-in-a-playbook/create-a-filter-example.md): Review a filter example in Cortex XSOAR 6.12. - [Create a Filter (Advanced) Example](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.12/configure-cortex-xsoar/customize-and-configure-cortex-xsoar/playbooks/filters-and-transformers/create-filters-and-transformers-in-a-playbook/create-a-filter-advanced-example.md): Review an advanced filter example in Cortex XSOAR 6.12. - [Filter Operators](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.12/configure-cortex-xsoar/customize-and-configure-cortex-xsoar/playbooks/filters-and-transformers/filter-operators.md): Reference filter operators in Cortex XSOAR 6.12. - [Built-in Filters](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.12/configure-cortex-xsoar/customize-and-configure-cortex-xsoar/playbooks/filters-and-transformers/filter-operators/built-in-filters.md): Reference built-in filters in Cortex XSOAR 6.12. - [Transformers Operators](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.12/configure-cortex-xsoar/customize-and-configure-cortex-xsoar/playbooks/filters-and-transformers/filter-operators/transformers-operators.md): Reference transformer operators in Cortex XSOAR 6.12. - [Create Custom Filter and Transformer Operators](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.12/configure-cortex-xsoar/customize-and-configure-cortex-xsoar/playbooks/filters-and-transformers/filter-operators/create-custom-filter-and-transformer-operators.md): Create custom filter and transformer operators in Cortex XSOAR 6.12. - [Automations](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.12/configure-cortex-xsoar/customize-and-configure-cortex-xsoar/playbooks/automations.md): Create and manage automations in Cortex XSOAR 6.12. - [Configure a Sub-playbook Loop](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.12/configure-cortex-xsoar/customize-and-configure-cortex-xsoar/playbooks/configure-a-sub-playbook-loop.md): Configure sub-playbook loops in Cortex XSOAR 6.12. - [Playbook Polling](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.12/configure-cortex-xsoar/customize-and-configure-cortex-xsoar/playbooks/playbook-polling.md): Configure playbook polling in Cortex XSOAR 6.12. - [Create Incident Fields in a Playbook](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.12/configure-cortex-xsoar/customize-and-configure-cortex-xsoar/playbooks/create-incident-fields-in-a-playbook.md): Create incident fields with playbooks in Cortex XSOAR 6.12. - [Playbook Testing](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.12/configure-cortex-xsoar/customize-and-configure-cortex-xsoar/playbooks/playbook-testing.md): Test playbooks in Cortex XSOAR 6.12. - [Best Practices](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.12/configure-cortex-xsoar/customize-and-configure-cortex-xsoar/playbooks/best-practices.md): Apply playbook best practices in Cortex XSOAR 6.12. - [Jobs](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.12/configure-cortex-xsoar/customize-and-configure-cortex-xsoar/jobs.md): Configure and manage jobs in Cortex XSOAR 6.12. - [Create a Time Triggered Job](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.12/configure-cortex-xsoar/customize-and-configure-cortex-xsoar/jobs/create-a-time-triggered-job.md): Create time-triggered jobs in Cortex XSOAR 6.12. - [Create a Job Triggered by a Delta in Feed](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.12/configure-cortex-xsoar/customize-and-configure-cortex-xsoar/jobs/create-a-job-triggered-by-a-delta-in-feed.md): Create feed delta-triggered jobs in Cortex XSOAR 6.12. - [Time Triggered Job Parameters](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.12/configure-cortex-xsoar/customize-and-configure-cortex-xsoar/jobs/time-triggered-job-parameters.md): Reference time-triggered job parameters in Cortex XSOAR 6.12. - [Process Indicators Using a Job Triggered By Delta](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.12/configure-cortex-xsoar/customize-and-configure-cortex-xsoar/jobs/process-indicators-using-a-job-triggered-by-delta.md): Process indicators with delta-triggered jobs in Cortex XSOAR 6.12. - [Add Indicators to SIEM Using a Time Triggered Job](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.12/configure-cortex-xsoar/customize-and-configure-cortex-xsoar/jobs/add-indicators-to-siem-using-a-time-triggered-job.md): Send indicators to a SIEM with jobs in Cortex XSOAR 6.12. - [Work with SLAs](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.12/configure-cortex-xsoar/customize-and-configure-cortex-xsoar/work-with-slas.md): Create and manage SLAs in Cortex XSOAR 6.12. - [SLA Overview](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.12/configure-cortex-xsoar/customize-and-configure-cortex-xsoar/work-with-slas/sla-overview.md): Understand SLA fields and timers in Cortex XSOAR 6.12. - [Create an SLA Field](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.12/configure-cortex-xsoar/customize-and-configure-cortex-xsoar/work-with-slas/create-an-sla-field.md): Create SLA fields in Cortex XSOAR 6.12. - [Manage SLA and Timer Fields in an Incident](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.12/configure-cortex-xsoar/customize-and-configure-cortex-xsoar/work-with-slas/manage-sla-and-timer-fields-in-an-incident.md): Manage incident SLA and timer fields in Cortex XSOAR 6.12. - [Create an SLA Trigger](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.12/configure-cortex-xsoar/customize-and-configure-cortex-xsoar/work-with-slas/create-an-sla-trigger.md): Create SLA triggers in Cortex XSOAR 6.12. - [Customize SLA Scripts](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.12/configure-cortex-xsoar/customize-and-configure-cortex-xsoar/work-with-slas/customize-sla-scripts.md): Customize SLA scripts in Cortex XSOAR 6.12. - [Search Incidents using SLA and Timer Fields](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.12/configure-cortex-xsoar/customize-and-configure-cortex-xsoar/work-with-slas/search-incidents-using-sla-and-timer-fields.md): Search incidents using SLA and timer fields in Cortex XSOAR 6.12. - [Configure the Global Risk Threshold](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.12/configure-cortex-xsoar/customize-and-configure-cortex-xsoar/work-with-slas/configure-the-global-risk-threshold.md): Configure the global SLA risk threshold in Cortex XSOAR 6.12. - [Machine Learning](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.12/configure-cortex-xsoar/customize-and-configure-cortex-xsoar/machine-learning.md): Understand machine learning models in Cortex XSOAR 6.12. - [Machine Learning Capabilities](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.12/configure-cortex-xsoar/customize-and-configure-cortex-xsoar/machine-learning/machine-learning-capabilities.md): Explore machine learning capabilities in Cortex XSOAR 6.12. - [Machine Learning Models](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.12/configure-cortex-xsoar/customize-and-configure-cortex-xsoar/machine-learning/machine-learning-models.md): Use machine learning models for phishing incidents in Cortex XSOAR 6.12. - [Use the Phishing Classifier in Production](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.12/configure-cortex-xsoar/customize-and-configure-cortex-xsoar/machine-learning/use-the-phishing-classifier-in-production.md): Use the phishing classifier in production in Cortex XSOAR 6.12. - [Create a Machine Learning Model](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.12/configure-cortex-xsoar/customize-and-configure-cortex-xsoar/machine-learning/create-a-machine-learning-model.md): Create phishing classification models in Cortex XSOAR 6.12. - [Phishing Classifier Demo](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.12/configure-cortex-xsoar/customize-and-configure-cortex-xsoar/machine-learning/phishing-classifier-demo.md): Run the phishing classifier demonstration in Cortex XSOAR 6.12. - [Train a Phishing Classifier on Non-English Languages](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.12/configure-cortex-xsoar/customize-and-configure-cortex-xsoar/machine-learning/train-a-phishing-classifier-on-non-english-languages.md): Train phishing classifiers for non-English emails in Cortex XSOAR 6.12. - [Additional Machine Learning Scripts](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.12/configure-cortex-xsoar/customize-and-configure-cortex-xsoar/machine-learning/additional-machine-learning-scripts.md): Use additional machine learning scripts in Cortex XSOAR 6.12. - [Lists](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.12/configure-cortex-xsoar/customize-and-configure-cortex-xsoar/lists.md): Create and manage lists in Cortex XSOAR 6.12. - [Work With Lists](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.12/configure-cortex-xsoar/customize-and-configure-cortex-xsoar/lists/work-with-lists.md): Manage lists for automations and playbooks in Cortex XSOAR 6.12. - [Work with JSON Lists](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.12/configure-cortex-xsoar/customize-and-configure-cortex-xsoar/lists/work-with-lists/work-with-json-lists.md): Work with JSON lists in Cortex XSOAR 6.12. - [Create a List](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.12/configure-cortex-xsoar/customize-and-configure-cortex-xsoar/lists/create-a-list.md): Create lists for scripts and playbooks in Cortex XSOAR 6.12. - [Set the List Separator Character](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.12/configure-cortex-xsoar/customize-and-configure-cortex-xsoar/lists/set-the-list-separator-character.md): Set list separator characters in Cortex XSOAR 6.12. - [Transform a List into an Array](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.12/configure-cortex-xsoar/customize-and-configure-cortex-xsoar/lists/transform-a-list-into-an-array.md): Transform lists into arrays in Cortex XSOAR 6.12. - [Indicators](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.12/configure-cortex-xsoar/customize-and-configure-cortex-xsoar/indicators.md): Manage indicators in Cortex XSOAR 6.12. - [Indicator Concepts](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.12/configure-cortex-xsoar/customize-and-configure-cortex-xsoar/indicators/indicator-concepts.md): Understand indicator concepts in Cortex XSOAR 6.12. - [Indicator Verdict](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.12/configure-cortex-xsoar/customize-and-configure-cortex-xsoar/indicators/indicator-verdict.md): Understand indicator verdicts in Cortex XSOAR 6.12. - [Indicator Ingestion](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.12/configure-cortex-xsoar/customize-and-configure-cortex-xsoar/indicators/indicator-ingestion.md): Ingest indicators in Cortex XSOAR 6.12. - [Indicator Customization](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.12/configure-cortex-xsoar/customize-and-configure-cortex-xsoar/indicators/indicator-customization.md): Customize indicators in Cortex XSOAR 6.12. - [Indicator Types](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.12/configure-cortex-xsoar/customize-and-configure-cortex-xsoar/indicators/indicator-customization/indicator-types.md): Configure indicator types in Cortex XSOAR 6.12. - [File Indicators](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.12/configure-cortex-xsoar/customize-and-configure-cortex-xsoar/indicators/indicator-customization/indicator-types/file-indicators.md): Manage file indicators in Cortex XSOAR 6.12. - [File Indicator Merging Strategy](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.12/configure-cortex-xsoar/customize-and-configure-cortex-xsoar/indicators/indicator-customization/indicator-types/file-indicators/file-indicator-merging-strategy.md): Understand file indicator merging in Cortex XSOAR 6.12. - [Create an Indicator Type](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.12/configure-cortex-xsoar/customize-and-configure-cortex-xsoar/indicators/indicator-customization/indicator-types/create-an-indicator-type.md): Create indicator types in Cortex XSOAR 6.12. - [Indicator Type Profile](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.12/configure-cortex-xsoar/customize-and-configure-cortex-xsoar/indicators/indicator-customization/indicator-types/indicator-type-profile.md): Configure indicator type profiles in Cortex XSOAR 6.12. - [Map Custom Indicator Fields](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.12/configure-cortex-xsoar/customize-and-configure-cortex-xsoar/indicators/indicator-customization/indicator-types/map-custom-indicator-fields.md): Map custom indicator fields in Cortex XSOAR 6.12. - [Formatting Scripts](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.12/configure-cortex-xsoar/customize-and-configure-cortex-xsoar/indicators/indicator-customization/indicator-types/formatting-scripts.md): Format indicator values in Cortex XSOAR 6.12. - [Enhancement Scripts](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.12/configure-cortex-xsoar/customize-and-configure-cortex-xsoar/indicators/indicator-customization/indicator-types/enhancement-scripts.md): Configure indicator enhancement scripts in Cortex XSOAR 6.12. - [Reputation Scripts](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.12/configure-cortex-xsoar/customize-and-configure-cortex-xsoar/indicators/indicator-customization/indicator-types/reputation-scripts.md): Configure indicator reputation scripts in Cortex XSOAR 6.12. - [Reputation Commands](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.12/configure-cortex-xsoar/customize-and-configure-cortex-xsoar/indicators/indicator-customization/indicator-types/reputation-commands.md): Configure indicator reputation commands in Cortex XSOAR 6.12. - [Indicator Fields](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.12/configure-cortex-xsoar/customize-and-configure-cortex-xsoar/indicators/indicator-customization/indicator-fields.md): Configure indicator fields in Cortex XSOAR 6.12. - [Create a Custom Indicator Field](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.12/configure-cortex-xsoar/customize-and-configure-cortex-xsoar/indicators/indicator-customization/indicator-fields/create-a-custom-indicator-field.md): Create custom indicator fields in Cortex XSOAR 6.12. - [Configure the HTML Field](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.12/configure-cortex-xsoar/customize-and-configure-cortex-xsoar/indicators/indicator-customization/indicator-fields/create-a-custom-indicator-field/configure-the-html-field.md): Configure indicator HTML fields in Cortex XSOAR 6.12. - [Indicator Field Trigger Scripts](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.12/configure-cortex-xsoar/customize-and-configure-cortex-xsoar/indicators/indicator-customization/indicator-fields/indicator-field-trigger-scripts.md): Run indicator field trigger scripts in Cortex XSOAR 6.12. - [Indicator Layouts](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.12/configure-cortex-xsoar/customize-and-configure-cortex-xsoar/indicators/indicator-customization/indicator-layouts.md): Customize indicator layouts in Cortex XSOAR 6.12. - [Customize an Indicator Type Layout](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.12/configure-cortex-xsoar/customize-and-configure-cortex-xsoar/indicators/indicator-customization/indicator-layouts/customize-an-indicator-type-layout.md): Customize indicator type layouts in Cortex XSOAR 6.12. - [Add a Script in the Indicator Layout](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.12/configure-cortex-xsoar/customize-and-configure-cortex-xsoar/indicators/indicator-customization/indicator-layouts/add-a-script-in-the-indicator-layout.md): Add scripts to indicator layouts in Cortex XSOAR 6.12. - [Indicator Extraction](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.12/configure-cortex-xsoar/customize-and-configure-cortex-xsoar/indicators/indicator-extraction.md): Extract indicators in Cortex XSOAR 6.12. - [Indicator Extraction Modes](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.12/configure-cortex-xsoar/customize-and-configure-cortex-xsoar/indicators/indicator-extraction/indicator-extraction-modes.md): Understand indicator extraction modes in Cortex XSOAR 6.12. - [Create Indicator Extraction Rules for an Incident Type](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.12/configure-cortex-xsoar/customize-and-configure-cortex-xsoar/indicators/indicator-extraction/create-indicator-extraction-rules-for-an-incident-type.md): Configure incident indicator extraction rules in Cortex XSOAR 6.12. - [Run Indicator Extraction in the CLI](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.12/configure-cortex-xsoar/customize-and-configure-cortex-xsoar/indicators/indicator-extraction/run-indicator-extraction-in-the-cli.md): Run indicator extraction from the CLI in Cortex XSOAR 6.12. - [Create Indicator Extract Rules for a Playbook Task](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.12/configure-cortex-xsoar/customize-and-configure-cortex-xsoar/indicators/indicator-extraction/create-indicator-extract-rules-for-a-playbook-task.md): Configure indicator extraction for playbook tasks in Cortex XSOAR 6.12. - [Disable Indicator Extraction for Automations or Integrations](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.12/configure-cortex-xsoar/customize-and-configure-cortex-xsoar/indicators/indicator-extraction/disable-indicator-extraction-for-automations-or-integrations.md): Disable indicator extraction in Cortex XSOAR 6.12. - [Indicator Expiration](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.12/configure-cortex-xsoar/customize-and-configure-cortex-xsoar/indicators/indicator-expiration.md): Configure indicator expiration in Cortex XSOAR 6.12. - [Feed Integrations](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.12/configure-cortex-xsoar/customize-and-configure-cortex-xsoar/indicators/feed-integrations.md): Configure feed integrations in Cortex XSOAR 6.12. - [Dashboards](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.12/configure-cortex-xsoar/customize-and-configure-cortex-xsoar/dashboards.md): Create, edit, and share dashboards in Cortex XSOAR 6.12. - [Dashboard Overview](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.12/configure-cortex-xsoar/customize-and-configure-cortex-xsoar/dashboards/dashboard-overview.md): Understand dashboards and widgets in Cortex XSOAR 6.12. - [Create a Dashboard](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.12/configure-cortex-xsoar/customize-and-configure-cortex-xsoar/dashboards/create-a-dashboard.md): Create and customize dashboards in Cortex XSOAR 6.12. - [Add a Widget to a Dashboard](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.12/configure-cortex-xsoar/customize-and-configure-cortex-xsoar/dashboards/add-a-widget-to-a-dashboard.md): Add and configure dashboard widgets in Cortex XSOAR 6.12. - [Share a Dashboard](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.12/configure-cortex-xsoar/customize-and-configure-cortex-xsoar/dashboards/share-a-dashboard.md): Share dashboards with users by role in Cortex XSOAR 6.12. - [Edit a Dashboard](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.12/configure-cortex-xsoar/customize-and-configure-cortex-xsoar/dashboards/edit-a-dashboard.md): Edit dashboards and widgets in Cortex XSOAR 6.12. - [Reports](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.12/configure-cortex-xsoar/customize-and-configure-cortex-xsoar/reports.md): Create, edit, and customize reports in Cortex XSOAR 6.12. - [Reports Overview](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.12/configure-cortex-xsoar/customize-and-configure-cortex-xsoar/reports/reports-overview.md): Understand reports in Cortex XSOAR 6.12. - [Create a Report](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.12/configure-cortex-xsoar/customize-and-configure-cortex-xsoar/reports/create-a-report.md): Create and customize reports in Cortex XSOAR 6.12. - [Schedule a report](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.12/configure-cortex-xsoar/customize-and-configure-cortex-xsoar/reports/schedule-a-report.md): Schedule reports and email delivery in Cortex XSOAR 6.12. - [Customize the Email When Sending a Report](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.12/configure-cortex-xsoar/customize-and-configure-cortex-xsoar/reports/customize-the-email-when-sending-a-report.md): Customize report emails in Cortex XSOAR 6.12. - [Create an Incident Summary Report](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.12/configure-cortex-xsoar/customize-and-configure-cortex-xsoar/reports/create-an-incident-summary-report.md): Create incident summary reports in Cortex XSOAR 6.12. - [Select and Customize Sections to Export to a Summary Report](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.12/configure-cortex-xsoar/customize-and-configure-cortex-xsoar/reports/select-and-customize-sections-to-export-to-a-summary-report.md): Select summary report sections in Cortex XSOAR 6.12. - [Add a Widget to a Report](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.12/configure-cortex-xsoar/customize-and-configure-cortex-xsoar/reports/add-a-widget-to-a-report.md): Add widgets to reports in Cortex XSOAR 6.12. - [Edit a report](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.12/configure-cortex-xsoar/customize-and-configure-cortex-xsoar/reports/edit-a-report.md): Edit report widgets, layouts, and output types in Cortex XSOAR 6.12. - [Change the Report Logo](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.12/configure-cortex-xsoar/customize-and-configure-cortex-xsoar/reports/change-the-report-logo.md): Change report logos in Cortex XSOAR 6.12. - [Configure the Time Zone and Format in a Report](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.12/configure-cortex-xsoar/customize-and-configure-cortex-xsoar/reports/configure-the-time-zone-and-format-in-a-report.md): Configure report time zones and formats in Cortex XSOAR 6.12. - [Troubleshoot Reports](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.12/configure-cortex-xsoar/customize-and-configure-cortex-xsoar/reports/troubleshoot-reports.md): Troubleshoot reports in Cortex XSOAR 6.12. - [Widgets](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.12/configure-cortex-xsoar/customize-and-configure-cortex-xsoar/widgets.md): Create and edit widgets in Cortex XSOAR 6.12 for reports and dashboards. - [Widgets Overview](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.12/configure-cortex-xsoar/customize-and-configure-cortex-xsoar/widgets/widgets-overview.md): Understand widget creation and usage in Cortex XSOAR 6.12. - [Create a Widget using the Widget Builder](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.12/configure-cortex-xsoar/customize-and-configure-cortex-xsoar/widgets/create-a-widget-using-the-widget-builder.md): Create widgets with Widget Builder in Cortex XSOAR 6.12. - [Create a Custom Widget Using a JSON File](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.12/configure-cortex-xsoar/customize-and-configure-cortex-xsoar/widgets/create-a-custom-widget-using-a-json-file.md): Create custom JSON widgets in Cortex XSOAR 6.12. - [Create a Custom Widget Using an Automation Script](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.12/configure-cortex-xsoar/customize-and-configure-cortex-xsoar/widgets/create-a-custom-widget-using-an-automation-script.md): Create automation-based custom widgets in Cortex XSOAR 6.12. - [Edit a Widget](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.12/configure-cortex-xsoar/customize-and-configure-cortex-xsoar/widgets/edit-a-widget.md): Edit widgets in Cortex XSOAR 6.12. - [Create a Used Percentage Widget for a Disk Partition](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.12/configure-cortex-xsoar/customize-and-configure-cortex-xsoar/widgets/create-a-used-percentage-widget-for-a-disk-partition.md): Create disk-partition usage widgets in Cortex XSOAR 6.12. - [Saved By Dbot (ROI) Widget](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.12/configure-cortex-xsoar/customize-and-configure-cortex-xsoar/widgets/saved-by-dbot-roi-widget.md): Configure the Saved by Dbot ROI widget in Cortex XSOAR 6.12. - [Manage Data](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.12/configure-cortex-xsoar/customize-and-configure-cortex-xsoar/manage-data.md): Manage data operations in Cortex XSOAR 6.12. - [Reindex the Entire Database](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.12/configure-cortex-xsoar/customize-and-configure-cortex-xsoar/manage-data/reindex-the-entire-database.md): Reindex the entire database in Cortex XSOAR 6.12. - [Reindex a Specific Index Database](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.12/configure-cortex-xsoar/customize-and-configure-cortex-xsoar/manage-data/reindex-a-specific-index-database.md): Reindex specific index databases in Cortex XSOAR 6.12. - [Reindex the Audit Log](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.12/configure-cortex-xsoar/customize-and-configure-cortex-xsoar/manage-data/reindex-the-audit-log.md): Reindex audit logs in Cortex XSOAR 6.12. - [Free up Disk Space with Data Archiving](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.12/configure-cortex-xsoar/customize-and-configure-cortex-xsoar/manage-data/free-up-disk-space-with-data-archiving.md): Archive data to free disk space in Cortex XSOAR 6.12. - [Archive Artifacts and Attachments](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.12/configure-cortex-xsoar/customize-and-configure-cortex-xsoar/manage-data/archive-artifacts-and-attachments.md): Archive artifacts and attachments in Cortex XSOAR 6.12. - [Store Incident/Artifact Files in the Cloud](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.12/configure-cortex-xsoar/customize-and-configure-cortex-xsoar/manage-data/store-incidentartifact-files-in-the-cloud.md): Store incident and artifact files in the cloud in Cortex XSOAR 6.12. - [Migrate Data to Another Server](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.12/configure-cortex-xsoar/customize-and-configure-cortex-xsoar/manage-data/migrate-data-to-another-server.md): Migrate data to another server in Cortex XSOAR 6.12. - [Migrate Data to Another Server for Multi-Tenant](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.12/configure-cortex-xsoar/customize-and-configure-cortex-xsoar/manage-data/migrate-data-to-another-server-for-multi-tenant.md): Migrate multi-tenant data to another server in Cortex XSOAR 6.12. - [Move Data Folders to Another Location on the Server](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.12/configure-cortex-xsoar/customize-and-configure-cortex-xsoar/manage-data/move-data-folders-to-another-location-on-the-server.md): Move data folders to another server location in Cortex XSOAR 6.12. - [Restore an Archived Folder](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.12/configure-cortex-xsoar/customize-and-configure-cortex-xsoar/manage-data/restore-an-archived-folder.md): Restore archived folders in Cortex XSOAR 6.12. - [Logs](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.12/configure-cortex-xsoar/customize-and-configure-cortex-xsoar/logs.md): Manage server logs and audit trails in Cortex XSOAR 6.12. - [Logs Overview](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.12/configure-cortex-xsoar/customize-and-configure-cortex-xsoar/logs/logs-overview.md): Use logs to troubleshoot Cortex XSOAR 6.12. - [Configure the Server Log](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.12/configure-cortex-xsoar/customize-and-configure-cortex-xsoar/logs/configure-the-server-log.md): Configure server log size, levels, backups, and retention in Cortex XSOAR 6.12. - [Configure the Access Log for HTTPS Requests](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.12/configure-cortex-xsoar/customize-and-configure-cortex-xsoar/logs/configure-the-access-log-for-https-requests.md): Configure access logging for HTTPS requests in Cortex XSOAR 6.12. - [Create a Log Bundle](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.12/configure-cortex-xsoar/customize-and-configure-cortex-xsoar/logs/create-a-log-bundle.md): Create log bundles for troubleshooting in Cortex XSOAR 6.12. - [Audit Trail](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.12/configure-cortex-xsoar/customize-and-configure-cortex-xsoar/logs/audit-trail.md): View, export, extract, and purge audit trails in Cortex XSOAR 6.12. - [Send the Audit Trail to an External Log Service](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.12/configure-cortex-xsoar/customize-and-configure-cortex-xsoar/logs/send-the-audit-trail-to-an-external-log-service.md): Send audit trails to an external log service in Cortex XSOAR 6.12. - [System Settings](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.12/configure-cortex-xsoar/customize-and-configure-cortex-xsoar/system-settings.md): Customize system settings in Cortex XSOAR 6.12, including branding, emails, and notifications. - [Customize the Logo](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.12/configure-cortex-xsoar/customize-and-configure-cortex-xsoar/system-settings/customize-the-logo.md): Customize full-size and minimized logos in Cortex XSOAR 6.12. - [Customize the Login Message](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.12/configure-cortex-xsoar/customize-and-configure-cortex-xsoar/system-settings/customize-the-login-message.md): Customize the login message for users in Cortex XSOAR 6.12. - [Customize System Emails](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.12/configure-cortex-xsoar/customize-and-configure-cortex-xsoar/system-settings/customize-system-emails.md): Customize system email content and formats in Cortex XSOAR 6.12. - [Configure System Notifications](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.12/configure-cortex-xsoar/customize-and-configure-cortex-xsoar/system-settings/configure-system-notifications.md): Configure email system notifications in Cortex XSOAR 6.12. - [Day to Day Tasks in Cortex XSOAR](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.12/investigate-and-respond-to-threats/day-to-day-tasks-in-cortex-xsoar.md): Manage daily incident and indicator management tasks in Cortex XSOAR 6.12. - [Incident Management](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.12/investigate-and-respond-to-threats/day-to-day-tasks-in-cortex-xsoar/incident-management.md): Open, investigate, and manage incidents in Cortex XSOAR 6.12. - [Create an Incident](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.12/investigate-and-respond-to-threats/day-to-day-tasks-in-cortex-xsoar/incident-management/create-an-incident.md): Create incidents manually, from feeds, or by importing JSON files in Cortex XSOAR 6.12. - [Create a Search Query for Incidents](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.12/investigate-and-respond-to-threats/day-to-day-tasks-in-cortex-xsoar/incident-management/create-a-search-query-for-incidents.md): Create, customize, and save incident search queries in Cortex XSOAR 6.12. - [Create a Widget From an Incident](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.12/investigate-and-respond-to-threats/day-to-day-tasks-in-cortex-xsoar/incident-management/create-a-widget-from-an-incident.md): Create custom widgets from incident searches in Cortex XSOAR 6.12. - [Export an Incident to CSV Using the UTF8-BOM Format](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.12/investigate-and-respond-to-threats/day-to-day-tasks-in-cortex-xsoar/incident-management/export-an-incident-to-csv-using-the-utf8-bom-format.md): Export incidents with Cyrillic characters to UTF8-BOM CSV files in Cortex XSOAR 6.12. - [Incident Investigation](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.12/investigate-and-respond-to-threats/day-to-day-tasks-in-cortex-xsoar/incident-management/incident-investigation.md): Open incidents and view their details in Cortex XSOAR 6.12. - [Work Plan](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.12/investigate-and-respond-to-threats/day-to-day-tasks-in-cortex-xsoar/incident-management/work-plan.md): Monitor and manage incident playbook workflows in Cortex XSOAR 6.12. - [Investigate an Incident Using the Canvas](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.12/investigate-and-respond-to-threats/day-to-day-tasks-in-cortex-xsoar/incident-management/investigate-an-incident-using-the-canvas.md): Visually map and investigate incidents using the canvas in Cortex XSOAR 6.12. - [Incident Actions](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.12/investigate-and-respond-to-threats/day-to-day-tasks-in-cortex-xsoar/incident-management/incident-actions.md): Manage incident actions, tasks, reports, and restrictions in Cortex XSOAR 6.12. - [Evidence Handling](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.12/investigate-and-respond-to-threats/day-to-day-tasks-in-cortex-xsoar/incident-management/evidence-handling.md): Add and manage investigation evidence in the Cortex XSOAR 6.12 War Room. - [Incident Tasks](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.12/investigate-and-respond-to-threats/day-to-day-tasks-in-cortex-xsoar/incident-management/incident-tasks.md): Manage playbook and to-do tasks during investigations in Cortex XSOAR 6.12. - [Link Incidents](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.12/investigate-and-respond-to-threats/day-to-day-tasks-in-cortex-xsoar/incident-management/link-incidents.md): Link related incidents using the UI, rules, or CLI in Cortex XSOAR 6.12. - [Configure Incident Fields for Related Incidents](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.12/investigate-and-respond-to-threats/day-to-day-tasks-in-cortex-xsoar/incident-management/configure-incident-fields-for-related-incidents.md): Configure related incident fields using server settings in Cortex XSOAR 6.12. - [Indicator Management](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.12/investigate-and-respond-to-threats/day-to-day-tasks-in-cortex-xsoar/indicator-management.md): Manage, search, create, edit, export, and delete indicators in Cortex XSOAR 6.12. - [Indicator Query](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.12/investigate-and-respond-to-threats/day-to-day-tasks-in-cortex-xsoar/indicator-management/indicator-query.md): Search, create, edit, export, and delete indicators in Cortex XSOAR 6.12. - [Configure the Indicator Timeline](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.12/investigate-and-respond-to-threats/day-to-day-tasks-in-cortex-xsoar/indicator-management/configure-the-indicator-timeline.md): Configure and optimize the indicator timeline in Cortex XSOAR 6.12. - [Exclusion List](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.12/investigate-and-respond-to-threats/day-to-day-tasks-in-cortex-xsoar/indicator-management/exclusion-list.md): Exclude indicators from system processing in Cortex XSOAR 6.12. - [Export Indicators](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.12/investigate-and-respond-to-threats/day-to-day-tasks-in-cortex-xsoar/indicator-management/export-indicators.md): Export indicators as lists, dynamic lists, or files in Cortex XSOAR 6.12. - [Reference](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.12/reference-docs/reference.md): Reference information for Cortex XSOAR 6.12. - [Navigation Cheat Sheet](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.12/reference-docs/reference/navigation-cheat-sheet.md): Learn about commonly used features in Cortex XSOAR 6.12. - [Server Configurations](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.12/reference-docs/reference/server-configurations.md): Reference server configurations for Cortex XSOAR 6.12 customization and troubleshooting. - [Modify Server Configurations](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.12/reference-docs/reference/server-configurations/modify-server-configurations.md): Customize and troubleshoot Cortex XSOAR 6.12 with server configuration settings. - [Active Directory Server Configurations](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.12/reference-docs/reference/server-configurations/active-directory-server-configurations.md): Reference Active Directory server configurations in Cortex XSOAR 6.12. - [Automation Server Configurations](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.12/reference-docs/reference/server-configurations/automation-server-configurations.md): Reference automation server configurations in Cortex XSOAR 6.12. - [Dashboard Server Configurations](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.12/reference-docs/reference/server-configurations/dashboard-server-configurations.md): Reference dashboard server configurations in Cortex XSOAR 6.12. - [Database Server Configurations](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.12/reference-docs/reference/server-configurations/database-server-configurations.md): Reference database server configurations in Cortex XSOAR 6.12. - [Disaster Recovery Server Configurations](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.12/reference-docs/reference/server-configurations/disaster-recovery-server-configurations.md): Reference disaster recovery server configurations in Cortex XSOAR 6.12. - [Docker Server Configurations](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.12/reference-docs/reference/server-configurations/docker-server-configurations.md): Reference Docker server configurations in Cortex XSOAR 6.12. - [Elasticsearch Server Configurations](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.12/reference-docs/reference/server-configurations/elasticsearch-server-configurations.md): Reference Elasticsearch server configurations in Cortex XSOAR 6.12. - [Engine Server Configurations](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.12/reference-docs/reference/server-configurations/engine-server-configurations.md): Reference engine server configurations in Cortex XSOAR 6.12. - [General Server Configurations](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.12/reference-docs/reference/server-configurations/general-server-configurations.md): Reference general server configurations in Cortex XSOAR 6.12. - [Google API Server Configuration](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.12/reference-docs/reference/server-configurations/google-api-server-configuration.md): Reference Google API server configuration in Cortex XSOAR 6.12. - [Incident Server Configurations](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.12/reference-docs/reference/server-configurations/incident-server-configurations.md): Reference incident server configurations in Cortex XSOAR 6.12. - [Indicator Server Configurations](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.12/reference-docs/reference/server-configurations/indicator-server-configurations.md): Reference indicator server configurations in Cortex XSOAR 6.12. - [Integration Server Configurations](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.12/reference-docs/reference/server-configurations/integration-server-configurations.md): Reference integration server configurations in Cortex XSOAR 6.12. - [List Server Configurations](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.12/reference-docs/reference/server-configurations/list-server-configurations.md): Reference list server configurations in Cortex XSOAR 6.12. - [Logs Server Configurations](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.12/reference-docs/reference/server-configurations/logs-server-configurations.md): Reference log server configurations in Cortex XSOAR 6.12. - [Marketplace Server Configurations](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.12/reference-docs/reference/server-configurations/marketplace-server-configurations.md): Reference Marketplace server configurations in Cortex XSOAR 6.12. - [Multi-Tenant Server Configurations](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.12/reference-docs/reference/server-configurations/multi-tenant-server-configurations.md): Reference multi-tenant server configurations in Cortex XSOAR 6.12. - [Notification Server Configurations](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.12/reference-docs/reference/server-configurations/notification-server-configurations.md): Reference notification server configurations in Cortex XSOAR 6.12. - [Playbook Server Configurations](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.12/reference-docs/reference/server-configurations/playbook-server-configurations.md): Reference playbook server configurations in Cortex XSOAR 6.12. - [Proxy Server Configurations](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.12/reference-docs/reference/server-configurations/proxy-server-configurations.md): Reference proxy server configurations in Cortex XSOAR 6.12. - [Remote Repository Server Configurations](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.12/reference-docs/reference/server-configurations/remote-repository-server-configurations.md): Reference remote repository server configurations in Cortex XSOAR 6.12. - [Report Server Configurations](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.12/reference-docs/reference/server-configurations/report-server-configurations.md): Reference report server configurations in Cortex XSOAR 6.12. - [Security Headers Server Configurations](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.12/reference-docs/reference/server-configurations/security-headers-server-configurations.md): Reference security header server configurations in Cortex XSOAR 6.12. - [SLA Server Configuration](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.12/reference-docs/reference/server-configurations/sla-server-configuration.md): Reference SLA server configuration in Cortex XSOAR 6.12. - [System Diagnostics Server Configurations](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.12/reference-docs/reference/server-configurations/system-diagnostics-server-configurations.md): Reference system diagnostics server configurations in Cortex XSOAR 6.12. - [Users and Roles Server Configurations](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.12/reference-docs/reference/server-configurations/users-and-roles-server-configurations.md): Reference users and roles server configurations in Cortex XSOAR 6.12. - [War Room Server Configurations](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.12/reference-docs/reference/server-configurations/war-room-server-configurations.md): Reference War Room server configurations in Cortex XSOAR 6.12. - [Widget Server Configurations](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.12/reference-docs/reference/server-configurations/widget-server-configurations.md): Reference widget server configurations in Cortex XSOAR 6.12. - [System Diagnostics](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.12/reference-docs/reference/system-diagnostics.md): Find and fix system performance issues in Cortex XSOAR 6.12. - [Fix System Diagnostics Issues](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.12/reference-docs/reference/system-diagnostics/fix-system-diagnostics-issues.md): Fix System Diagnostics alerts in Cortex XSOAR 6.12. - [Performance Tuning for Cortex XSOAR](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.12/reference-docs/reference/performance-tuning-for-cortex-xsoar.md): Tune Cortex XSOAR 6.12 performance. - [Supported Ciphers](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.12/reference-docs/reference/supported-ciphers.md): Reference TLS 1.2 and TLS 1.3 ciphers supported in Cortex XSOAR 6.12. - [Telemetry](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.12/reference-docs/reference/telemetry.md): Enable or disable telemetry collection in Cortex XSOAR 6.12. - [Keyboard Shortcuts](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.12/reference-docs/reference/keyboard-shortcuts.md): Use keyboard shortcuts to navigate Cortex XSOAR 6.12. - [Indicator Fields Structure](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.12/reference-docs/reference/indicator-fields-structure.md): Reference the STIX-aligned indicator field structure in Cortex XSOAR 6.12. ## Cortex XSOAR 6 Threat Intel Management Guides - [Cortex XSOAR 6 Threat Intel Management Guides](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-6-threat-intel-management-guides/cortex-xsoar-6-threat-intel-management-guides.md): Start here to choose the right Cortex XSOAR 6 version. * [Navigate the Threat Intel Management Guide](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-6-threat-intel-management-guides/6.15/learn-about-threat-intel-management/readme.md): Start here for a visual overview of the main Cortex XSOAR Threat Intel Management 6.15 documentation areas. * [Threat Intel Management Overview](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-6-threat-intel-management-guides/6.15/learn-about-threat-intel-management/readme-1.md): Learn about native threat intelligence management capabilities in Cortex XSOAR 6.15. * [Indicator Concepts](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-6-threat-intel-management-guides/6.15/learn-about-threat-intel-management/readme-1/indicator-concepts.md): Explore indicator concepts in Cortex XSOAR 6.15, including ingestion, enrichment, smart merge, and expiration. * [Indicator Verdict](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-6-threat-intel-management-guides/6.15/learn-about-threat-intel-management/readme-1/indicator-verdict.md): Learn how Cortex XSOAR 6.15 assigns indicator verdicts using source reliability and reputation data. * [Indicator Ingestion](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-6-threat-intel-management-guides/6.15/learn-about-threat-intel-management/readme-1/indicator-ingestion.md): Learn how Cortex XSOAR 6.15 detects and ingests indicators through integrations, extraction, and manual methods. * [Indicator Customization](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-6-threat-intel-management-guides/6.15/configure-indicators/indicator-customization.md): Customize indicator types, fields, and layouts in Cortex XSOAR 6.15. * [Indicator Types](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-6-threat-intel-management-guides/6.15/configure-indicators/indicator-customization/indicator-types.md): Learn how Cortex XSOAR 6.15 identifies and manages indicator types. * [File Indicators](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-6-threat-intel-management-guides/6.15/configure-indicators/indicator-customization/indicator-types/file-indicators.md): Configure file indicators and hash-based indicators in Cortex XSOAR 6.15. * [Create an Indicator Type](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-6-threat-intel-management-guides/6.15/configure-indicators/indicator-customization/indicator-types/create-an-indicator-type.md): Create custom indicator types alongside system types in Cortex XSOAR 6.15. * [Indicator Type Profile](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-6-threat-intel-management-guides/6.15/configure-indicators/indicator-customization/indicator-types/indicator-type-profile.md): Configure indicator type profiles and fields in Cortex XSOAR 6.15. * [Formatting Scripts](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-6-threat-intel-management-guides/6.15/configure-indicators/indicator-customization/indicator-types/formatting-scripts.md): Use formatting scripts to validate input and format indicators in Cortex XSOAR 6.15. * [Enhancement Scripts](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-6-threat-intel-management-guides/6.15/configure-indicators/indicator-customization/indicator-types/enhancement-scripts.md): Use enhancement scripts to enrich indicators in Cortex XSOAR 6.15. * [Reputation Scripts](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-6-threat-intel-management-guides/6.15/configure-indicators/indicator-customization/indicator-types/reputation-scripts.md): Use reputation scripts for indicator enrichment in Cortex XSOAR 6.15. * [Reputation Commands](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-6-threat-intel-management-guides/6.15/configure-indicators/indicator-customization/indicator-types/reputation-commands.md): Learn how reputation commands return indicator verdicts in Cortex XSOAR 6.15. * [Map Custom Indicator Fields](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-6-threat-intel-management-guides/6.15/configure-indicators/indicator-customization/indicator-types/map-custom-indicator-fields.md): Map custom indicator fields to context data in Cortex XSOAR 6.15. * [Indicator Fields](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-6-threat-intel-management-guides/6.15/configure-indicators/indicator-customization/indicator-fields.md): Configure indicator fields for specific or all types in Cortex XSOAR 6.15. * [Create a Custom Indicator Field](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-6-threat-intel-management-guides/6.15/configure-indicators/indicator-customization/indicator-fields/create-a-custom-indicator-field.md): Create custom indicator fields in Cortex XSOAR 6.15. * [Indicator Field Trigger Scripts](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-6-threat-intel-management-guides/6.15/configure-indicators/indicator-customization/indicator-fields/indicator-field-trigger-scripts.md): Trigger scripts when indicator fields change in Cortex XSOAR 6.15. * [Indicator Fields Structure](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-6-threat-intel-management-guides/6.15/configure-indicators/indicator-customization/indicator-fields/indicator-fields-structure.md): Understand STIX-aligned indicator field structures in Cortex XSOAR 6.15. * [Indicator Layouts](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-6-threat-intel-management-guides/6.15/configure-indicators/indicator-customization/indicator-layouts.md): Learn about indicator view layouts in Cortex XSOAR 6.15. * [Customize an Indicator Type Layout](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-6-threat-intel-management-guides/6.15/configure-indicators/indicator-customization/indicator-layouts/customize-an-indicator-type-layout.md): Customize layouts for each indicator type in Cortex XSOAR 6.15. * [Add a Script in the Indicator Layout](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-6-threat-intel-management-guides/6.15/configure-indicators/indicator-customization/indicator-layouts/add-a-script-in-the-indicator-layout.md): Add automation script content to indicator layouts in Cortex XSOAR 6.15. * [Indicator Extraction](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-6-threat-intel-management-guides/6.15/configure-indicators/indicator-extraction.md): Configure and run indicator extraction and enrichment in Cortex XSOAR 6.15. * [Indicator Extraction Modes](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-6-threat-intel-management-guides/6.15/configure-indicators/indicator-extraction/indicator-extraction-modes.md): Configure indicator extraction modes in Cortex XSOAR 6.15. * [Create Indicator Extraction Rules for an Incident Type](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-6-threat-intel-management-guides/6.15/configure-indicators/indicator-extraction/create-indicator-extraction-rules-for-an-incident-type.md): Create indicator extraction rules for incident types in Cortex XSOAR 6.15. * [Run Indicator Extraction in the CLI](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-6-threat-intel-management-guides/6.15/configure-indicators/indicator-extraction/run-indicator-extraction-in-the-cli.md): Run indicator extraction and enrichment commands in the Cortex XSOAR 6.15 CLI. * [Create Indicator Extract Rules for a Playbook Task](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-6-threat-intel-management-guides/6.15/configure-indicators/indicator-extraction/create-indicator-extract-rules-for-a-playbook-task.md): Create indicator extraction rules for playbook tasks in Cortex XSOAR 6.15. * [Disable Indicator Extraction for Automations or Integrations](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-6-threat-intel-management-guides/6.15/configure-indicators/indicator-extraction/disable-indicator-extraction-for-automations-or-integrations.md): Disable indicator extraction for automations or integrations in Cortex XSOAR 6.15. * [Indicator Expiration](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-6-threat-intel-management-guides/6.15/configure-indicators/indicator-expiration.md): Cortex XSOAR 6.15 indicators have an active or expired status, which can be set to expire after a period of time or never to expire. Set default expiration method. * [Threat Intel Feeds](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-6-threat-intel-management-guides/6.15/configure-indicators/threat-intel-feeds.md): Import and export threat intelligence feeds in Cortex XSOAR 6.15. * [Feed Integrations](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-6-threat-intel-management-guides/6.15/configure-indicators/threat-intel-feeds/feed-integrations.md): Configure feed integrations that fetch indicators in Cortex XSOAR 6.15. * [Set the Source Reliability of Enrichment Integrations](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-6-threat-intel-management-guides/6.15/configure-indicators/threat-intel-feeds/set-the-source-reliability-of-enrichment-integrations.md): Set enrichment integration source reliability in Cortex XSOAR 6.15. * [Configure threat intelligence management playbooks](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-6-threat-intel-management-guides/6.15/configure-indicators/threat-intel-feeds/threat-intelligence-management-playbooks.md): Configure threat intelligence management playbooks and indicator queries in Cortex XSOAR 6.15. * [Indicator Management](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-6-threat-intel-management-guides/6.15/configure-indicators/indicator-management.md): Create, manage, search, and export indicators in Cortex XSOAR 6.15. * [Indicator Query](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-6-threat-intel-management-guides/6.15/configure-indicators/indicator-management/indicator-query.md): Search for and manage indicators in Cortex XSOAR 6.15. * [Configure the Indicator Timeline](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-6-threat-intel-management-guides/6.15/configure-indicators/indicator-management/configure-the-indicator-timeline.md): Configure the indicator timeline and its performance in Cortex XSOAR 6.15. * [Exclusion List](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-6-threat-intel-management-guides/6.15/configure-indicators/indicator-management/exclusion-list.md): Add indicators to exclusion lists in Cortex XSOAR 6.15. * [Export Indicators](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-6-threat-intel-management-guides/6.15/configure-indicators/indicator-management/export-indicators.md): Export indicators as lists, files, and feeds from Cortex XSOAR 6.15. * [Manually Export Indicators](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-6-threat-intel-management-guides/6.15/configure-indicators/indicator-management/export-indicators/manually-export-indicators.md): Manually export indicators to files from Cortex XSOAR 6.15. * [Export Indicators Integrations](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-6-threat-intel-management-guides/6.15/configure-indicators/indicator-management/export-indicators/export-indicators-integrations.md): Export indicators with outbound-feed integrations in Cortex XSOAR 6.15. * [Export Indicators Playbooks](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-6-threat-intel-management-guides/6.15/configure-indicators/indicator-management/export-indicators/export-indicators-playbooks.md): Use playbooks to process and export indicators in Cortex XSOAR 6.15. * [Export an Indicator to CSV Using the UTF8-BOM Format](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-6-threat-intel-management-guides/6.15/configure-indicators/indicator-management/export-indicators/export-an-indicator-to-csv-using-the-utf8-bom-format.md): Export indicators to UTF-8 BOM CSV files in Cortex XSOAR 6.15. * [Indicator Relationships](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-6-threat-intel-management-guides/6.15/configure-indicators/indicator-management/indicator-relationships.md): Create and manage relationships between indicators in Cortex XSOAR 6.15. * [Create Indicator Relationships](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-6-threat-intel-management-guides/6.15/configure-indicators/indicator-management/indicator-relationships/create-indicator-relationships.md): Create indicator relationships that enhance investigations in Cortex XSOAR 6.15. * [Leverage Relationships in the Canvas](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-6-threat-intel-management-guides/6.15/configure-indicators/indicator-management/indicator-relationships/leverage-relationships-in-the-canvas.md): Use Canvas indicator relationships to enrich investigations in Cortex XSOAR 6.15. * [Threat Intel Reports](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-6-threat-intel-management-guides/6.15/reports/threat-intel-reports.md): Create and manage threat intelligence reports in Cortex XSOAR 6.15. * [Threat Intel Reports Overview](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-6-threat-intel-management-guides/6.15/reports/threat-intel-reports/threat-intel-reports-overview.md): Learn how to work with threat intelligence reports in Cortex XSOAR 6.15. * [Threat Intel Reports Customization](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-6-threat-intel-management-guides/6.15/reports/threat-intel-reports/threat-intel-reports-customization.md): Set up and customize threat intelligence report types in Cortex XSOAR 6.15. * [Configure Threat Intel Report Types](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-6-threat-intel-management-guides/6.15/reports/threat-intel-reports/threat-intel-reports-customization/configure-threat-intel-report-types.md): Configure threat intelligence report types in Cortex XSOAR 6.15. * [Configure Threat Intel Report Fields](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-6-threat-intel-management-guides/6.15/reports/threat-intel-reports/threat-intel-reports-customization/configure-threat-intel-report-fields.md): Configure threat intelligence report fields in Cortex XSOAR 6.15. * [Configure Threat Intel Report Layouts](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-6-threat-intel-management-guides/6.15/reports/threat-intel-reports/threat-intel-reports-customization/configure-threat-intel-report-layouts.md): Configure threat intelligence report layouts in Cortex XSOAR 6.15. * [Threat Intel Reports Management](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-6-threat-intel-management-guides/6.15/reports/threat-intel-reports/threat-intel-reports-management.md): Manage threat intelligence reports in Cortex XSOAR 6.15. * [Create a Threat Intel Report](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-6-threat-intel-management-guides/6.15/reports/threat-intel-reports/threat-intel-reports-management/create-a-threat-intel-report.md): Create a threat intelligence report from a type and layout in Cortex XSOAR 6.15. * [RBAC for Reports](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-6-threat-intel-management-guides/6.15/reports/threat-intel-reports/threat-intel-reports-management/rbac-for-reports.md): Control threat intelligence report access with RBAC in Cortex XSOAR 6.15. * [Generate a Threat Intel Report](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-6-threat-intel-management-guides/6.15/reports/threat-intel-reports/threat-intel-reports-management/generate-a-threat-intel-report.md): Generate, export, and share threat intelligence reports in Cortex XSOAR 6.15. * [Publish a Threat Intel Report](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-6-threat-intel-management-guides/6.15/reports/threat-intel-reports/threat-intel-reports-management/publish-a-threat-intel-report.md): Publish threat intelligence reports with read-only access in Cortex XSOAR 6.15. - [Navigate the Threat Intel Management Guide](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-6-threat-intel-management-guides/6.14/learn-about-threat-intel-management/readme.md): Start here for a visual overview of the main Cortex XSOAR Threat Intel Management 6.14 documentation areas. - [Threat Intel Management Overview](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-6-threat-intel-management-guides/6.14/learn-about-threat-intel-management/readme-1.md): Learn about native threat intelligence management capabilities in Cortex XSOAR 6.14. - [Indicator Concepts](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-6-threat-intel-management-guides/6.14/learn-about-threat-intel-management/readme-1/indicator-concepts.md): Explore indicator concepts in Cortex XSOAR 6.14, including ingestion, enrichment, smart merge, and expiration. - [Indicator Verdict](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-6-threat-intel-management-guides/6.14/learn-about-threat-intel-management/readme-1/indicator-verdict.md): Learn how Cortex XSOAR 6.14 assigns indicator verdicts using source reliability and reputation data. - [Indicator Ingestion](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-6-threat-intel-management-guides/6.14/learn-about-threat-intel-management/readme-1/indicator-ingestion.md): Learn how Cortex XSOAR 6.14 detects and ingests indicators through integrations, extraction, and manual methods. - [Indicator Customization](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-6-threat-intel-management-guides/6.14/configure-indicators/indicator-customization.md): Customize indicator types, fields, and layouts in Cortex XSOAR 6.14. - [Indicator Types](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-6-threat-intel-management-guides/6.14/configure-indicators/indicator-customization/indicator-types.md): Learn how Cortex XSOAR 6.14 identifies and manages indicator types. - [File Indicators](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-6-threat-intel-management-guides/6.14/configure-indicators/indicator-customization/indicator-types/file-indicators.md): Configure file indicators and hash-based indicators in Cortex XSOAR 6.14. - [Create an Indicator Type](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-6-threat-intel-management-guides/6.14/configure-indicators/indicator-customization/indicator-types/create-an-indicator-type.md): Create custom indicator types alongside system types in Cortex XSOAR 6.14. - [Indicator Type Profile](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-6-threat-intel-management-guides/6.14/configure-indicators/indicator-customization/indicator-types/indicator-type-profile.md): Configure indicator type profiles and fields in Cortex XSOAR 6.14. - [Formatting Scripts](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-6-threat-intel-management-guides/6.14/configure-indicators/indicator-customization/indicator-types/formatting-scripts.md): Use formatting scripts to validate input and format indicators in Cortex XSOAR 6.14. - [Enhancement Scripts](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-6-threat-intel-management-guides/6.14/configure-indicators/indicator-customization/indicator-types/enhancement-scripts.md): Use enhancement scripts to enrich indicators in Cortex XSOAR 6.14. - [Reputation Scripts](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-6-threat-intel-management-guides/6.14/configure-indicators/indicator-customization/indicator-types/reputation-scripts.md): Use reputation scripts for indicator enrichment in Cortex XSOAR 6.14. - [Reputation Commands](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-6-threat-intel-management-guides/6.14/configure-indicators/indicator-customization/indicator-types/reputation-commands.md): Learn how reputation commands return indicator verdicts in Cortex XSOAR 6.14. - [Map Custom Indicator Fields](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-6-threat-intel-management-guides/6.14/configure-indicators/indicator-customization/indicator-types/map-custom-indicator-fields.md): Map custom indicator fields to context data in Cortex XSOAR 6.14. - [Indicator Fields](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-6-threat-intel-management-guides/6.14/configure-indicators/indicator-customization/indicator-fields.md): Configure indicator fields for specific or all types in Cortex XSOAR 6.14. - [Create a Custom Indicator Field](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-6-threat-intel-management-guides/6.14/configure-indicators/indicator-customization/indicator-fields/create-a-custom-indicator-field.md): Create custom indicator fields in Cortex XSOAR 6.14. - [Indicator Field Trigger Scripts](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-6-threat-intel-management-guides/6.14/configure-indicators/indicator-customization/indicator-fields/indicator-field-trigger-scripts.md): Trigger scripts when indicator fields change in Cortex XSOAR 6.14. - [Indicator Fields Structure](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-6-threat-intel-management-guides/6.14/configure-indicators/indicator-customization/indicator-fields/indicator-fields-structure.md): Understand STIX-aligned indicator field structures in Cortex XSOAR 6.14. - [Indicator Layouts](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-6-threat-intel-management-guides/6.14/configure-indicators/indicator-customization/indicator-layouts.md): Learn about indicator view layouts in Cortex XSOAR 6.14. - [Customize an Indicator Type Layout](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-6-threat-intel-management-guides/6.14/configure-indicators/indicator-customization/indicator-layouts/customize-an-indicator-type-layout.md): Customize layouts for each indicator type in Cortex XSOAR 6.14. - [Add a Script in the Indicator Layout](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-6-threat-intel-management-guides/6.14/configure-indicators/indicator-customization/indicator-layouts/add-a-script-in-the-indicator-layout.md): Add automation script content to indicator layouts in Cortex XSOAR 6.14. - [Indicator Extraction](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-6-threat-intel-management-guides/6.14/configure-indicators/indicator-extraction.md): Configure and run indicator extraction and enrichment in Cortex XSOAR 6.14. - [Indicator Extraction Modes](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-6-threat-intel-management-guides/6.14/configure-indicators/indicator-extraction/indicator-extraction-modes.md): Configure indicator extraction modes in Cortex XSOAR 6.14. - [Create Indicator Extraction Rules for an Incident Type](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-6-threat-intel-management-guides/6.14/configure-indicators/indicator-extraction/create-indicator-extraction-rules-for-an-incident-type.md): Create indicator extraction rules for incident types in Cortex XSOAR 6.14. - [Run Indicator Extraction in the CLI](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-6-threat-intel-management-guides/6.14/configure-indicators/indicator-extraction/run-indicator-extraction-in-the-cli.md): Run indicator extraction and enrichment commands in the Cortex XSOAR 6.14 CLI. - [Create Indicator Extract Rules for a Playbook Task](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-6-threat-intel-management-guides/6.14/configure-indicators/indicator-extraction/create-indicator-extract-rules-for-a-playbook-task.md): Create indicator extraction rules for playbook tasks in Cortex XSOAR 6.14. - [Disable Indicator Extraction for Automations or Integrations](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-6-threat-intel-management-guides/6.14/configure-indicators/indicator-extraction/disable-indicator-extraction-for-automations-or-integrations.md): Disable indicator extraction for automations or integrations in Cortex XSOAR 6.14. - [Indicator Expiration](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-6-threat-intel-management-guides/6.14/configure-indicators/indicator-expiration.md): Cortex XSOAR 6.14 indicators have an active or expired status, which can be set to expire after a period of time or never to expire. Set default expiration method. - [Threat Intel Feeds](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-6-threat-intel-management-guides/6.14/configure-indicators/threat-intel-feeds.md): Import and export threat intelligence feeds in Cortex XSOAR 6.14. - [Feed Integrations](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-6-threat-intel-management-guides/6.14/configure-indicators/threat-intel-feeds/feed-integrations.md): Configure feed integrations that fetch indicators in Cortex XSOAR 6.14. - [Feed-Triggered Jobs](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-6-threat-intel-management-guides/6.14/configure-indicators/threat-intel-feeds/feed-integrations/feed-triggered-jobs.md): Configure jobs triggered by threat intelligence feed updates in Cortex XSOAR 6.14. - [Set the Source Reliability of Enrichment Integrations](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-6-threat-intel-management-guides/6.14/configure-indicators/threat-intel-feeds/set-the-source-reliability-of-enrichment-integrations.md): Set enrichment integration source reliability in Cortex XSOAR 6.14. - [Threat Intelligence Management Playbooks](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-6-threat-intel-management-guides/6.14/configure-indicators/threat-intel-feeds/threat-intelligence-management-playbooks.md): Configure threat intelligence management playbooks in Cortex XSOAR 6.14. - [Indicator Management](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-6-threat-intel-management-guides/6.14/configure-indicators/indicator-management.md): Create, manage, search, and export indicators in Cortex XSOAR 6.14. - [Indicator Query](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-6-threat-intel-management-guides/6.14/configure-indicators/indicator-management/indicator-query.md): Search for and manage indicators in Cortex XSOAR 6.14. - [Configure the Indicator Timeline](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-6-threat-intel-management-guides/6.14/configure-indicators/indicator-management/configure-the-indicator-timeline.md): Configure the indicator timeline and its performance in Cortex XSOAR 6.14. - [Exclusion List](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-6-threat-intel-management-guides/6.14/configure-indicators/indicator-management/exclusion-list.md): Add indicators to exclusion lists in Cortex XSOAR 6.14. - [Export Indicators](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-6-threat-intel-management-guides/6.14/configure-indicators/indicator-management/export-indicators.md): Export indicators as lists, files, and feeds from Cortex XSOAR 6.14. - [Manually Export Indicators](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-6-threat-intel-management-guides/6.14/configure-indicators/indicator-management/export-indicators/manually-export-indicators.md): Manually export indicators to files from Cortex XSOAR 6.14. - [Export Indicators Integrations](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-6-threat-intel-management-guides/6.14/configure-indicators/indicator-management/export-indicators/export-indicators-integrations.md): Export indicators with outbound-feed integrations in Cortex XSOAR 6.14. - [Export Indicators Playbooks](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-6-threat-intel-management-guides/6.14/configure-indicators/indicator-management/export-indicators/export-indicators-playbooks.md): Use playbooks to process and export indicators in Cortex XSOAR 6.14. - [Export an Indicator to CSV Using the UTF8-BOM Format](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-6-threat-intel-management-guides/6.14/configure-indicators/indicator-management/export-indicators/export-an-indicator-to-csv-using-the-utf8-bom-format.md): Export indicators to UTF-8 BOM CSV files in Cortex XSOAR 6.14. - [Indicator Relationships](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-6-threat-intel-management-guides/6.14/configure-indicators/indicator-management/indicator-relationships.md): Create and manage relationships between indicators in Cortex XSOAR 6.14. - [Create Indicator Relationships](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-6-threat-intel-management-guides/6.14/configure-indicators/indicator-management/indicator-relationships/create-indicator-relationships.md): Create indicator relationships that enhance investigations in Cortex XSOAR 6.14. - [Leverage Relationships in the Canvas](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-6-threat-intel-management-guides/6.14/configure-indicators/indicator-management/indicator-relationships/leverage-relationships-in-the-canvas.md): Use Canvas indicator relationships to enrich investigations in Cortex XSOAR 6.14. - [Threat Intel Reports](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-6-threat-intel-management-guides/6.14/reports/threat-intel-reports.md): Create and manage threat intelligence reports in Cortex XSOAR 6.14. - [Threat Intel Reports Overview](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-6-threat-intel-management-guides/6.14/reports/threat-intel-reports/threat-intel-reports-overview.md): Learn how to work with threat intelligence reports in Cortex XSOAR 6.14. - [Threat Intel Reports Customization](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-6-threat-intel-management-guides/6.14/reports/threat-intel-reports/threat-intel-reports-customization.md): Set up and customize threat intelligence report types in Cortex XSOAR 6.14. - [Configure Threat Intel Report Types](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-6-threat-intel-management-guides/6.14/reports/threat-intel-reports/threat-intel-reports-customization/configure-threat-intel-report-types.md): Configure threat intelligence report types in Cortex XSOAR 6.14. - [Configure Threat Intel Report Fields](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-6-threat-intel-management-guides/6.14/reports/threat-intel-reports/threat-intel-reports-customization/configure-threat-intel-report-fields.md): Configure threat intelligence report fields in Cortex XSOAR 6.14. - [Configure Threat Intel Report Layouts](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-6-threat-intel-management-guides/6.14/reports/threat-intel-reports/threat-intel-reports-customization/configure-threat-intel-report-layouts.md): Configure threat intelligence report layouts in Cortex XSOAR 6.14. - [Threat Intel Reports Management](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-6-threat-intel-management-guides/6.14/reports/threat-intel-reports/threat-intel-reports-management.md): Manage threat intelligence reports in Cortex XSOAR 6.14. - [Create a Threat Intel Report](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-6-threat-intel-management-guides/6.14/reports/threat-intel-reports/threat-intel-reports-management/create-a-threat-intel-report.md): Create a threat intelligence report from a type and layout in Cortex XSOAR 6.14. - [RBAC for Reports](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-6-threat-intel-management-guides/6.14/reports/threat-intel-reports/threat-intel-reports-management/rbac-for-reports.md): Control threat intelligence report access with RBAC in Cortex XSOAR 6.14. - [Generate a Threat Intel Report](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-6-threat-intel-management-guides/6.14/reports/threat-intel-reports/threat-intel-reports-management/generate-a-threat-intel-report.md): Generate, export, and share threat intelligence reports in Cortex XSOAR 6.14. - [Publish a Threat Intel Report](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-6-threat-intel-management-guides/6.14/reports/threat-intel-reports/threat-intel-reports-management/publish-a-threat-intel-report.md): Publish threat intelligence reports with read-only access in Cortex XSOAR 6.14. * [Navigate the Threat Intel Management Guide](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-6-threat-intel-management-guides/6.13/learn-about-threat-intel-management/readme.md): Navigate Cortex XSOAR 6.13 Threat Intel Management documentation areas. * [Threat Intel Management Overview](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-6-threat-intel-management-guides/6.13/learn-about-threat-intel-management/readme-1.md): Learn threat intel capabilities in Cortex XSOAR 6.13 Threat Intel Management. * [Indicator Concepts](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-6-threat-intel-management-guides/6.13/learn-about-threat-intel-management/readme-1/indicator-concepts.md): Learn indicator concepts in Cortex XSOAR 6.13 Threat Intel Management. * [Indicator Verdict](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-6-threat-intel-management-guides/6.13/learn-about-threat-intel-management/readme-1/indicator-verdict.md): Learn indicator verdicts in Cortex XSOAR 6.13 Threat Intel Management. * [Indicator Ingestion](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-6-threat-intel-management-guides/6.13/learn-about-threat-intel-management/readme-1/indicator-ingestion.md): Learn indicator ingestion in Cortex XSOAR 6.13 Threat Intel Management. * [Indicator Customization](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-6-threat-intel-management-guides/6.13/configure-indicators/indicator-customization.md): Customize indicators in Cortex XSOAR 6.13 Threat Intel Management. * [Indicator Types](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-6-threat-intel-management-guides/6.13/configure-indicators/indicator-customization/indicator-types.md): Configure indicator types in Cortex XSOAR 6.13 Threat Intel Management. * [File Indicators](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-6-threat-intel-management-guides/6.13/configure-indicators/indicator-customization/indicator-types/file-indicators.md): Work with file indicators in Cortex XSOAR 6.13 Threat Intel Management. * [Create an Indicator Type](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-6-threat-intel-management-guides/6.13/configure-indicators/indicator-customization/indicator-types/create-an-indicator-type.md): Create indicator types in Cortex XSOAR 6.13 Threat Intel Management. * [Indicator Type Profile](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-6-threat-intel-management-guides/6.13/configure-indicators/indicator-customization/indicator-types/indicator-type-profile.md): Configure type profiles in Cortex XSOAR 6.13 Threat Intel Management. * [Formatting Scripts](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-6-threat-intel-management-guides/6.13/configure-indicators/indicator-customization/indicator-types/formatting-scripts.md): Use formatting scripts in Cortex XSOAR 6.13 Threat Intel Management. * [Enhancement Scripts](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-6-threat-intel-management-guides/6.13/configure-indicators/indicator-customization/indicator-types/enhancement-scripts.md): Use enhancement scripts in Cortex XSOAR 6.13 Threat Intel Management. * [Reputation Scripts](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-6-threat-intel-management-guides/6.13/configure-indicators/indicator-customization/indicator-types/reputation-scripts.md): Use reputation scripts in Cortex XSOAR 6.13 Threat Intel Management. * [Reputation Commands](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-6-threat-intel-management-guides/6.13/configure-indicators/indicator-customization/indicator-types/reputation-commands.md): Use reputation commands in Cortex XSOAR 6.13 Threat Intel Management. * [Map Custom Indicator Fields](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-6-threat-intel-management-guides/6.13/configure-indicators/indicator-customization/indicator-types/map-custom-indicator-fields.md): Map custom fields in Cortex XSOAR 6.13 Threat Intel Management. * [Indicator Fields](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-6-threat-intel-management-guides/6.13/configure-indicators/indicator-customization/indicator-fields.md): Configure indicator fields in Cortex XSOAR 6.13 Threat Intel Management. * [Create a Custom Indicator Field](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-6-threat-intel-management-guides/6.13/configure-indicators/indicator-customization/indicator-fields/create-a-custom-indicator-field.md): Create custom fields in Cortex XSOAR 6.13 Threat Intel Management. * [Indicator Field Trigger Scripts](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-6-threat-intel-management-guides/6.13/configure-indicators/indicator-customization/indicator-fields/indicator-field-trigger-scripts.md): Configure field triggers in Cortex XSOAR 6.13 Threat Intel Management. * [Indicator Fields Structure](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-6-threat-intel-management-guides/6.13/configure-indicators/indicator-customization/indicator-fields/indicator-fields-structure.md): Understand field structure in Cortex XSOAR 6.13 Threat Intel Management. * [Indicator Layouts](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-6-threat-intel-management-guides/6.13/configure-indicators/indicator-customization/indicator-layouts.md): Configure indicator layouts in Cortex XSOAR 6.13 Threat Intel Management. * [Customize an Indicator Type Layout](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-6-threat-intel-management-guides/6.13/configure-indicators/indicator-customization/indicator-layouts/customize-an-indicator-type-layout.md): Customize layouts in Cortex XSOAR 6.13 Threat Intel Management. * [Add a Script in the Indicator Layout](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-6-threat-intel-management-guides/6.13/configure-indicators/indicator-customization/indicator-layouts/add-a-script-in-the-indicator-layout.md): Add layout scripts in Cortex XSOAR 6.13 Threat Intel Management. * [Indicator Extraction](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-6-threat-intel-management-guides/6.13/configure-indicators/indicator-extraction.md): Configure indicator extraction in Cortex XSOAR 6.13 Threat Intel Management. * [Indicator Extraction Modes](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-6-threat-intel-management-guides/6.13/configure-indicators/indicator-extraction/indicator-extraction-modes.md): Configure extraction modes in Cortex XSOAR 6.13 Threat Intel Management. * [Create Indicator Extraction Rules for an Incident Type](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-6-threat-intel-management-guides/6.13/configure-indicators/indicator-extraction/create-indicator-extraction-rules-for-an-incident-type.md): Create extraction rules in Cortex XSOAR 6.13 Threat Intel Management. * [Run Indicator Extraction in the CLI](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-6-threat-intel-management-guides/6.13/configure-indicators/indicator-extraction/run-indicator-extraction-in-the-cli.md): Run CLI extraction in Cortex XSOAR 6.13 Threat Intel Management. * [Create Indicator Extract Rules for a Playbook Task](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-6-threat-intel-management-guides/6.13/configure-indicators/indicator-extraction/create-indicator-extract-rules-for-a-playbook-task.md): Create task extraction rules in Cortex XSOAR 6.13 Threat Intel Management. * [Disable Indicator Extraction for Automations or Integrations](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-6-threat-intel-management-guides/6.13/configure-indicators/indicator-extraction/disable-indicator-extraction-for-automations-or-integrations.md): Disable extraction in Cortex XSOAR 6.13 Threat Intel Management. * [Indicator Management](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-6-threat-intel-management-guides/6.13/configure-indicators/indicator-management.md): Manage indicators in Cortex XSOAR 6.13 Threat Intel Management. * [Indicator Query](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-6-threat-intel-management-guides/6.13/configure-indicators/indicator-management/indicator-query.md): Query indicators in Cortex XSOAR 6.13 Threat Intel Management. * [Configure the Indicator Timeline](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-6-threat-intel-management-guides/6.13/configure-indicators/indicator-management/configure-the-indicator-timeline.md): Configure timelines in Cortex XSOAR 6.13 Threat Intel Management. * [Exclusion List](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-6-threat-intel-management-guides/6.13/configure-indicators/indicator-management/exclusion-list.md): Manage exclusions in Cortex XSOAR 6.13 Threat Intel Management. * [Export Indicators](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-6-threat-intel-management-guides/6.13/configure-indicators/indicator-management/export-indicators.md): Export indicators from Cortex XSOAR 6.13 Threat Intel Management. * [Manually Export Indicators](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-6-threat-intel-management-guides/6.13/configure-indicators/indicator-management/export-indicators/manually-export-indicators.md): Manually export indicators from Cortex XSOAR 6.13 Threat Intel Management. * [Export Indicators Integrations](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-6-threat-intel-management-guides/6.13/configure-indicators/indicator-management/export-indicators/export-indicators-integrations.md): Export using integrations in Cortex XSOAR 6.13 Threat Intel Management. * [Export Indicators Playbooks](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-6-threat-intel-management-guides/6.13/configure-indicators/indicator-management/export-indicators/export-indicators-playbooks.md): Export through playbooks in Cortex XSOAR 6.13 Threat Intel Management. * [Export an Indicator to CSV Using the UTF8-BOM Format](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-6-threat-intel-management-guides/6.13/configure-indicators/indicator-management/export-indicators/export-an-indicator-to-csv-using-the-utf8-bom-format.md): Export UTF8-BOM CSV files in Cortex XSOAR 6.13 Threat Intel Management. * [Indicator Relationships](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-6-threat-intel-management-guides/6.13/configure-indicators/indicator-management/indicator-relationships.md): Use relationships in Cortex XSOAR 6.13 Threat Intel Management. * [Create Indicator Relationships](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-6-threat-intel-management-guides/6.13/configure-indicators/indicator-management/indicator-relationships/create-indicator-relationships.md): Create relationships in Cortex XSOAR 6.13 Threat Intel Management. * [Leverage Relationships in the Canvas](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-6-threat-intel-management-guides/6.13/configure-indicators/indicator-management/indicator-relationships/leverage-relationships-in-the-canvas.md): Use canvas relationships in Cortex XSOAR 6.13 Threat Intel Management. * [Indicator Expiration](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-6-threat-intel-management-guides/6.13/configure-indicators/indicator-expiration.md): Configure expiration in Cortex XSOAR 6.13 Threat Intel Management. * [Threat Intel Feeds](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-6-threat-intel-management-guides/6.13/configure-indicators/threat-intel-feeds.md): Configure feeds in Cortex XSOAR 6.13 Threat Intel Management. * [Feed Integrations](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-6-threat-intel-management-guides/6.13/configure-indicators/threat-intel-feeds/feed-integrations.md): Configure feed integrations in Cortex XSOAR 6.13 Threat Intel Management. * [Feed-Triggered Jobs](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-6-threat-intel-management-guides/6.13/configure-indicators/threat-intel-feeds/feed-integrations/feed-triggered-jobs.md): Run feed-triggered jobs in Cortex XSOAR 6.13 Threat Intel Management. * [Set the Source Reliability of Enrichment Integrations](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-6-threat-intel-management-guides/6.13/configure-indicators/threat-intel-feeds/set-the-source-reliability-of-enrichment-integrations.md): Set source reliability in Cortex XSOAR 6.13 Threat Intel Management. * [Threat Intelligence Management Playbooks](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-6-threat-intel-management-guides/6.13/configure-indicators/threat-intel-feeds/threat-intelligence-management-playbooks.md): Configure playbooks in Cortex XSOAR 6.13 Threat Intel Management. * [Threat Intel Reports](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-6-threat-intel-management-guides/6.13/reports/threat-intel-reports.md): Work with reports in Cortex XSOAR 6.13 Threat Intel Management. * [Threat Intel Reports Overview](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-6-threat-intel-management-guides/6.13/reports/threat-intel-reports/threat-intel-reports-overview.md): Explore reports in Cortex XSOAR 6.13 Threat Intel Management. * [Threat Intel Reports Customization](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-6-threat-intel-management-guides/6.13/reports/threat-intel-reports/threat-intel-reports-customization.md): Customize reports in Cortex XSOAR 6.13 Threat Intel Management. * [Configure Threat Intel Report Types](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-6-threat-intel-management-guides/6.13/reports/threat-intel-reports/threat-intel-reports-customization/configure-threat-intel-report-types.md): Configure report types in Cortex XSOAR 6.13 Threat Intel Management. * [Configure Threat Intel Report Fields](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-6-threat-intel-management-guides/6.13/reports/threat-intel-reports/threat-intel-reports-customization/configure-threat-intel-report-fields.md): Configure report fields in Cortex XSOAR 6.13 Threat Intel Management. * [Configure Threat Intel Report Layouts](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-6-threat-intel-management-guides/6.13/reports/threat-intel-reports/threat-intel-reports-customization/configure-threat-intel-report-layouts.md): Configure report layouts in Cortex XSOAR 6.13 Threat Intel Management. * [Threat Intel Reports Management](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-6-threat-intel-management-guides/6.13/reports/threat-intel-reports/threat-intel-reports-management.md): Manage reports in Cortex XSOAR 6.13 Threat Intel Management. * [Create a Threat Intel Report](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-6-threat-intel-management-guides/6.13/reports/threat-intel-reports/threat-intel-reports-management/create-a-threat-intel-report.md): Create reports in Cortex XSOAR 6.13 Threat Intel Management. * [RBAC for Reports](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-6-threat-intel-management-guides/6.13/reports/threat-intel-reports/threat-intel-reports-management/rbac-for-reports.md): Control report access in Cortex XSOAR 6.13 Threat Intel Management. * [Generate a Threat Intel Report](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-6-threat-intel-management-guides/6.13/reports/threat-intel-reports/threat-intel-reports-management/generate-a-threat-intel-report.md): Generate reports in Cortex XSOAR 6.13 Threat Intel Management. * [Publish a Threat Intel Report](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-6-threat-intel-management-guides/6.13/reports/threat-intel-reports/threat-intel-reports-management/publish-a-threat-intel-report.md): Publish reports in Cortex XSOAR 6.13 Threat Intel Management. - [Navigate the Threat Intel Management Guide](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-6-threat-intel-management-guides/6.12/learn-about-threat-intel-management/readme.md): Start here for a visual overview of Cortex XSOAR 6.12 Threat Intel Management documentation areas. - [Threat Intel Management Overview](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-6-threat-intel-management-guides/6.12/learn-about-threat-intel-management/threat-intel-management-overview.md): Learn about native threat intel capabilities in Cortex XSOAR 6.12. - [Indicator Concepts](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-6-threat-intel-management-guides/6.12/learn-about-threat-intel-management/threat-intel-management-overview/indicator-concepts.md): Learn about threat intelligence management concepts in Cortex XSOAR 6.12. - [Indicator Verdict](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-6-threat-intel-management-guides/6.12/learn-about-threat-intel-management/threat-intel-management-overview/indicator-verdict.md): Learn how source reliability assigns indicator verdicts in Cortex XSOAR 6.12. - [Indicator Ingestion](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-6-threat-intel-management-guides/6.12/learn-about-threat-intel-management/threat-intel-management-overview/indicator-ingestion.md): Learn how indicators are detected and ingested in Cortex XSOAR 6.12. - [Indicator Customization](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-6-threat-intel-management-guides/6.12/configure-indicators/indicator-customization.md): Customize indicator types, fields, and layouts in Cortex XSOAR 6.12. - [Indicator Types](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-6-threat-intel-management-guides/6.12/configure-indicators/indicator-customization/indicator-types.md): Learn how indicator types are determined in Cortex XSOAR 6.12. - [File Indicators](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-6-threat-intel-management-guides/6.12/configure-indicators/indicator-customization/indicator-types/file-indicators.md): Configure file indicators and hashes in Cortex XSOAR 6.12. - [Create an Indicator Type](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-6-threat-intel-management-guides/6.12/configure-indicators/indicator-customization/indicator-types/create-an-indicator-type.md): Create custom indicator types in Cortex XSOAR 6.12. - [Indicator Type Profile](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-6-threat-intel-management-guides/6.12/configure-indicators/indicator-customization/indicator-types/indicator-type-profile.md): Configure indicator type profiles in Cortex XSOAR 6.12. - [Formatting Scripts](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-6-threat-intel-management-guides/6.12/configure-indicators/indicator-customization/indicator-types/formatting-scripts.md): Use formatting scripts for indicators in Cortex XSOAR 6.12. - [Enhancement Scripts](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-6-threat-intel-management-guides/6.12/configure-indicators/indicator-customization/indicator-types/enhancement-scripts.md): Use enhancement scripts for indicators in Cortex XSOAR 6.12. - [Reputation Scripts](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-6-threat-intel-management-guides/6.12/configure-indicators/indicator-customization/indicator-types/reputation-scripts.md): Use reputation scripts for indicator enrichment in Cortex XSOAR 6.12. - [Reputation Commands](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-6-threat-intel-management-guides/6.12/configure-indicators/indicator-customization/indicator-types/reputation-commands.md): Run reputation commands by indicator type in Cortex XSOAR 6.12. - [Map Custom Indicator Fields](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-6-threat-intel-management-guides/6.12/configure-indicators/indicator-customization/indicator-types/map-custom-indicator-fields.md): Map custom indicator fields to context data in Cortex XSOAR 6.12. - [Indicator Fields](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-6-threat-intel-management-guides/6.12/configure-indicators/indicator-customization/indicator-fields.md): Add and associate indicator fields in Cortex XSOAR 6.12. - [Create a Custom Indicator Field](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-6-threat-intel-management-guides/6.12/configure-indicators/indicator-customization/indicator-fields/create-a-custom-indicator-field.md): Create custom indicator fields in Cortex XSOAR 6.12. - [Indicator Field Trigger Scripts](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-6-threat-intel-management-guides/6.12/configure-indicators/indicator-customization/indicator-fields/indicator-field-trigger-scripts.md): Associate indicator fields with trigger scripts in Cortex XSOAR 6.12. - [Indicator Fields Structure](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-6-threat-intel-management-guides/6.12/configure-indicators/indicator-customization/indicator-fields/indicator-fields-structure.md): Understand the STIX-aligned indicator field structure in Cortex XSOAR 6.12. - [Indicator Layouts](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-6-threat-intel-management-guides/6.12/configure-indicators/indicator-customization/indicator-layouts.md): Learn about indicator view layouts in Cortex XSOAR 6.12. - [Customize an Indicator Type Layout](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-6-threat-intel-management-guides/6.12/configure-indicators/indicator-customization/indicator-layouts/customize-an-indicator-type-layout.md): Customize indicator type layouts in Cortex XSOAR 6.12. - [Add a Script in the Indicator Layout](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-6-threat-intel-management-guides/6.12/configure-indicators/indicator-customization/indicator-layouts/add-a-script-in-the-indicator-layout.md): Add scripts to indicator layouts in Cortex XSOAR 6.12. - [Indicator Extraction](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-6-threat-intel-management-guides/6.12/configure-indicators/indicator-extraction.md): Extract and enrich indicators from incident fields in Cortex XSOAR 6.12. - [Indicator Extraction Modes](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-6-threat-intel-management-guides/6.12/configure-indicators/indicator-extraction/indicator-extraction-modes.md): Configure indicator extraction modes in Cortex XSOAR 6.12. - [Create Indicator Extraction Rules for an Incident Type](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-6-threat-intel-management-guides/6.12/configure-indicators/indicator-extraction/create-indicator-extraction-rules-for-an-incident-type.md): Create incident type extraction rules in Cortex XSOAR 6.12. - [Run Indicator Extraction in the CLI](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-6-threat-intel-management-guides/6.12/configure-indicators/indicator-extraction/run-indicator-extraction-in-the-cli.md): Run indicator extraction commands in the Cortex XSOAR 6.12 CLI. - [Create Indicator Extract Rules for a Playbook Task](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-6-threat-intel-management-guides/6.12/configure-indicators/indicator-extraction/create-indicator-extract-rules-for-a-playbook-task.md): Create playbook task extraction rules in Cortex XSOAR 6.12. - [Disable Indicator Extraction for Automations or Integrations](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-6-threat-intel-management-guides/6.12/configure-indicators/indicator-extraction/disable-indicator-extraction-for-automations-or-integrations.md): Disable indicator extraction for automations and integrations in Cortex XSOAR 6.12. - [Indicator Management](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-6-threat-intel-management-guides/6.12/configure-indicators/indicator-management.md): Create, manage, search, and export indicators in Cortex XSOAR 6.12. - [Configure the Indicator Timeline](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-6-threat-intel-management-guides/6.12/configure-indicators/indicator-management/configure-the-indicator-timeline.md): Configure the indicator timeline in Cortex XSOAR 6.12. - [Exclusion List](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-6-threat-intel-management-guides/6.12/configure-indicators/indicator-management/exclusion-list.md): Add indicators to an exclusion list in Cortex XSOAR 6.12. - [Export Indicators](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-6-threat-intel-management-guides/6.12/configure-indicators/indicator-management/export-indicators.md): Export indicators as lists or files in Cortex XSOAR 6.12. - [Manually Export Indicators](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-6-threat-intel-management-guides/6.12/configure-indicators/indicator-management/export-indicators/manually-export-indicators.md): Manually export indicators to a file in Cortex XSOAR 6.12. - [Export Indicators Integrations](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-6-threat-intel-management-guides/6.12/configure-indicators/indicator-management/export-indicators/export-indicators-integrations.md): Export indicators through integrations in Cortex XSOAR 6.12. - [Export Indicators Playbooks](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-6-threat-intel-management-guides/6.12/configure-indicators/indicator-management/export-indicators/export-indicators-playbooks.md): Export indicators through playbooks in Cortex XSOAR 6.12. - [Export an Indicator to CSV Using the UTF8-BOM Format](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-6-threat-intel-management-guides/6.12/configure-indicators/indicator-management/export-indicators/export-an-indicator-to-csv-using-the-utf8-bom-format.md): Export indicators to UTF8-BOM CSV files in Cortex XSOAR 6.12. - [Indicator Relationships](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-6-threat-intel-management-guides/6.12/configure-indicators/indicator-management/indicator-relationships.md): Create connections between indicators in Cortex XSOAR 6.12. - [Create Indicator Relationships](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-6-threat-intel-management-guides/6.12/configure-indicators/indicator-management/indicator-relationships/create-indicator-relationships.md): Create indicator relationships in Cortex XSOAR 6.12. - [Leverage Relationships in the Canvas](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-6-threat-intel-management-guides/6.12/configure-indicators/indicator-management/indicator-relationships/leverage-relationships-in-the-canvas.md): Use indicator relationships in the canvas in Cortex XSOAR 6.12. - [Indicator Expiration](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-6-threat-intel-management-guides/6.12/configure-indicators/indicator-expiration.md): Configure indicator expiration in Cortex XSOAR 6.12. - [Threat Intel Feeds](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-6-threat-intel-management-guides/6.12/configure-indicators/threat-intel-feeds.md): Import and export indicators through feeds in Cortex XSOAR 6.12. - [Feed Integrations](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-6-threat-intel-management-guides/6.12/configure-indicators/threat-intel-feeds/feed-integrations.md): Fetch indicators through feed integrations in Cortex XSOAR 6.12. - [Set the Source Reliability of Enrichment Integrations](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-6-threat-intel-management-guides/6.12/configure-indicators/threat-intel-feeds/set-the-source-reliability-of-enrichment-integrations.md): Set enrichment integration source reliability in Cortex XSOAR 6.12. - [Threat Intelligence Management Playbooks](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-6-threat-intel-management-guides/6.12/configure-indicators/threat-intel-feeds/threat-intelligence-management-playbooks.md): Configure Threat Intel Management playbooks in Cortex XSOAR 6.12. - [Threat Intel Reports](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-6-threat-intel-management-guides/6.12/reports/threat-intel-reports.md): Create Threat Intel Reports in Cortex XSOAR 6.12. - [Threat Intel Reports Overview](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-6-threat-intel-management-guides/6.12/reports/threat-intel-reports/threat-intel-reports-overview.md): Learn about threat intel reports in Cortex XSOAR 6.12. - [Threat Intel Reports Customization](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-6-threat-intel-management-guides/6.12/reports/threat-intel-reports/threat-intel-reports-customization.md): Customize threat intel report types in Cortex XSOAR 6.12. - [Configure Threat Intel Report Types](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-6-threat-intel-management-guides/6.12/reports/threat-intel-reports/threat-intel-reports-customization/configure-threat-intel-report-types.md): Configure threat intel report types in Cortex XSOAR 6.12. - [Configure Threat Intel Report Fields](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-6-threat-intel-management-guides/6.12/reports/threat-intel-reports/threat-intel-reports-customization/configure-threat-intel-report-fields.md): Configure threat intel report fields in Cortex XSOAR 6.12. - [Configure Threat Intel Report Layouts](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-6-threat-intel-management-guides/6.12/reports/threat-intel-reports/threat-intel-reports-customization/configure-threat-intel-report-layouts.md): Configure threat intel report layouts in Cortex XSOAR 6.12. - [Threat Intel Reports Management](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-6-threat-intel-management-guides/6.12/reports/threat-intel-reports/threat-intel-reports-management.md): Manage threat intel reports in Cortex XSOAR 6.12. - [Create a Threat Intel Report](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-6-threat-intel-management-guides/6.12/reports/threat-intel-reports/threat-intel-reports-management/create-a-threat-intel-report.md): Create a threat intel report from a type and layout in Cortex XSOAR 6.12. - [RBAC for Reports](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-6-threat-intel-management-guides/6.12/reports/threat-intel-reports/threat-intel-reports-management/rbac-for-reports.md): Control threat intel report access with RBAC in Cortex XSOAR 6.12. - [Generate a Threat Intel Report](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-6-threat-intel-management-guides/6.12/reports/threat-intel-reports/threat-intel-reports-management/generate-a-threat-intel-report.md): Generate and share threat intel reports in Cortex XSOAR 6.12. - [Publish a Threat Intel Report](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-6-threat-intel-management-guides/6.12/reports/threat-intel-reports/threat-intel-reports-management/publish-a-threat-intel-report.md): Publish read-only threat intel reports in Cortex XSOAR 6.12. ## Cortex XSOAR 6 Multi-Tenant Guides - [Cortex XSOAR 6 Multi-Tenant Guides](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-6-multi-tenant-guides/cortex-xsoar-6-multi-tenant-guides.md): Start here to choose the right Cortex XSOAR 6 version. * [Navigate the Multi-Tenant Guide](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-6-multi-tenant-guides/6.15/learn-about-mult-tenant/readme.md): Start here for a visual overview of the Cortex XSOAR Multi-Tenant 6.15 documentation areas. * [Multi-Tenant Deployments](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-6-multi-tenant-guides/6.15/learn-about-mult-tenant/readme-1.md): Explore Cortex XSOAR 6.15 multi-tenant deployments for MSSPs and enterprises, including architecture and high availability. * [Multi-Tenant Overview](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-6-multi-tenant-guides/6.15/learn-about-mult-tenant/readme-1/multi-tenant-overview.md): Learn how Cortex XSOAR 6.15 multi-tenant deployments provide data segregation, centralized management, and scalable tenant operations. * [Multi-Tenant High Availability Overview](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-6-multi-tenant-guides/6.15/learn-about-mult-tenant/readme-1/multi-tenant-high-availability-overview.md): Understand high availability architecture, failover, and scaling for Cortex XSOAR 6.15 multi-tenant deployments. * [Plan Your Multi-Tenant Deployment](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-6-multi-tenant-guides/6.15/learn-about-mult-tenant/plan-your-multi-tenant-deployment.md): Plan a Cortex XSOAR 6.15 multi-tenant deployment with sizing, security, SAML, and host-to-main communication guidance. * [Multi-Tenant Sizing Requirements](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-6-multi-tenant-guides/6.15/learn-about-mult-tenant/plan-your-multi-tenant-deployment/multi-tenant-sizing-requirements.md): Review Cortex XSOAR 6.15 multi-tenant sizing requirements for hosts and tenants, including production hardware recommendations. * [Configure Security Settings for Multi-Tenant Deployments](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-6-multi-tenant-guides/6.15/learn-about-mult-tenant/plan-your-multi-tenant-deployment/configure-security-settings-for-multi-tenant-deployments.md): Harden Cortex XSOAR 6.15 multi-tenant deployments with recommended server configurations for secure main and tenant communication. * [SAML for Multi-Tenant Deployments](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-6-multi-tenant-guides/6.15/learn-about-mult-tenant/plan-your-multi-tenant-deployment/saml-for-multi-tenant-deployments.md): Configure SAML 2.0 authentication for main and tenant accounts in a Cortex XSOAR 6.15 multi-tenant deployment. * [Communication in a Multi-Tenant Deployment](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-6-multi-tenant-guides/6.15/learn-about-mult-tenant/plan-your-multi-tenant-deployment/communication-in-a-multi-tenant-deployment.md): Review ports, TLS requirements, and host-to-tenant communication for Cortex XSOAR 6.15 multi-tenant deployments. * [Change the Port for Host to Main Communication](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-6-multi-tenant-guides/6.15/learn-about-mult-tenant/plan-your-multi-tenant-deployment/change-the-port-for-host-to-main-communication.md): Set a custom host-to-main communication port in a Cortex XSOAR 6.15 multi-tenant deployment. * [Multi-Tenant Deployment Installation](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-6-multi-tenant-guides/6.15/onboard-multi-tenant/multi-tenant-deployment-installation.md): Install or upgrade Cortex XSOAR 6.15 multi-tenant deployments with BoltDB or Elasticsearch. * [Install Cortex XSOAR for a Multi-Tenant Deployment](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-6-multi-tenant-guides/6.15/onboard-multi-tenant/multi-tenant-deployment-installation/install-cortex-xsoar-for-a-multi-tenant-deployment.md): Install Cortex XSOAR 6.15 for a multi-tenant deployment using the BoltDB database. * [Installer Flags](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-6-multi-tenant-guides/6.15/onboard-multi-tenant/multi-tenant-deployment-installation/install-cortex-xsoar-for-a-multi-tenant-deployment/installer-flags.md): Review supported installer flags for Cortex XSOAR 6.15 multi-tenant deployments. * [Install Cortex XSOAR for a Multi-Tenant Deployment with Elasticsearch](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-6-multi-tenant-guides/6.15/onboard-multi-tenant/multi-tenant-deployment-installation/install-cortex-xsoar-for-a-multi-tenant-deployment-with-elasticsearch.md): Install Cortex XSOAR 6.15 for a multi-tenant deployment with an Elasticsearch database. * [Upgrade Your Multi-Tenant Deployment](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-6-multi-tenant-guides/6.15/onboard-multi-tenant/multi-tenant-deployment-installation/upgrade-your-multi-tenant-deployment.md): Prepare, upgrade, and validate a Cortex XSOAR 6.15 multi-tenant deployment. * [Get the Host Installer Manually](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-6-multi-tenant-guides/6.15/onboard-multi-tenant/multi-tenant-deployment-installation/get-the-host-installer-manually.md): Manually download and run the host installer for Cortex XSOAR 6.15 multi-tenant deployments. * [Configure the Multi-Tenant Deployment](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-6-multi-tenant-guides/6.15/configure-multi-tenant/configure-the-multi-tenant-deployment.md): Configure hosts, tenants, backups, and engines in a Cortex XSOAR 6.15 multi-tenant deployment. * [Main Account to Tenant Communication Encryption](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-6-multi-tenant-guides/6.15/configure-multi-tenant/configure-the-multi-tenant-deployment/main-account-to-tenant-communication-encryption.md): Configure encrypted, two-way main-account and tenant communication in Cortex XSOAR 6.15 multi-tenant deployments. * [Add a Host](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-6-multi-tenant-guides/6.15/configure-multi-tenant/configure-the-multi-tenant-deployment/add-a-host.md): Add host servers to scale Cortex XSOAR 6.15 multi-tenant deployments across tenant workloads. * [Add a Tenant to a Host](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-6-multi-tenant-guides/6.15/configure-multi-tenant/configure-the-multi-tenant-deployment/add-a-tenant-to-a-host.md): Add tenant accounts to hosts and assign user roles in Cortex XSOAR 6.15 multi-tenant deployments. * [Delete a Tenant From a Host](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-6-multi-tenant-guides/6.15/configure-multi-tenant/configure-the-multi-tenant-deployment/delete-a-tenant-from-a-host.md): Delete a tenant account from a host through Account Management in Cortex XSOAR 6.15. * [Delete a Host](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-6-multi-tenant-guides/6.15/configure-multi-tenant/configure-the-multi-tenant-deployment/delete-a-host.md): Delete a host from a Cortex XSOAR 6.15 multi-tenant environment. * [Configure Live Backup](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-6-multi-tenant-guides/6.15/configure-multi-tenant/configure-the-multi-tenant-deployment/configure-live-backup.md): Configure Live Backup for main and host servers in Cortex XSOAR 6.15 multi-tenant deployments. * [Configure the HTTP Request Timeout](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-6-multi-tenant-guides/6.15/configure-multi-tenant/configure-the-multi-tenant-deployment/configure-the-http-request-timeout.md): Configure HTTP request timeouts for main and tenant accounts in Cortex XSOAR 6.15 multi-tenant deployments. * [Configure the Account Timeout](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-6-multi-tenant-guides/6.15/configure-multi-tenant/configure-the-multi-tenant-deployment/configure-the-account-timeout.md): Configure account timeouts when moving large tenant accounts in Cortex XSOAR 6.15. * [Forward Server Configurations to Tenant Accounts](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-6-multi-tenant-guides/6.15/configure-multi-tenant/configure-the-multi-tenant-deployment/forward-server-configurations-to-tenant-accounts.md): Forward server configurations from the main account to tenants in Cortex XSOAR 6.15 multi-tenant deployments. * [Run a Command on Multiple Tenants](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-6-multi-tenant-guides/6.15/configure-multi-tenant/configure-the-multi-tenant-deployment/run-a-command-on-multiple-tenants.md): Run commands on incidents across multiple tenants in Cortex XSOAR 6.15 multi-tenant deployments. * [Move a Tenant to a Different Host](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-6-multi-tenant-guides/6.15/configure-multi-tenant/configure-the-multi-tenant-deployment/move-a-tenant-to-a-different-host.md): Back up and move a tenant to another host in a Cortex XSOAR 6.15 multi-tenant deployment. * [Stop and Start a Tenant](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-6-multi-tenant-guides/6.15/configure-multi-tenant/configure-the-multi-tenant-deployment/stop-and-start-a-tenant.md): Start, stop, or reindex tenant accounts through the UI or API in Cortex XSOAR 6.15. * [Block and Unblock a Tenant](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-6-multi-tenant-guides/6.15/configure-multi-tenant/configure-the-multi-tenant-deployment/block-and-unblock-a-tenant.md): Block or unblock tenant accounts at the proxy level in Cortex XSOAR 6.15 multi-tenant deployments. * [Reindex a Tenant Database](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-6-multi-tenant-guides/6.15/configure-multi-tenant/configure-the-multi-tenant-deployment/reindex-a-tenant-database.md): Reindex a tenant database in a Cortex XSOAR 6.15 multi-tenant environment. * [Back Up a Tenant](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-6-multi-tenant-guides/6.15/configure-multi-tenant/configure-the-multi-tenant-deployment/back-up-a-tenant.md): Create manual or automatic backups of tenant databases in Cortex XSOAR 6.15 multi-tenant deployments. * [Reindex a Specific Index for a Tenant](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-6-multi-tenant-guides/6.15/configure-multi-tenant/configure-the-multi-tenant-deployment/reindex-a-specific-index-for-a-tenant.md): Reindex one or more indexes for an individual tenant in Cortex XSOAR 6.15 multi-tenant deployments. * [Restore a Tenant Database](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-6-multi-tenant-guides/6.15/configure-multi-tenant/configure-the-multi-tenant-deployment/restore-a-tenant-database.md): Restore a tenant database from a manual or automated backup in Cortex XSOAR 6.15. * [Restore a Partition for a Tenant](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-6-multi-tenant-guides/6.15/configure-multi-tenant/configure-the-multi-tenant-deployment/restore-a-partition-for-a-tenant.md): Restore a partition for a specific tenant in a Cortex XSOAR 6.15 multi-tenant environment. * [Index War Room Entries in a Multi-Tenant Deployment](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-6-multi-tenant-guides/6.15/configure-multi-tenant/configure-the-multi-tenant-deployment/index-war-room-entries-in-a-multi-tenant-deployment.md): Index War Room entries and reindex incidents for tenant searches in Cortex XSOAR 6.15. * [Install Engines on Tenants in a Multi-Tenant Deployment](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-6-multi-tenant-guides/6.15/configure-multi-tenant/configure-the-multi-tenant-deployment/install-engines-on-tenants-in-a-multi-tenant-deployment.md): Install tenant engines and configure firewall access in Cortex XSOAR 6.15 multi-tenant deployments. * [Configure User Settings](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-6-multi-tenant-guides/6.15/configure-multi-tenant/configure-user-settings.md): Cortex XSOAR 6.15 users can control details, preferences, and notifications, by changing the notifications settings in their user profile. * [Manage Content](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-6-multi-tenant-guides/6.15/configure-multi-tenant/manage-content.md): Manage propagation labels and sync tenant content in Cortex XSOAR 6.15 multi-tenant deployments. * [Manage Content Overview](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-6-multi-tenant-guides/6.15/configure-multi-tenant/manage-content/manage-content-overview.md): Understand propagation labels and content synchronization in Cortex XSOAR 6.15 multi-tenant deployments. * [Add Propagation Labels to an Existing Tenant Account](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-6-multi-tenant-guides/6.15/configure-multi-tenant/manage-content/add-propagation-labels-to-an-existing-tenant-account.md): Add propagation labels to tenant accounts to control content synchronization in Cortex XSOAR 6.15. * [Add Propagation Labels to Content](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-6-multi-tenant-guides/6.15/configure-multi-tenant/manage-content/add-propagation-labels-to-content.md): Apply propagation labels to control content synchronized to tenant accounts in Cortex XSOAR 6.15. * [Add Propagation Labels in Remote Repositories](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-6-multi-tenant-guides/6.15/configure-multi-tenant/manage-content/add-propagation-labels-in-remote-repositories.md): Add propagation labels through remote repositories in Cortex XSOAR 6.15 multi-tenant deployments. * [Content Dependencies and Propagation](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-6-multi-tenant-guides/6.15/configure-multi-tenant/manage-content/content-dependencies-and-propagation.md): Understand how content dependencies propagate to tenants in Cortex XSOAR 6.15 multi-tenant deployments. * [Sync Content to Tenant Accounts](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-6-multi-tenant-guides/6.15/configure-multi-tenant/manage-content/sync-content-to-tenant-accounts.md): Synchronize content with individual or all tenant accounts in Cortex XSOAR 6.15 multi-tenant deployments. * [Troubleshoot Errors When Syncing All Accounts](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-6-multi-tenant-guides/6.15/configure-multi-tenant/manage-content/sync-content-to-tenant-accounts/troubleshoot-errors-when-syncing-all-accounts.md): Troubleshoot all-account sync errors in large Cortex XSOAR 6.15 multi-tenant environments. * [Disable Propagation Labels](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-6-multi-tenant-guides/6.15/configure-multi-tenant/manage-content/disable-propagation-labels.md): Disable propagation labels and automatically synchronize tenant content in Cortex XSOAR 6.15. * [Restrict Actions for Custom Locked Content Items](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-6-multi-tenant-guides/6.15/configure-multi-tenant/manage-content/restrict-actions-for-custom-locked-content-items.md): Restrict tenant actions for custom locked content items in Cortex XSOAR 6.15 multi-tenant deployments. * [Share Indicators](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-6-multi-tenant-guides/6.15/configure-multi-tenant/share-indicators.md): Share threat indicators between tenant accounts in Cortex XSOAR 6.15 multi-tenant deployments. * [Share Indicators Overview](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-6-multi-tenant-guides/6.15/configure-multi-tenant/share-indicators/share-indicators-overview.md): Share tenant indicators through shared Elasticsearch indexes in Cortex XSOAR 6.15 multi-tenant deployments. * [Manually Share Indicators](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-6-multi-tenant-guides/6.15/configure-multi-tenant/share-indicators/manually-share-indicators.md): Manually share tenant indicators with a dedicated Elasticsearch index in Cortex XSOAR 6.15. * [Export Indicators to the Shared Index](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-6-multi-tenant-guides/6.15/configure-multi-tenant/share-indicators/export-indicators-to-the-shared-index.md): Configure tenant indicator exports to a shared index in Cortex XSOAR 6.15 multi-tenant deployments. * [Ingest Indicators from the Shared Indicators Index](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-6-multi-tenant-guides/6.15/configure-multi-tenant/share-indicators/ingest-indicators-from-the-shared-indicators-index.md): Configure tenants to ingest shared indicators with Elasticsearch Feed in Cortex XSOAR 6.15. * [Remote Repositories for Multi-Tenant Deployments](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-6-multi-tenant-guides/6.15/configure-multi-tenant/remote-repositories-for-multi-tenant-deployments.md): Configure remote repositories for Cortex XSOAR 6.15 multi-tenant deployments. * [Remote Repositories Overview](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-6-multi-tenant-guides/6.15/configure-multi-tenant/remote-repositories-for-multi-tenant-deployments/remote-repositories-overview.md): Develop, test, and synchronize tenant content with remote repositories in Cortex XSOAR 6.15. * [Configure a Remote Repository on a Development Machine](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-6-multi-tenant-guides/6.15/configure-multi-tenant/remote-repositories-for-multi-tenant-deployments/configure-a-remote-repository-on-a-development-machine.md): Configure a development-machine remote repository for Cortex XSOAR 6.15 multi-tenant content. * [Configure a Remote Repository on the Main Account](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-6-multi-tenant-guides/6.15/configure-multi-tenant/remote-repositories-for-multi-tenant-deployments/configure-a-remote-repository-on-the-main-account.md): Configure a main-account remote repository for Cortex XSOAR 6.15 multi-tenant deployments. * [Edit and Push Content to a Remote Repository](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-6-multi-tenant-guides/6.15/configure-multi-tenant/remote-repositories-for-multi-tenant-deployments/edit-and-push-content-to-a-remote-repository.md): Edit and push content to remote repositories in Cortex XSOAR 6.15 multi-tenant deployments. * [Troubleshoot a Remote Repository Configuration](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-6-multi-tenant-guides/6.15/configure-multi-tenant/remote-repositories-for-multi-tenant-deployments/troubleshoot-a-remote-repository-configuration.md): Troubleshoot remote repository configuration issues in Cortex XSOAR 6.15 multi-tenant deployments. * [Troubleshoot a Remote Repository Definition](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-6-multi-tenant-guides/6.15/configure-multi-tenant/remote-repositories-for-multi-tenant-deployments/troubleshoot-a-remote-repository-configuration/troubleshoot-a-remote-repository-definition.md): Resolve remote repository definition errors in Cortex XSOAR 6.15 multi-tenant deployments. * [Troubleshoot Editing and Pushing Content](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-6-multi-tenant-guides/6.15/configure-multi-tenant/remote-repositories-for-multi-tenant-deployments/troubleshoot-a-remote-repository-configuration/troubleshoot-editing-and-pushing-content.md): Troubleshoot editing and pushing content to remote repositories in Cortex XSOAR 6.15. * [Troubleshoot Content Issues](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-6-multi-tenant-guides/6.15/configure-multi-tenant/remote-repositories-for-multi-tenant-deployments/troubleshoot-a-remote-repository-configuration/troubleshoot-content-issues.md): Troubleshoot remote repository content issues and restore missing content in Cortex XSOAR 6.15. - [Navigate the Multi-Tenant Guide](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-6-multi-tenant-guides/6.14/learn-about-mult-tenant/readme.md): Start here for a visual overview of the Cortex XSOAR Multi-Tenant 6.14 documentation areas. - [Multi-Tenant Deployments](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-6-multi-tenant-guides/6.14/learn-about-mult-tenant/readme-1.md): Explore Cortex XSOAR 6.14 multi-tenant deployments for MSSPs and enterprises, including architecture and high availability. - [Multi-Tenant Overview](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-6-multi-tenant-guides/6.14/learn-about-mult-tenant/readme-1/multi-tenant-overview.md): Learn how Cortex XSOAR 6.14 multi-tenant deployments provide data segregation, centralized management, and scalable tenant operations. - [Multi-Tenant High Availability Overview](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-6-multi-tenant-guides/6.14/learn-about-mult-tenant/readme-1/multi-tenant-high-availability-overview.md): Understand high availability architecture, failover, and scaling for Cortex XSOAR 6.14 multi-tenant deployments. - [Plan Your Multi-Tenant Deployment](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-6-multi-tenant-guides/6.14/learn-about-mult-tenant/plan-your-multi-tenant-deployment.md): Plan a Cortex XSOAR 6.14 multi-tenant deployment with sizing, security, SAML, and host-to-main communication guidance. - [Multi-Tenant Sizing Requirements](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-6-multi-tenant-guides/6.14/learn-about-mult-tenant/plan-your-multi-tenant-deployment/multi-tenant-sizing-requirements.md): Review Cortex XSOAR 6.14 multi-tenant sizing requirements for hosts and tenants, including production hardware recommendations. - [Configure Security Settings for Multi-Tenant Deployments](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-6-multi-tenant-guides/6.14/learn-about-mult-tenant/plan-your-multi-tenant-deployment/configure-security-settings-for-multi-tenant-deployments.md): Harden Cortex XSOAR 6.14 multi-tenant deployments with recommended server configurations for secure main and tenant communication. - [SAML for Multi-Tenant Deployments](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-6-multi-tenant-guides/6.14/learn-about-mult-tenant/plan-your-multi-tenant-deployment/saml-for-multi-tenant-deployments.md): Configure SAML 2.0 authentication for main and tenant accounts in a Cortex XSOAR 6.14 multi-tenant deployment. - [Communication in a Multi-Tenant Deployment](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-6-multi-tenant-guides/6.14/learn-about-mult-tenant/plan-your-multi-tenant-deployment/communication-in-a-multi-tenant-deployment.md): Review ports, TLS requirements, and host-to-tenant communication for Cortex XSOAR 6.14 multi-tenant deployments. - [Configure unidirectional communication](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-6-multi-tenant-guides/6.14/learn-about-mult-tenant/plan-your-multi-tenant-deployment/communication-in-a-multi-tenant-deployment/configure-unidirectional-communication.md): Configure secure unidirectional host-to-main communication for a Cortex XSOAR 6.14 multi-tenant deployment. - [Change the Port for Host to Main Communication](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-6-multi-tenant-guides/6.14/learn-about-mult-tenant/plan-your-multi-tenant-deployment/change-the-port-for-host-to-main-communication.md): Set a custom host-to-main communication port in a Cortex XSOAR 6.14 multi-tenant deployment. - [Multi-Tenant Deployment Installation](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-6-multi-tenant-guides/6.14/onboard-multi-tenant/multi-tenant-deployment-installation.md): Install or upgrade Cortex XSOAR 6.14 multi-tenant deployments with BoltDB or Elasticsearch. - [Install Cortex XSOAR for a Multi-Tenant Deployment](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-6-multi-tenant-guides/6.14/onboard-multi-tenant/multi-tenant-deployment-installation/install-cortex-xsoar-for-a-multi-tenant-deployment.md): Install Cortex XSOAR 6.14 for a multi-tenant deployment on a single server with the application and database services on one host. - [Installer Flags](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-6-multi-tenant-guides/6.14/onboard-multi-tenant/multi-tenant-deployment-installation/install-cortex-xsoar-for-a-multi-tenant-deployment/installer-flags.md): Review supported installer flags for Cortex XSOAR 6.14 multi-tenant deployments. - [Install Cortex XSOAR for a Multi-Tenant Deployment with Elasticsearch](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-6-multi-tenant-guides/6.14/onboard-multi-tenant/multi-tenant-deployment-installation/install-cortex-xsoar-for-a-multi-tenant-deployment-with-elasticsearch.md): Install Cortex XSOAR 6.14 for a multi-tenant deployment with an Elasticsearch database. - [Upgrade Your Multi-Tenant Deployment](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-6-multi-tenant-guides/6.14/onboard-multi-tenant/multi-tenant-deployment-installation/upgrade-your-multi-tenant-deployment.md): Prepare, upgrade, and validate a Cortex XSOAR 6.14 multi-tenant deployment. - [Get the Host Installer Manually](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-6-multi-tenant-guides/6.14/onboard-multi-tenant/multi-tenant-deployment-installation/get-the-host-installer-manually.md): Manually download and run the host installer for Cortex XSOAR 6.14 multi-tenant deployments. - [Configure the Multi-Tenant Deployment](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-6-multi-tenant-guides/6.14/configure-multi-tenant/configure-the-multi-tenant-deployment.md): Configure hosts, tenants, backups, and engines in a Cortex XSOAR 6.14 multi-tenant deployment. - [Main Account to Tenant Communication Encryption](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-6-multi-tenant-guides/6.14/configure-multi-tenant/configure-the-multi-tenant-deployment/main-account-to-tenant-communication-encryption.md): Configure encrypted, two-way main-account and tenant communication in Cortex XSOAR 6.14 multi-tenant deployments. - [Add a Host](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-6-multi-tenant-guides/6.14/configure-multi-tenant/configure-the-multi-tenant-deployment/add-a-host.md): Add host servers to scale Cortex XSOAR 6.14 multi-tenant deployments across tenant workloads. - [Add a Tenant to a Host](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-6-multi-tenant-guides/6.14/configure-multi-tenant/configure-the-multi-tenant-deployment/add-a-tenant-to-a-host.md): Add tenant accounts to hosts and assign user roles in Cortex XSOAR 6.14 multi-tenant deployments. - [Delete a Tenant From a Host](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-6-multi-tenant-guides/6.14/configure-multi-tenant/configure-the-multi-tenant-deployment/delete-a-tenant-from-a-host.md): Delete a tenant account from a host through Account Management in Cortex XSOAR 6.14. - [Delete a Host](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-6-multi-tenant-guides/6.14/configure-multi-tenant/configure-the-multi-tenant-deployment/delete-a-host.md): Delete a host from a Cortex XSOAR 6.14 multi-tenant environment. - [Configure Live Backup](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-6-multi-tenant-guides/6.14/configure-multi-tenant/configure-the-multi-tenant-deployment/configure-live-backup.md): Configure Live Backup for main and host servers in Cortex XSOAR 6.14 multi-tenant deployments. - [Configure the HTTP Request Timeout](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-6-multi-tenant-guides/6.14/configure-multi-tenant/configure-the-multi-tenant-deployment/configure-the-http-request-timeout.md): Configure HTTP request timeouts for main and tenant accounts in Cortex XSOAR 6.14 multi-tenant deployments. - [Configure the Account Timeout](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-6-multi-tenant-guides/6.14/configure-multi-tenant/configure-the-multi-tenant-deployment/configure-the-account-timeout.md): Configure account timeouts when moving large tenant accounts in Cortex XSOAR 6.14. - [Forward Server Configurations to Tenant Accounts](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-6-multi-tenant-guides/6.14/configure-multi-tenant/configure-the-multi-tenant-deployment/forward-server-configurations-to-tenant-accounts.md): Forward server configurations from the main account to tenants in Cortex XSOAR 6.14 multi-tenant deployments. - [Run a Command on Multiple Tenants](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-6-multi-tenant-guides/6.14/configure-multi-tenant/configure-the-multi-tenant-deployment/run-a-command-on-multiple-tenants.md): Run commands on incidents across multiple tenants in Cortex XSOAR 6.14 multi-tenant deployments. - [Move a Tenant to a Different Host](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-6-multi-tenant-guides/6.14/configure-multi-tenant/configure-the-multi-tenant-deployment/move-a-tenant-to-a-different-host.md): Back up and move a tenant to another host in a Cortex XSOAR 6.14 multi-tenant deployment. - [Stop and Start a Tenant](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-6-multi-tenant-guides/6.14/configure-multi-tenant/configure-the-multi-tenant-deployment/stop-and-start-a-tenant.md): Start, stop, or reindex tenant accounts through the UI or API in Cortex XSOAR 6.14. - [Block and Unblock a Tenant](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-6-multi-tenant-guides/6.14/configure-multi-tenant/configure-the-multi-tenant-deployment/block-and-unblock-a-tenant.md): Block or unblock tenant accounts at the proxy level in Cortex XSOAR 6.14 multi-tenant deployments. - [Reindex a Tenant Database](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-6-multi-tenant-guides/6.14/configure-multi-tenant/configure-the-multi-tenant-deployment/reindex-a-tenant-database.md): Reindex a tenant database in a Cortex XSOAR 6.14 multi-tenant environment. - [Back Up a Tenant](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-6-multi-tenant-guides/6.14/configure-multi-tenant/configure-the-multi-tenant-deployment/back-up-a-tenant.md): Create manual or automatic backups of tenant databases in Cortex XSOAR 6.14 multi-tenant deployments. - [Reindex a Specific Index for a Tenant](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-6-multi-tenant-guides/6.14/configure-multi-tenant/configure-the-multi-tenant-deployment/reindex-a-specific-index-for-a-tenant.md): Reindex one or more indexes for an individual tenant in Cortex XSOAR 6.14 multi-tenant deployments. - [Restore a Tenant Database](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-6-multi-tenant-guides/6.14/configure-multi-tenant/configure-the-multi-tenant-deployment/restore-a-tenant-database.md): Restore a tenant database from a manual or automated backup in Cortex XSOAR 6.14. - [Restore a Partition for a Tenant](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-6-multi-tenant-guides/6.14/configure-multi-tenant/configure-the-multi-tenant-deployment/restore-a-partition-for-a-tenant.md): Restore a partition for a specific tenant in a Cortex XSOAR 6.14 multi-tenant environment. - [Index War Room Entries in a Multi-Tenant Deployment](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-6-multi-tenant-guides/6.14/configure-multi-tenant/configure-the-multi-tenant-deployment/index-war-room-entries-in-a-multi-tenant-deployment.md): Index War Room entries and reindex incidents for tenant searches in Cortex XSOAR 6.14. - [Install Engines on Tenants in a Multi-Tenant Deployment](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-6-multi-tenant-guides/6.14/configure-multi-tenant/configure-the-multi-tenant-deployment/install-engines-on-tenants-in-a-multi-tenant-deployment.md): Install tenant engines and configure firewall access in Cortex XSOAR 6.14 multi-tenant deployments. - [Configure User Settings](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-6-multi-tenant-guides/6.14/configure-multi-tenant/configure-user-settings.md): Cortex XSOAR 6.14 users can control details, preferences, and notifications, by changing the notifications settings in their user profile. - [Manage Content](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-6-multi-tenant-guides/6.14/configure-multi-tenant/manage-content.md): Manage propagation labels and sync tenant content in Cortex XSOAR 6.14 multi-tenant deployments. - [Manage Content Overview](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-6-multi-tenant-guides/6.14/configure-multi-tenant/manage-content/manage-content-overview.md): Understand propagation labels and content synchronization in Cortex XSOAR 6.14 multi-tenant deployments. - [Add Propagation Labels to an Existing Tenant Account](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-6-multi-tenant-guides/6.14/configure-multi-tenant/manage-content/add-propagation-labels-to-an-existing-tenant-account.md): Add propagation labels to tenant accounts to control content synchronization in Cortex XSOAR 6.14. - [Add Propagation Labels to Content](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-6-multi-tenant-guides/6.14/configure-multi-tenant/manage-content/add-propagation-labels-to-content.md): Apply propagation labels to control content synchronized to tenant accounts in Cortex XSOAR 6.14. - [Add Propagation Labels in Remote Repositories](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-6-multi-tenant-guides/6.14/configure-multi-tenant/manage-content/add-propagation-labels-in-remote-repositories.md): Add propagation labels through remote repositories in Cortex XSOAR 6.14 multi-tenant deployments. - [Content Dependencies and Propagation](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-6-multi-tenant-guides/6.14/configure-multi-tenant/manage-content/content-dependencies-and-propagation.md): Understand how content dependencies propagate to tenants in Cortex XSOAR 6.14 multi-tenant deployments. - [Sync Content to Tenant Accounts](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-6-multi-tenant-guides/6.14/configure-multi-tenant/manage-content/sync-content-to-tenant-accounts.md): Synchronize content with individual or all tenant accounts in Cortex XSOAR 6.14 multi-tenant deployments. - [Troubleshoot Errors When Syncing All Accounts](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-6-multi-tenant-guides/6.14/configure-multi-tenant/manage-content/sync-content-to-tenant-accounts/troubleshoot-errors-when-syncing-all-accounts.md): Troubleshoot all-account sync errors in large Cortex XSOAR 6.14 multi-tenant environments. - [Disable Propagation Labels](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-6-multi-tenant-guides/6.14/configure-multi-tenant/manage-content/disable-propagation-labels.md): Disable propagation labels and automatically synchronize tenant content in Cortex XSOAR 6.14. - [Restrict Actions for Custom Locked Content Items](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-6-multi-tenant-guides/6.14/configure-multi-tenant/manage-content/restrict-actions-for-custom-locked-content-items.md): Restrict tenant actions for custom locked content items in Cortex XSOAR 6.14 multi-tenant deployments. - [Share Indicators](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-6-multi-tenant-guides/6.14/configure-multi-tenant/share-indicators.md): Share threat indicators between tenant accounts in Cortex XSOAR 6.14 multi-tenant deployments. - [Share Indicators Overview](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-6-multi-tenant-guides/6.14/configure-multi-tenant/share-indicators/share-indicators-overview.md): Share tenant indicators through shared Elasticsearch indexes in Cortex XSOAR 6.14 multi-tenant deployments. - [Manually Share Indicators](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-6-multi-tenant-guides/6.14/configure-multi-tenant/share-indicators/manually-share-indicators.md): Manually share tenant indicators with a dedicated Elasticsearch index in Cortex XSOAR 6.14. - [Export Indicators to the Shared Index](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-6-multi-tenant-guides/6.14/configure-multi-tenant/share-indicators/export-indicators-to-the-shared-index.md): Configure tenant indicator exports to a shared index in Cortex XSOAR 6.14 multi-tenant deployments. - [Ingest Indicators from the Shared Indicators Index](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-6-multi-tenant-guides/6.14/configure-multi-tenant/share-indicators/ingest-indicators-from-the-shared-indicators-index.md): Configure tenants to ingest shared indicators with Elasticsearch Feed in Cortex XSOAR 6.14. - [Remote Repositories for Multi-Tenant Deployments](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-6-multi-tenant-guides/6.14/configure-multi-tenant/remote-repositories-for-multi-tenant-deployments.md): Configure remote repositories for Cortex XSOAR 6.14 multi-tenant deployments. - [Remote Repositories Overview](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-6-multi-tenant-guides/6.14/configure-multi-tenant/remote-repositories-for-multi-tenant-deployments/remote-repositories-overview.md): Develop, test, and synchronize tenant content with remote repositories in Cortex XSOAR 6.14. - [Configure a Remote Repository on a Development Machine](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-6-multi-tenant-guides/6.14/configure-multi-tenant/remote-repositories-for-multi-tenant-deployments/configure-a-remote-repository-on-a-development-machine.md): Configure a development-machine remote repository for Cortex XSOAR 6.14 multi-tenant content. - [Configure a Remote Repository on the Main Account](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-6-multi-tenant-guides/6.14/configure-multi-tenant/remote-repositories-for-multi-tenant-deployments/configure-a-remote-repository-on-the-main-account.md): Configure a main-account remote repository for Cortex XSOAR 6.14 multi-tenant deployments. - [Edit and Push Content to a Remote Repository](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-6-multi-tenant-guides/6.14/configure-multi-tenant/remote-repositories-for-multi-tenant-deployments/edit-and-push-content-to-a-remote-repository.md): Edit and push content to remote repositories in Cortex XSOAR 6.14 multi-tenant deployments. - [Troubleshoot a Remote Repository Configuration](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-6-multi-tenant-guides/6.14/configure-multi-tenant/remote-repositories-for-multi-tenant-deployments/troubleshoot-a-remote-repository-configuration.md): Troubleshoot remote repository configuration issues in Cortex XSOAR 6.14 multi-tenant deployments. - [Troubleshoot a Remote Repository Definition](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-6-multi-tenant-guides/6.14/configure-multi-tenant/remote-repositories-for-multi-tenant-deployments/troubleshoot-a-remote-repository-configuration/troubleshoot-a-remote-repository-definition.md): Resolve remote repository definition errors in Cortex XSOAR 6.14 multi-tenant deployments. - [Troubleshoot Editing and Pushing Content](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-6-multi-tenant-guides/6.14/configure-multi-tenant/remote-repositories-for-multi-tenant-deployments/troubleshoot-a-remote-repository-configuration/troubleshoot-editing-and-pushing-content.md): Troubleshoot editing and pushing content to remote repositories in Cortex XSOAR 6.14. - [Troubleshoot Content Issues](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-6-multi-tenant-guides/6.14/configure-multi-tenant/remote-repositories-for-multi-tenant-deployments/troubleshoot-a-remote-repository-configuration/troubleshoot-content-issues.md): Troubleshoot remote repository content issues and restore missing content in Cortex XSOAR 6.14. * [Navigate the Multi-Tenant Guide](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-6-multi-tenant-guides/6.13/learn-about-multi-tenant/readme.md): Start here for a visual overview of Cortex XSOAR 6.13 Multi-Tenant documentation areas. * [Multi-Tenant Deployments](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-6-multi-tenant-guides/6.13/learn-about-multi-tenant/readme-1.md): Overview of Cortex XSOAR 6.13 multi-tenant deployments for MSSPs and enterprises. * [Multi-Tenant Overview](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-6-multi-tenant-guides/6.13/learn-about-multi-tenant/readme-1/multi-tenant-overview.md): Cortex XSOAR 6.13 multi-tenant deployments for MSSPs and enterprises requiring tenant data segregation. * [Multi-Tenant High Availability Overview](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-6-multi-tenant-guides/6.13/learn-about-multi-tenant/readme-1/multi-tenant-high-availability-overview.md): In Cortex XSOAR 6.13, understand high availability for a multi-tenant deployment. * [Plan Your Multi-Tenant Deployment](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-6-multi-tenant-guides/6.13/onboard-multi-tenant/plan-your-multi-tenant-deployment.md): Plan Cortex XSOAR 6.13 multi-tenant deployments with sizing and security guidance. * [Multi-Tenant Sizing Requirements](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-6-multi-tenant-guides/6.13/onboard-multi-tenant/plan-your-multi-tenant-deployment/multi-tenant-sizing-requirements.md): In Cortex XSOAR 6.13, size multi-tenant deployments by hosts and tenants. * [Configure Security Settings for Multi-Tenant Deployments](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-6-multi-tenant-guides/6.13/onboard-multi-tenant/plan-your-multi-tenant-deployment/configure-security-settings-for-multi-tenant-deployments.md): In Cortex XSOAR 6.13, configure security settings for multi-tenant deployments. * [SAML for Multi-Tenant Deployments](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-6-multi-tenant-guides/6.13/onboard-multi-tenant/plan-your-multi-tenant-deployment/saml-for-multi-tenant-deployments.md): In Cortex XSOAR 6.13, authenticate multi-tenant users with SAML 2.0. * [Communication in a Multi-Tenant Deployment](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-6-multi-tenant-guides/6.13/onboard-multi-tenant/plan-your-multi-tenant-deployment/communication-in-a-multi-tenant-deployment.md): In Cortex XSOAR 6.13, review ports for multi-tenant deployment communication. * [Change the Port for Host to Main Communication](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-6-multi-tenant-guides/6.13/onboard-multi-tenant/plan-your-multi-tenant-deployment/change-the-port-for-host-to-main-communication.md): In Cortex XSOAR 6.13, set a custom host-to-main port for multi-tenant communication. * [Multi-Tenant Deployment Installation](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-6-multi-tenant-guides/6.13/onboard-multi-tenant/multi-tenant-deployment-installation.md): Install or upgrade Cortex XSOAR 6.13 multi-tenant deployments with BoltDB or Elasticsearch. * [Install Cortex XSOAR for a Multi-Tenant Deployment](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-6-multi-tenant-guides/6.13/onboard-multi-tenant/multi-tenant-deployment-installation/install-cortex-xsoar-for-a-multi-tenant-deployment.md): Install Cortex XSOAR 6.13 for a multi-tenant deployment using the BoltDB database. * [Installer Flags](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-6-multi-tenant-guides/6.13/onboard-multi-tenant/multi-tenant-deployment-installation/install-cortex-xsoar-for-a-multi-tenant-deployment/installer-flags.md): In Cortex XSOAR 6.13, review supported installer flags for multi-tenant deployments. * [Install Cortex XSOAR for a Multi-Tenant Deployment with Elasticsearch](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-6-multi-tenant-guides/6.13/onboard-multi-tenant/multi-tenant-deployment-installation/install-cortex-xsoar-for-a-multi-tenant-deployment-with-elasticsearch.md): Install Cortex XSOAR 6.13 for a multi-tenant deployment with an Elasticsearch database. * [Upgrade Your Multi-Tenant Deployment](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-6-multi-tenant-guides/6.13/onboard-multi-tenant/multi-tenant-deployment-installation/upgrade-your-multi-tenant-deployment.md): Prepare, upgrade, and validate a Cortex XSOAR 6.13 multi-tenant deployment. * [Get the Host Installer Manually](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-6-multi-tenant-guides/6.13/onboard-multi-tenant/multi-tenant-deployment-installation/get-the-host-installer-manually.md): In Cortex XSOAR 6.13, manually retrieve and run the multi-tenant host installer. * [Configure the Multi-Tenant Deployment](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-6-multi-tenant-guides/6.13/configure-multi-tenant/configure-the-multi-tenant-deployment.md): In Cortex XSOAR 6.13, configure multi-tenant hosts, tenants, backups, and engines. * [Main Account to Tenant Communication Encryption](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-6-multi-tenant-guides/6.13/configure-multi-tenant/configure-the-multi-tenant-deployment/main-account-to-tenant-communication-encryption.md): In Cortex XSOAR 6.13, configure encryption and API keys for tenant communication. * [Add a Host](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-6-multi-tenant-guides/6.13/configure-multi-tenant/configure-the-multi-tenant-deployment/add-a-host.md): In Cortex XSOAR 6.13, add hosts and scale multi-tenant deployments. * [Add a Tenant to a Host](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-6-multi-tenant-guides/6.13/configure-multi-tenant/configure-the-multi-tenant-deployment/add-a-tenant-to-a-host.md): In Cortex XSOAR 6.13, add tenants to hosts and assign user roles. * [Delete a Tenant From a Host](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-6-multi-tenant-guides/6.13/configure-multi-tenant/configure-the-multi-tenant-deployment/delete-a-tenant-from-a-host.md): In Cortex XSOAR 6.13, delete a tenant from a multi-tenant host. * [Delete a Host](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-6-multi-tenant-guides/6.13/configure-multi-tenant/configure-the-multi-tenant-deployment/delete-a-host.md): In Cortex XSOAR 6.13, delete a host from a multi-tenant environment. * [Configure Live Backup](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-6-multi-tenant-guides/6.13/configure-multi-tenant/configure-the-multi-tenant-deployment/configure-live-backup.md): In Cortex XSOAR 6.13, configure Live Backup for multi-tenant main and host servers. * [Configure the HTTP Request Timeout](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-6-multi-tenant-guides/6.13/configure-multi-tenant/configure-the-multi-tenant-deployment/configure-the-http-request-timeout.md): In Cortex XSOAR 6.13, configure HTTP timeouts for multi-tenant accounts. * [Configure the Account Timeout](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-6-multi-tenant-guides/6.13/configure-multi-tenant/configure-the-multi-tenant-deployment/configure-the-account-timeout.md): In Cortex XSOAR 6.13, configure timeouts when moving large tenant accounts. * [Forward Server Configurations to Tenant Accounts](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-6-multi-tenant-guides/6.13/configure-multi-tenant/configure-the-multi-tenant-deployment/forward-server-configurations-to-tenant-accounts.md): In Cortex XSOAR 6.13, forward server configurations to multi-tenant accounts. * [Run a Command on Multiple Tenants](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-6-multi-tenant-guides/6.13/configure-multi-tenant/configure-the-multi-tenant-deployment/run-a-command-on-multiple-tenants.md): In Cortex XSOAR 6.13, run commands on incidents across multiple tenants. * [Move a Tenant to a Different Host](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-6-multi-tenant-guides/6.13/configure-multi-tenant/configure-the-multi-tenant-deployment/move-a-tenant-to-a-different-host.md): Move a tenant to a different host in a Cortex XSOAR multi-tenant deployment. Backup the tenant first. * [Stop and Start a Tenant](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-6-multi-tenant-guides/6.13/configure-multi-tenant/configure-the-multi-tenant-deployment/stop-and-start-a-tenant.md): Stop and start a tenant in a Cortex XSOAR multi-tenant deployment, through the API or the UI. Reindex a tenant. * [Block and Unblock a Tenant](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-6-multi-tenant-guides/6.13/configure-multi-tenant/configure-the-multi-tenant-deployment/block-and-unblock-a-tenant.md): Block or unblock a tenant (account) at the proxy level for Cortex XSOAR multi-tenant deployment. Troubleshoot tenant performance issues. * [Reindex a Tenant Database](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-6-multi-tenant-guides/6.13/configure-multi-tenant/configure-the-multi-tenant-deployment/reindex-a-tenant-database.md): Reindex a tenant database in the Cortex XSOAR multi-tenant environment. * [Back Up a Tenant](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-6-multi-tenant-guides/6.13/configure-multi-tenant/configure-the-multi-tenant-deployment/back-up-a-tenant.md): Create a backup of a tenant account for a Cortex XSOAR multi-tenant deployment. Perform manual and automatic backups of the database. * [Reindex a Specific Index for a Tenant](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-6-multi-tenant-guides/6.13/configure-multi-tenant/configure-the-multi-tenant-deployment/reindex-a-specific-index-for-a-tenant.md): Reindex one or more indexes for an individual tenant in a multi-tenant deployment. * [Restore a Tenant Database](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-6-multi-tenant-guides/6.13/configure-multi-tenant/configure-the-multi-tenant-deployment/restore-a-tenant-database.md): Restore a tenant database from a manual backup or automated backup back up in Cortex XSOAR. * [Restore a Partition for a Tenant](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-6-multi-tenant-guides/6.13/configure-multi-tenant/configure-the-multi-tenant-deployment/restore-a-partition-for-a-tenant.md): Restore a partition for a specific tenant in a multi tenant environment * [Index War Room Entries in a Multi-Tenant Deployment](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-6-multi-tenant-guides/6.13/configure-multi-tenant/configure-the-multi-tenant-deployment/index-war-room-entries-in-a-multi-tenant-deployment.md): Index Cortex XSOAR War Room entries to ensure that you can search for them in the Search Incidents. Re-index incidents for selected months. * [Install Engines on Tenants in a Multi-Tenant Deployment](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-6-multi-tenant-guides/6.13/configure-multi-tenant/configure-the-multi-tenant-deployment/install-engines-on-tenants-in-a-multi-tenant-deployment.md): Install engines on tenants in a Cortex XSOAR multi-tenant deployment. Configure firewall to allow communication between engine and server. * [Configure User Settings](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-6-multi-tenant-guides/6.13/configure-multi-tenant/configure-user-settings.md): Cortex XSOAR 6.13 users can control details, preferences, and notifications, by changing the notifications settings in their user profile. * [Manage Content](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-6-multi-tenant-guides/6.13/configure-multi-tenant/manage-content.md): In Cortex XSOAR 6.13, manage propagation labels and sync multi-tenant content. * [Manage Content Overview](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-6-multi-tenant-guides/6.13/configure-multi-tenant/manage-content/manage-content-overview.md): In Cortex XSOAR 6.13, use propagation labels to push content to tenant accounts. * [Add Propagation Labels to an Existing Tenant Account](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-6-multi-tenant-guides/6.13/configure-multi-tenant/manage-content/add-propagation-labels-to-an-existing-tenant-account.md): In Cortex XSOAR 6.13, add propagation labels to control tenant content syncing. * [Add Propagation Labels to Content](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-6-multi-tenant-guides/6.13/configure-multi-tenant/manage-content/add-propagation-labels-to-content.md): In Cortex XSOAR 6.13, apply propagation labels to control tenant content syncing. * [Add Propagation Labels in Remote Repositories](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-6-multi-tenant-guides/6.13/configure-multi-tenant/manage-content/add-propagation-labels-in-remote-repositories.md): In Cortex XSOAR 6.13, use remote repositories to apply tenant propagation labels. * [Content Dependencies and Propagation](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-6-multi-tenant-guides/6.13/configure-multi-tenant/manage-content/content-dependencies-and-propagation.md): In Cortex XSOAR 6.13, understand content dependencies and tenant propagation. * [Sync Content to Tenant Accounts](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-6-multi-tenant-guides/6.13/configure-multi-tenant/manage-content/sync-content-to-tenant-accounts.md): In Cortex XSOAR 6.13, sync content to one or all tenant accounts. * [Troubleshoot Errors When Syncing All Accounts](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-6-multi-tenant-guides/6.13/configure-multi-tenant/manage-content/sync-content-to-tenant-accounts/troubleshoot-errors-when-syncing-all-accounts.md): In Cortex XSOAR 6.13, fix multi-tenant account sync errors at scale. * [Disable Propagation Labels](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-6-multi-tenant-guides/6.13/configure-multi-tenant/manage-content/disable-propagation-labels.md): In Cortex XSOAR 6.13, disable propagation labels and automatically sync tenant content. * [Restrict Actions for Custom Locked Content Items](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-6-multi-tenant-guides/6.13/configure-multi-tenant/manage-content/restrict-actions-for-custom-locked-content-items.md): In Cortex XSOAR 6.13, restrict tenant actions for custom locked content. * [Share Indicators](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-6-multi-tenant-guides/6.13/configure-multi-tenant/share-indicators.md): In Cortex XSOAR 6.13, share indicators between multi-tenant accounts. * [Share Indicators Overview](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-6-multi-tenant-guides/6.13/configure-multi-tenant/share-indicators/share-indicators-overview.md): In Cortex XSOAR 6.13, share tenant indicators through a shared index. * [Manually Share Indicators](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-6-multi-tenant-guides/6.13/configure-multi-tenant/share-indicators/manually-share-indicators.md): In Cortex XSOAR 6.13, manually share tenant indicators through Elasticsearch. * [Export Indicators to the Shared Index](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-6-multi-tenant-guides/6.13/configure-multi-tenant/share-indicators/export-indicators-to-the-shared-index.md): In Cortex XSOAR 6.13, export tenant indicators to the shared index. * [Ingest Indicators from the Shared Indicators Index](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-6-multi-tenant-guides/6.13/configure-multi-tenant/share-indicators/ingest-indicators-from-the-shared-indicators-index.md): In Cortex XSOAR 6.13, ingest shared indicators into multi-tenant accounts. * [Remote Repositories for Multi-Tenant Deployments](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-6-multi-tenant-guides/6.13/configure-multi-tenant/remote-repositories-for-multi-tenant-deployments.md): In Cortex XSOAR 6.13, configure remote repositories for multi-tenant deployments. * [Remote Repositories Overview](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-6-multi-tenant-guides/6.13/configure-multi-tenant/remote-repositories-for-multi-tenant-deployments/remote-repositories-overview.md): In Cortex XSOAR 6.13, use remote repositories for multi-tenant content development. * [Configure a Remote Repository on a Development Machine](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-6-multi-tenant-guides/6.13/configure-multi-tenant/remote-repositories-for-multi-tenant-deployments/configure-a-remote-repository-on-a-development-machine.md): In Cortex XSOAR 6.13, configure development-machine remote repositories and selective propagation. * [Configure a Remote Repository on the Main Account](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-6-multi-tenant-guides/6.13/configure-multi-tenant/remote-repositories-for-multi-tenant-deployments/configure-a-remote-repository-on-the-main-account.md): In Cortex XSOAR 6.13, configure main-account remote repositories for multi-tenant deployments. * [Edit and Push Content to a Remote Repository](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-6-multi-tenant-guides/6.13/configure-multi-tenant/remote-repositories-for-multi-tenant-deployments/edit-and-push-content-to-a-remote-repository.md): In Cortex XSOAR 6.13, edit and push multi-tenant content to remote repositories. * [Troubleshoot a Remote Repository Configuration](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-6-multi-tenant-guides/6.13/configure-multi-tenant/remote-repositories-for-multi-tenant-deployments/troubleshoot-a-remote-repository-configuration.md): In Cortex XSOAR 6.13, troubleshoot multi-tenant remote repository configurations. * [Troubleshoot a Remote Repository Definition](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-6-multi-tenant-guides/6.13/configure-multi-tenant/remote-repositories-for-multi-tenant-deployments/troubleshoot-a-remote-repository-configuration/troubleshoot-a-remote-repository-definition.md): In Cortex XSOAR 6.13, troubleshoot multi-tenant remote repository definitions. * [Troubleshoot Editing and Pushing Content](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-6-multi-tenant-guides/6.13/configure-multi-tenant/remote-repositories-for-multi-tenant-deployments/troubleshoot-a-remote-repository-configuration/troubleshoot-editing-and-pushing-content.md): In Cortex XSOAR 6.13, troubleshoot editing and pushing multi-tenant repository content. * [Troubleshoot Content Issues](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-6-multi-tenant-guides/6.13/configure-multi-tenant/remote-repositories-for-multi-tenant-deployments/troubleshoot-a-remote-repository-configuration/troubleshoot-content-issues.md): In Cortex XSOAR 6.13, troubleshoot remote repository content and restore backups. - [Navigate the Multi-Tenant Guide](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-6-multi-tenant-guides/6.12/learn-about-multi-tenant/readme.md): Start here for a visual overview of the Cortex XSOAR Multi-Tenant 6.12 documentation areas. - [Multi-Tenant Overview](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-6-multi-tenant-guides/6.12/learn-about-multi-tenant/multi-tenant-overview.md): Cortex XSOAR 6.12 multi-tenant deployments for Managed Security Service Providers and enterprises needing tenant data segregation. - [Multi-Tenant High Availability Overview](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-6-multi-tenant-guides/6.12/learn-about-multi-tenant/multi-tenant-high-availability-overview.md): A conceptual overview of high availability in Cortex XSOAR 6.12 multi-tenant deployments. - [Plan Your Multi-Tenant Deployment](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-6-multi-tenant-guides/6.12/onboard-multi-tenant/plan-your-multi-tenant-deployment.md): Sizing requirements and security settings in Cortex XSOAR 6.12 multi-tenant deployments. - [Multi-Tenant Sizing Requirements](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-6-multi-tenant-guides/6.12/onboard-multi-tenant/plan-your-multi-tenant-deployment/multi-tenant-sizing-requirements.md): Sizing requirements in Cortex XSOAR 6.12 multi-tenant deployments depend on deployed hosts and tenants. - [Configure Security Settings for Multi-Tenant Deployments](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-6-multi-tenant-guides/6.12/onboard-multi-tenant/plan-your-multi-tenant-deployment/configure-security-settings-for-multi-tenant-deployments.md): Add server configurations to harden Cortex XSOAR 6.12 multi-tenant deployments. - [SAML for Multi-Tenant Deployments](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-6-multi-tenant-guides/6.12/onboard-multi-tenant/plan-your-multi-tenant-deployment/saml-for-multi-tenant-deployments.md): Authenticate users with SAML 2.0 in Cortex XSOAR 6.12 multi-tenant deployments. - [Communication in a Multi-Tenant Deployment](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-6-multi-tenant-guides/6.12/onboard-multi-tenant/plan-your-multi-tenant-deployment/communication-in-a-multi-tenant-deployment.md): Ports used in Cortex XSOAR 6.12 multi-tenant deployments. - [Change the Port for Host to Main Communication](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-6-multi-tenant-guides/6.12/onboard-multi-tenant/plan-your-multi-tenant-deployment/change-the-port-for-host-to-main-communication.md): Set a custom host-to-main port in Cortex XSOAR 6.12 multi-tenant deployments. - [Multi-Tenant Deployment Installation](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-6-multi-tenant-guides/6.12/onboard-multi-tenant/multi-tenant-deployment-installation.md): Install or upgrade Cortex XSOAR 6.12 multi-tenant deployments with Bolt/Bleve or Elasticsearch. - [Install Cortex XSOAR for a Multi-Tenant Deployment](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-6-multi-tenant-guides/6.12/onboard-multi-tenant/multi-tenant-deployment-installation/install-cortex-xsoar-for-a-multi-tenant-deployment.md): Install Cortex XSOAR 6.12 for a multi-tenant deployment using Bolt/Bleve, not Elasticsearch. - [Installer Flags](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-6-multi-tenant-guides/6.12/onboard-multi-tenant/multi-tenant-deployment-installation/install-cortex-xsoar-for-a-multi-tenant-deployment/installer-flags.md): Supported installer flags in Cortex XSOAR 6.12. - [Install Cortex XSOAR for a Multi-Tenant Deployment with Elasticsearch](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-6-multi-tenant-guides/6.12/onboard-multi-tenant/multi-tenant-deployment-installation/install-cortex-xsoar-for-a-multi-tenant-deployment-with-elasticsearch.md): Install Cortex XSOAR 6.12 multi-tenant deployments with an Elasticsearch database. - [Upgrade Your Multi-Tenant Deployment](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-6-multi-tenant-guides/6.12/onboard-multi-tenant/multi-tenant-deployment-installation/upgrade-your-multi-tenant-deployment.md): Prepare, upgrade, and complete post-upgrade tasks in Cortex XSOAR 6.12 multi-tenant deployments. - [Get the Host Installer Manually](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-6-multi-tenant-guides/6.12/onboard-multi-tenant/multi-tenant-deployment-installation/get-the-host-installer-manually.md): Manually retrieve the host installer in Cortex XSOAR 6.12 when server access is unavailable. - [Configure the Multi-Tenant Deployment](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-6-multi-tenant-guides/6.12/configure-multi-tenant/configure-the-multi-tenant-deployment.md): Configure hosts, tenants, backups, and engines in Cortex XSOAR 6.12 Multi-Tenant deployments. - [Main Account to Tenant Communication Encryption](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-6-multi-tenant-guides/6.12/configure-multi-tenant/configure-the-multi-tenant-deployment/main-account-to-tenant-communication-encryption.md): Configure main-account and tenant communication in Cortex XSOAR 6.12 Multi-Tenant deployments. - [Add a Host](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-6-multi-tenant-guides/6.12/configure-multi-tenant/configure-the-multi-tenant-deployment/add-a-host.md): Add hosts and scale Cortex XSOAR 6.12 multi-tenant deployments across host servers. - [Add a Tenant to a Host](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-6-multi-tenant-guides/6.12/configure-multi-tenant/configure-the-multi-tenant-deployment/add-a-tenant-to-a-host.md): Add a tenant and assign users in Cortex XSOAR 6.12 Multi-Tenant deployments. - [Delete a Tenant From a Host](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-6-multi-tenant-guides/6.12/configure-multi-tenant/configure-the-multi-tenant-deployment/delete-a-tenant-from-a-host.md): Delete a tenant from a host in Cortex XSOAR 6.12. - [Delete a Host](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-6-multi-tenant-guides/6.12/configure-multi-tenant/configure-the-multi-tenant-deployment/delete-a-host.md): Delete a host from a Cortex XSOAR 6.12 multi-tenant environment. - [Configure Live Backup](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-6-multi-tenant-guides/6.12/configure-multi-tenant/configure-the-multi-tenant-deployment/configure-live-backup.md): Configure Live Backup in Cortex XSOAR 6.12 multi-tenant deployments. - [Configure the HTTP Request Timeout](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-6-multi-tenant-guides/6.12/configure-multi-tenant/configure-the-multi-tenant-deployment/configure-the-http-request-timeout.md): Configure HTTP timeouts in Cortex XSOAR 6.12 multi-tenant deployments. - [Configure the Account Timeout](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-6-multi-tenant-guides/6.12/configure-multi-tenant/configure-the-multi-tenant-deployment/configure-the-account-timeout.md): Configure the account timeout in Cortex XSOAR 6.12 when moving large tenants. - [Forward Server Configurations to Tenant Accounts](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-6-multi-tenant-guides/6.12/configure-multi-tenant/configure-the-multi-tenant-deployment/forward-server-configurations-to-tenant-accounts.md): Forward server configurations in Cortex XSOAR 6.12 multi-tenant deployments. - [Run a Command on Multiple Tenants](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-6-multi-tenant-guides/6.12/configure-multi-tenant/configure-the-multi-tenant-deployment/run-a-command-on-multiple-tenants.md): Run commands across tenants in Cortex XSOAR 6.12 multi-tenant deployments. - [Move a Tenant to a Different Host](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-6-multi-tenant-guides/6.12/configure-multi-tenant/configure-the-multi-tenant-deployment/move-a-tenant-to-a-different-host.md): Move tenants between hosts in Cortex XSOAR 6.12 multi-tenant deployments. - [Stop and Start a Tenant](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-6-multi-tenant-guides/6.12/configure-multi-tenant/configure-the-multi-tenant-deployment/stop-and-start-a-tenant.md): Stop, start, and reindex tenants in Cortex XSOAR 6.12 multi-tenant deployments. - [Block and Unblock a Tenant](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-6-multi-tenant-guides/6.12/configure-multi-tenant/configure-the-multi-tenant-deployment/block-and-unblock-a-tenant.md): Block or unblock tenants in Cortex XSOAR 6.12 multi-tenant deployments. - [Reindex a Tenant Database](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-6-multi-tenant-guides/6.12/configure-multi-tenant/configure-the-multi-tenant-deployment/reindex-a-tenant-database.md): Reindex tenant databases in Cortex XSOAR 6.12 multi-tenant environments. - [Back Up a Tenant](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-6-multi-tenant-guides/6.12/configure-multi-tenant/configure-the-multi-tenant-deployment/back-up-a-tenant.md): Back up tenant databases in Cortex XSOAR 6.12 multi-tenant deployments. - [Reindex a Specific Index for a Tenant](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-6-multi-tenant-guides/6.12/configure-multi-tenant/configure-the-multi-tenant-deployment/reindex-a-specific-index-for-a-tenant.md): Reindex individual tenant indexes in Cortex XSOAR 6.12 multi-tenant deployments. - [Restore a Tenant Database](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-6-multi-tenant-guides/6.12/configure-multi-tenant/configure-the-multi-tenant-deployment/restore-a-tenant-database.md): Restore tenant databases from backups in Cortex XSOAR 6.12. - [Restore a Partition for a Tenant](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-6-multi-tenant-guides/6.12/configure-multi-tenant/configure-the-multi-tenant-deployment/restore-a-partition-for-a-tenant.md): Restore a tenant partition in a Cortex XSOAR 6.12 multi-tenant environment. - [Index War Room Entries in a Multi-Tenant Deployment](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-6-multi-tenant-guides/6.12/configure-multi-tenant/configure-the-multi-tenant-deployment/index-war-room-entries-in-a-multi-tenant-deployment.md): Index War Room entries in Cortex XSOAR 6.12 multi-tenant deployments. - [Install Engines on Tenants in a Multi-Tenant Deployment](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-6-multi-tenant-guides/6.12/configure-multi-tenant/configure-the-multi-tenant-deployment/install-engines-on-tenants-in-a-multi-tenant-deployment.md): Install tenant engines in Cortex XSOAR 6.12 multi-tenant deployments. - [Configure User Settings](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-6-multi-tenant-guides/6.12/configure-multi-tenant/configure-user-settings.md): Configure user preferences and notifications in Cortex XSOAR 6.12. - [Manage Content](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-6-multi-tenant-guides/6.12/configure-multi-tenant/manage-content.md): Apply propagation labels and sync content in Cortex XSOAR 6.12 multi-tenant deployments. - [Manage Content Overview](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-6-multi-tenant-guides/6.12/configure-multi-tenant/manage-content/manage-content-overview.md): Manage content propagation in Cortex XSOAR 6.12 multi-tenant deployments. - [Add Propagation Labels to an Existing Tenant Account](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-6-multi-tenant-guides/6.12/configure-multi-tenant/manage-content/add-propagation-labels-to-an-existing-tenant-account.md): Add tenant propagation labels in Cortex XSOAR 6.12 multi-tenant deployments. - [Add Propagation Labels to Content](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-6-multi-tenant-guides/6.12/configure-multi-tenant/manage-content/add-propagation-labels-to-content.md): Apply propagation labels in Cortex XSOAR 6.12 multi-tenant deployments. - [Add Propagation Labels in Remote Repositories](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-6-multi-tenant-guides/6.12/configure-multi-tenant/manage-content/add-propagation-labels-in-remote-repositories.md): Add propagation labels through remote repositories in Cortex XSOAR 6.12. - [Content Dependencies and Propagation](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-6-multi-tenant-guides/6.12/configure-multi-tenant/manage-content/content-dependencies-and-propagation.md): Understand content dependencies and propagation in Cortex XSOAR 6.12. - [Sync Content to Tenant Accounts](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-6-multi-tenant-guides/6.12/configure-multi-tenant/manage-content/sync-content-to-tenant-accounts.md): Sync content to tenant accounts in Cortex XSOAR 6.12 multi-tenant deployments. - [Troubleshoot Errors When Syncing All Accounts](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-6-multi-tenant-guides/6.12/configure-multi-tenant/manage-content/sync-content-to-tenant-accounts/troubleshoot-errors-when-syncing-all-accounts.md): Fix content-sync errors in large Cortex XSOAR 6.12 multi-tenant environments. - [Disable Propagation Labels](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-6-multi-tenant-guides/6.12/configure-multi-tenant/manage-content/disable-propagation-labels.md): Disable propagation labels in Cortex XSOAR 6.12 multi-tenant deployments. - [Restrict Actions for Custom Locked Content Items](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-6-multi-tenant-guides/6.12/configure-multi-tenant/manage-content/restrict-actions-for-custom-locked-content-items.md): Restrict locked custom content in Cortex XSOAR 6.12 multi-tenant deployments. - [Share Indicators](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-6-multi-tenant-guides/6.12/configure-multi-tenant/share-indicators.md): Share indicators in Cortex XSOAR 6.12 multi-tenant deployments. - [Share Indicators Overview](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-6-multi-tenant-guides/6.12/configure-multi-tenant/share-indicators/share-indicators-overview.md): Share indicators between tenants in Cortex XSOAR 6.12. - [Manually Share Indicators](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-6-multi-tenant-guides/6.12/configure-multi-tenant/share-indicators/manually-share-indicators.md): Manually share tenant indicators in Cortex XSOAR 6.12. - [Export Indicators to the Shared Index](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-6-multi-tenant-guides/6.12/configure-multi-tenant/share-indicators/export-indicators-to-the-shared-index.md): Export tenant indicators to a shared index in Cortex XSOAR 6.12. - [Ingest Indicators from the Shared Indicators Index](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-6-multi-tenant-guides/6.12/configure-multi-tenant/share-indicators/ingest-indicators-from-the-shared-indicators-index.md): Ingest shared indicators in Cortex XSOAR 6.12 multi-tenant deployments. - [Remote Repositories for Multi-Tenant Deployments](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-6-multi-tenant-guides/6.12/configure-multi-tenant/remote-repositories-for-multi-tenant-deployments.md): Configure remote repositories in Cortex XSOAR 6.12 multi-tenant deployments. - [Remote Repositories Overview](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-6-multi-tenant-guides/6.12/configure-multi-tenant/remote-repositories-for-multi-tenant-deployments/remote-repositories-overview.md): Use remote repositories in Cortex XSOAR 6.12 multi-tenant deployments. - [Configure a Remote Repository on a Development Machine](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-6-multi-tenant-guides/6.12/configure-multi-tenant/remote-repositories-for-multi-tenant-deployments/configure-a-remote-repository-on-a-development-machine.md): Configure development remote repositories in Cortex XSOAR 6.12. - [Configure a Remote Repository on the Main Account](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-6-multi-tenant-guides/6.12/configure-multi-tenant/remote-repositories-for-multi-tenant-deployments/configure-a-remote-repository-on-the-main-account.md): Configure main-account remote repositories in Cortex XSOAR 6.12. - [Edit and Push Content to a Remote Repository](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-6-multi-tenant-guides/6.12/configure-multi-tenant/remote-repositories-for-multi-tenant-deployments/edit-and-push-content-to-a-remote-repository.md): Push content to remote repositories in Cortex XSOAR 6.12. - [Troubleshoot a Remote Repository Configuration](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-6-multi-tenant-guides/6.12/configure-multi-tenant/remote-repositories-for-multi-tenant-deployments/troubleshoot-a-remote-repository-configuration.md): Troubleshoot remote repository configurations in Cortex XSOAR 6.12. - [Troubleshoot a Remote Repository Definition](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-6-multi-tenant-guides/6.12/configure-multi-tenant/remote-repositories-for-multi-tenant-deployments/troubleshoot-a-remote-repository-configuration/troubleshoot-a-remote-repository-definition.md): Troubleshoot remote repository definitions in Cortex XSOAR 6.12. - [Troubleshoot Editing and Pushing Content](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-6-multi-tenant-guides/6.12/configure-multi-tenant/remote-repositories-for-multi-tenant-deployments/troubleshoot-a-remote-repository-configuration/troubleshoot-editing-and-pushing-content.md): Troubleshoot remote-content updates in Cortex XSOAR 6.12. - [Troubleshoot Content Issues](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-6-multi-tenant-guides/6.12/configure-multi-tenant/remote-repositories-for-multi-tenant-deployments/troubleshoot-a-remote-repository-configuration/troubleshoot-content-issues.md): Troubleshoot remote repository content in Cortex XSOAR 6.12. ## Cortex XSOAR 6 Installation Guides - [Cortex XSOAR Installation Guides](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-6-installation-guides/cortex-xsoar-installation-guides.md): Start here to choose the right Cortex XSOAR 6 version. * [Overview](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-6-installation-guides/6.15/cortex-xsoar-installation-guide/readme.md): Cortex XSOAR 6.15 installation for single server and multi-tenant deployments. * [Installation Overview](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-6-installation-guides/6.15/cortex-xsoar-installation-guide/readme/installation-overview.md): Cortex XSOAR 6.15 installation overview for single server, multi-tenant, BoltDB, Elasticsearch, and high availability. * [Single Server Installation Overview](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-6-installation-guides/6.15/cortex-xsoar-installation-guide/readme/single-server-installation-overview.md): Cortex XSOAR 6.15 single server deployment overview with Bolt, Elasticsearch, and high availability. * [Multi-Tenant Installation Overview](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-6-installation-guides/6.15/cortex-xsoar-installation-guide/readme/multi-tenant-installation-overview.md): Cortex XSOAR 6.15 multi-tenant installation overview with Bolt, Elasticsearch, and high availability. * [System Requirements](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-6-installation-guides/6.15/cortex-xsoar-installation-guide/system-requirements.md): Cortex XSOAR 6.15 system requirements for installation. * [Cortex XSOAR System Requirements](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-6-installation-guides/6.15/cortex-xsoar-installation-guide/system-requirements/cortex-xsoar-system-requirements.md): Cortex XSOAR 6.15 system requirements for operating systems, hardware, Docker, and Podman. * [Multi-Tenant System Requirements](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-6-installation-guides/6.15/cortex-xsoar-installation-guide/system-requirements/multi-tenant-system-requirements.md): Cortex XSOAR 6.15 multi-tenant server requirements and sizing examples. * [Elasticsearch System Requirements](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-6-installation-guides/6.15/cortex-xsoar-installation-guide/system-requirements/elasticsearch-system-requirements.md): Cortex XSOAR 6.15 Elasticsearch requirements and sizing guidance. * [Supported Web Browsers](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-6-installation-guides/6.15/cortex-xsoar-installation-guide/system-requirements/supported-web-browsers.md): Supported web browsers for Cortex XSOAR 6.15. * [Cloud Deployment Specifications](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-6-installation-guides/6.15/cortex-xsoar-installation-guide/system-requirements/cloud-deployment-specifications.md): Cortex XSOAR 6.15 deployment guidance for AWS EC2, Azure virtual machines, and GCP Compute Engine. * [AWS EC2 Deployment Guidelines](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-6-installation-guides/6.15/cortex-xsoar-installation-guide/system-requirements/cloud-deployment-specifications/aws-ec2-deployment-guidelines.md): Cortex XSOAR 6.15 AWS EC2 deployment requirements, sizing, and best practices. * [Azure Virtual Machines Deployment Guidelines](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-6-installation-guides/6.15/cortex-xsoar-installation-guide/system-requirements/cloud-deployment-specifications/azure-virtual-machines-deployment-guidelines.md): Cortex XSOAR 6.15 Azure VM deployment requirements, sizing, and best practices. * [GCP Compute Engine Deployment Guidelines](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-6-installation-guides/6.15/cortex-xsoar-installation-guide/system-requirements/cloud-deployment-specifications/gcp-compute-engine-deployment-guidelines.md): Cortex XSOAR 6.15 GCP Compute Engine deployment requirements, sizing, and best practices. * [Single Server Installation](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-6-installation-guides/6.15/cortex-xsoar-installation-guide/single-server-installation.md): Cortex XSOAR 6.15 single server installation guides. * [Install Cortex XSOAR with Bolt Database](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-6-installation-guides/6.15/cortex-xsoar-installation-guide/single-server-installation/install-cortex-xsoar-with-bolt-database.md): Install Cortex XSOAR 6.15 on a single server with the Bolt database. * [Installer Flags](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-6-installation-guides/6.15/cortex-xsoar-installation-guide/single-server-installation/install-cortex-xsoar-with-bolt-database/installer-flags.md): Supported installer flags for Cortex XSOAR 6.15 installation. * [Install Cortex XSOAR with Elasticsearch](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-6-installation-guides/6.15/cortex-xsoar-installation-guide/single-server-installation/install-cortex-xsoar-with-elasticsearch.md): Install Cortex XSOAR 6.15 with Elasticsearch. * [Elasticsearch Configurations](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-6-installation-guides/6.15/cortex-xsoar-installation-guide/single-server-installation/install-cortex-xsoar-with-elasticsearch/elasticsearch-configurations.md): Supported Elasticsearch configurations for Cortex XSOAR 6.15. * [Elasticsearch General Security Guidelines](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-6-installation-guides/6.15/cortex-xsoar-installation-guide/single-server-installation/install-cortex-xsoar-with-elasticsearch/elasticsearch-general-security-guidelines.md): Elasticsearch security guidance for Cortex XSOAR 6.15 single-server deployments. * [Elasticsearch Installation](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-6-installation-guides/6.15/cortex-xsoar-installation-guide/single-server-installation/install-cortex-xsoar-with-elasticsearch/elasticsearch-installation.md): Install Cortex XSOAR 6.15 on a single server with Elasticsearch. * [Elasticsearch Best Practices](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-6-installation-guides/6.15/cortex-xsoar-installation-guide/single-server-installation/install-cortex-xsoar-with-elasticsearch/elasticsearch-best-practices.md): Elasticsearch configuration best practices for Cortex XSOAR 6.15. * [Install Cortex XSOAR Offline](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-6-installation-guides/6.15/cortex-xsoar-installation-guide/single-server-installation/install-cortex-xsoar-offline.md): Install Cortex XSOAR 6.15 without internet access. * [Dependencies for Offline Installation](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-6-installation-guides/6.15/cortex-xsoar-installation-guide/single-server-installation/install-cortex-xsoar-offline/dependencies-for-offline-installation.md): Offline installation dependencies for Cortex XSOAR 6.15 on supported Linux operating systems. * [Uninstall the Server](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-6-installation-guides/6.15/cortex-xsoar-installation-guide/single-server-installation/uninstall-the-server.md): Uninstall Cortex XSOAR 6.15 and retain configuration and engine-created files. * [Multi-Tenant Installation](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-6-installation-guides/6.15/cortex-xsoar-installation-guide/multi-tenant-installation.md): Cortex XSOAR 6.15 multi-tenant installation planning and guidance. * [Install Multi-Tenant with Bolt Database](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-6-installation-guides/6.15/cortex-xsoar-installation-guide/multi-tenant-installation/install-multi-tenant-with-bolt-database.md): Install Cortex XSOAR 6.15 for multi-tenant deployments with the Bolt database. * [Installer Flags](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-6-installation-guides/6.15/cortex-xsoar-installation-guide/multi-tenant-installation/install-multi-tenant-with-bolt-database/installer-flags.md): Supported installer flags for Cortex XSOAR 6.15 multi-tenant installation. * [Install Multi-Tenant with Elasticsearch](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-6-installation-guides/6.15/cortex-xsoar-installation-guide/multi-tenant-installation/install-multi-tenant-with-elasticsearch.md): Install Cortex XSOAR 6.15 for multi-tenant deployments with Elasticsearch. * [Post Installation Checklist](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-6-installation-guides/6.15/cortex-xsoar-installation-guide/post-installation-checklist.md): Cortex XSOAR 6.15 post-installation checklist for validating and monitoring components. * [Add a License](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-6-installation-guides/6.15/cortex-xsoar-installation-guide/post-installation-checklist/add-a-license.md): Add a Cortex XSOAR 6.15 license through the UI or directly on the server. * [Server Post-Installation Health Check](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-6-installation-guides/6.15/cortex-xsoar-installation-guide/post-installation-checklist/server-post-installation-health-check.md): Run Cortex XSOAR 6.15 post-installation health checks for Docker, integrations, reporting, and content. * [Monitor Cortex XSOAR Components](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-6-installation-guides/6.15/cortex-xsoar-installation-guide/post-installation-checklist/monitor-cortex-xsoar-components.md): Monitor Cortex XSOAR 6.15 system components and health. * [Upgrade Your Installation](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-6-installation-guides/6.15/cortex-xsoar-installation-guide/upgrade-your-installation.md): Upgrade Cortex XSOAR 6.15 single server, multi-tenant, and live backup deployments. * [Upgrade the Cortex XSOAR Server](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-6-installation-guides/6.15/cortex-xsoar-installation-guide/upgrade-your-installation/upgrade-the-cortex-xsoar-server.md): Upgrade your Cortex XSOAR server to version 6.14. * [Upgrade Your Multi-Tenant Deployment](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-6-installation-guides/6.15/cortex-xsoar-installation-guide/upgrade-your-installation/upgrade-your-multi-tenant-deployment.md): Upgrade a Cortex XSOAR 6.15 multi-tenant deployment, including preparation and post-upgrade steps. * [Upgrade the Live Backup Environment](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-6-installation-guides/6.15/cortex-xsoar-installation-guide/upgrade-your-installation/upgrade-the-live-backup-environment.md): Upgrade the Cortex XSOAR 6.15 live backup environment. - [Overview](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-6-installation-guides/6.14/cortex-xsoar-installation-guide/readme.md): Cortex XSOAR 6.14 installation for single server and multi-tenant deployments. - [Installation Overview](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-6-installation-guides/6.14/cortex-xsoar-installation-guide/readme/installation-overview.md): Cortex XSOAR 6.14 installation overview for single server, multi-tenant, BoltDB, Elasticsearch, and high availability. - [Single Server Installation Overview](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-6-installation-guides/6.14/cortex-xsoar-installation-guide/readme/single-server-installation-overview.md): Cortex XSOAR 6.14 single server deployment overview with Bolt, Elasticsearch, and high availability. - [Multi-Tenant Installation Overview](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-6-installation-guides/6.14/cortex-xsoar-installation-guide/readme/multi-tenant-installation-overview.md): Cortex XSOAR 6.14 multi-tenant installation overview with Bolt, Elasticsearch, and high availability. - [System Requirements](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-6-installation-guides/6.14/cortex-xsoar-installation-guide/system-requirements.md): Cortex XSOAR 6.14 system requirements for installation. - [Cortex XSOAR System Requirements](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-6-installation-guides/6.14/cortex-xsoar-installation-guide/system-requirements/cortex-xsoar-system-requirements.md): Cortex XSOAR 6.14 system requirements for operating systems, hardware, Docker, and Podman. - [Multi-Tenant System Requirements](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-6-installation-guides/6.14/cortex-xsoar-installation-guide/system-requirements/multi-tenant-system-requirements.md): Cortex XSOAR 6.14 multi-tenant server requirements and sizing examples. - [Elasticsearch System Requirements](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-6-installation-guides/6.14/cortex-xsoar-installation-guide/system-requirements/elasticsearch-system-requirements.md): Cortex XSOAR 6.14 Elasticsearch requirements and sizing guidance. - [Supported Web Browsers](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-6-installation-guides/6.14/cortex-xsoar-installation-guide/system-requirements/supported-web-browsers.md): Supported web browsers for Cortex XSOAR 6.14. - [Cloud Deployment Specifications](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-6-installation-guides/6.14/cortex-xsoar-installation-guide/system-requirements/cloud-deployment-specifications.md): Cortex XSOAR 6.14 deployment guidance for AWS EC2, Azure virtual machines, and GCP Compute Engine. - [AWS EC2 Deployment Guidelines](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-6-installation-guides/6.14/cortex-xsoar-installation-guide/system-requirements/cloud-deployment-specifications/aws-ec2-deployment-guidelines.md): Cortex XSOAR 6.14 AWS EC2 deployment requirements, sizing, and best practices. - [Azure Virtual Machines Deployment Guidelines](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-6-installation-guides/6.14/cortex-xsoar-installation-guide/system-requirements/cloud-deployment-specifications/azure-virtual-machines-deployment-guidelines.md): Cortex XSOAR 6.14 Azure VM deployment requirements, sizing, and best practices. - [GCP Compute Engine Deployment Guidelines](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-6-installation-guides/6.14/cortex-xsoar-installation-guide/system-requirements/cloud-deployment-specifications/gcp-compute-engine-deployment-guidelines.md): Cortex XSOAR 6.14 GCP Compute Engine deployment requirements, sizing, and best practices. - [Single Server Installation](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-6-installation-guides/6.14/cortex-xsoar-installation-guide/single-server-installation.md): Cortex XSOAR 6.14 single server installation guides. - [Install Cortex XSOAR with Bolt Database](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-6-installation-guides/6.14/cortex-xsoar-installation-guide/single-server-installation/install-cortex-xsoar-with-bolt-database.md): Install Cortex XSOAR 6.14 on a single server with the Bolt database. - [Installer Flags](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-6-installation-guides/6.14/cortex-xsoar-installation-guide/single-server-installation/install-cortex-xsoar-with-bolt-database/installer-flags.md): Supported installer flags for Cortex XSOAR 6.14 installation. - [Install Cortex XSOAR with Elasticsearch](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-6-installation-guides/6.14/cortex-xsoar-installation-guide/single-server-installation/install-cortex-xsoar-with-elasticsearch.md): Install Cortex XSOAR 6.14 with Elasticsearch. - [Elasticsearch Configurations](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-6-installation-guides/6.14/cortex-xsoar-installation-guide/single-server-installation/install-cortex-xsoar-with-elasticsearch/elasticsearch-configurations.md): Supported Elasticsearch configurations for Cortex XSOAR 6.14. - [Elasticsearch General Security Guidelines](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-6-installation-guides/6.14/cortex-xsoar-installation-guide/single-server-installation/install-cortex-xsoar-with-elasticsearch/elasticsearch-general-security-guidelines.md): Elasticsearch security guidance for Cortex XSOAR 6.14 single-server deployments. - [Elasticsearch Installation](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-6-installation-guides/6.14/cortex-xsoar-installation-guide/single-server-installation/install-cortex-xsoar-with-elasticsearch/elasticsearch-installation.md): Install Cortex XSOAR 6.14 on a single server with Elasticsearch. - [Elasticsearch Best Practices](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-6-installation-guides/6.14/cortex-xsoar-installation-guide/single-server-installation/install-cortex-xsoar-with-elasticsearch/elasticsearch-best-practices.md): Elasticsearch configuration best practices for Cortex XSOAR 6.14. - [Install Cortex XSOAR Offline](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-6-installation-guides/6.14/cortex-xsoar-installation-guide/single-server-installation/install-cortex-xsoar-offline.md): Install Cortex XSOAR 6.14 without internet access. - [Dependencies for Offline Installation](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-6-installation-guides/6.14/cortex-xsoar-installation-guide/single-server-installation/install-cortex-xsoar-offline/dependencies-for-offline-installation.md): Offline installation dependencies for Cortex XSOAR 6.14 on supported Linux operating systems. - [Uninstall the Server](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-6-installation-guides/6.14/cortex-xsoar-installation-guide/single-server-installation/uninstall-the-server.md): Uninstall Cortex XSOAR 6.14 and retain configuration and engine-created files. - [Multi-Tenant Installation](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-6-installation-guides/6.14/cortex-xsoar-installation-guide/multi-tenant-installation.md): Cortex XSOAR 6.14 multi-tenant installation planning and guidance. - [Install Multi-Tenant with Bolt Database](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-6-installation-guides/6.14/cortex-xsoar-installation-guide/multi-tenant-installation/install-multi-tenant-with-bolt-database.md): Install Cortex XSOAR 6.14 for multi-tenant deployments with the Bolt database. - [Installer Flags](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-6-installation-guides/6.14/cortex-xsoar-installation-guide/multi-tenant-installation/install-multi-tenant-with-bolt-database/installer-flags.md): Supported installer flags for Cortex XSOAR 6.14 multi-tenant installation. - [Install Multi-Tenant with Elasticsearch](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-6-installation-guides/6.14/cortex-xsoar-installation-guide/multi-tenant-installation/install-multi-tenant-with-elasticsearch.md): Install Cortex XSOAR 6.14 for multi-tenant deployments with Elasticsearch. - [Post Installation Checklist](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-6-installation-guides/6.14/cortex-xsoar-installation-guide/post-installation-checklist.md): Cortex XSOAR 6.14 post-installation checklist for validating and monitoring components. - [Add a License](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-6-installation-guides/6.14/cortex-xsoar-installation-guide/post-installation-checklist/add-a-license.md): Add a Cortex XSOAR 6.14 license through the UI or directly on the server. - [Server Post-Installation Health Check](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-6-installation-guides/6.14/cortex-xsoar-installation-guide/post-installation-checklist/server-post-installation-health-check.md): Run Cortex XSOAR 6.14 post-installation health checks for Docker, integrations, reporting, and content. - [Monitor Cortex XSOAR Components](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-6-installation-guides/6.14/cortex-xsoar-installation-guide/post-installation-checklist/monitor-cortex-xsoar-components.md): Monitor Cortex XSOAR 6.14 system components and health. - [Upgrade Your Installation](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-6-installation-guides/6.14/cortex-xsoar-installation-guide/upgrade-your-installation.md): Upgrade Cortex XSOAR 6.14 single server, multi-tenant, and live backup deployments. - [Upgrade the Cortex XSOAR Server](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-6-installation-guides/6.14/cortex-xsoar-installation-guide/upgrade-your-installation/upgrade-the-cortex-xsoar-server.md): Upgrade your Cortex XSOAR server to version 6.14. - [Upgrade Your Multi-Tenant Deployment](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-6-installation-guides/6.14/cortex-xsoar-installation-guide/upgrade-your-installation/upgrade-your-multi-tenant-deployment.md): Upgrade a Cortex XSOAR 6.14 multi-tenant deployment, including preparation and post-upgrade steps. - [Upgrade the Live Backup Environment](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-6-installation-guides/6.14/cortex-xsoar-installation-guide/upgrade-your-installation/upgrade-the-live-backup-environment.md): Upgrade the Cortex XSOAR 6.14 live backup environment. * [Overview](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-6-installation-guides/6.13/cortex-xsoar-installation-guide/readme.md): Installation for single server and multi-tenant deployments of Cortex XSOAR 6.13. * [Installation Overview](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-6-installation-guides/6.13/cortex-xsoar-installation-guide/readme/installation-overview.md): Cortex XSOAR 6.13 installation overview for single server, multi-tenant, BoltDB, Elasticsearch, and high availability deployments. * [Single Server Installation Overview](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-6-installation-guides/6.13/cortex-xsoar-installation-guide/readme/single-server-installation-overview.md): Cortex XSOAR 6.13 single server deployment overview with Bolt, Elasticsearch, and high availability options. * [Multi-Tenant Installation Overview](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-6-installation-guides/6.13/cortex-xsoar-installation-guide/readme/multi-tenant-installation-overview.md): Cortex XSOAR 6.13 multi-tenant installation overview with Bolt, Elasticsearch, and high availability options. * [System Requirements](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-6-installation-guides/6.13/cortex-xsoar-installation-guide/system-requirements.md): System requirements for installing Cortex XSOAR 6.13. * [Cortex XSOAR System Requirements](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-6-installation-guides/6.13/cortex-xsoar-installation-guide/system-requirements/cortex-xsoar-system-requirements.md): Cortex XSOAR 6.13 system requirements for operating systems, hardware, Docker, and Podman. * [Multi-Tenant System Requirements](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-6-installation-guides/6.13/cortex-xsoar-installation-guide/system-requirements/multi-tenant-system-requirements.md): Cortex XSOAR 6.13 multi-tenant server requirements and examples. * [Elasticsearch System Requirements](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-6-installation-guides/6.13/cortex-xsoar-installation-guide/system-requirements/elasticsearch-system-requirements.md): Cortex XSOAR 6.13 Elasticsearch implementation and sizing requirements. * [Supported Web Browsers](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-6-installation-guides/6.13/cortex-xsoar-installation-guide/system-requirements/supported-web-browsers.md): Supported web browsers for Cortex XSOAR 6.13. * [Cloud Deployment Specifications](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-6-installation-guides/6.13/cortex-xsoar-installation-guide/system-requirements/cloud-deployment-specifications.md): Cortex XSOAR 6.13 deployment guidelines for AWS EC2, Azure virtual machines, and GCP Compute Engine. * [AWS EC2 Deployment Guidelines](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-6-installation-guides/6.13/cortex-xsoar-installation-guide/system-requirements/cloud-deployment-specifications/aws-ec2-deployment-guidelines.md): Cortex XSOAR 6.13 AWS EC2 deployment sizing requirements and best practices. * [Azure Virtual Machines Deployment Guidelines](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-6-installation-guides/6.13/cortex-xsoar-installation-guide/system-requirements/cloud-deployment-specifications/azure-virtual-machines-deployment-guidelines.md): Cortex XSOAR 6.13 Azure virtual machine deployment sizing requirements and best practices. * [GCP Compute Engine Deployment Guidelines](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-6-installation-guides/6.13/cortex-xsoar-installation-guide/system-requirements/cloud-deployment-specifications/gcp-compute-engine-deployment-guidelines.md): Cortex XSOAR 6.13 GCP Compute Engine deployment sizing requirements and best practices. * [Single Server Installation](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-6-installation-guides/6.13/cortex-xsoar-installation-guide/single-server-installation.md): Cortex XSOAR 6.13 single server installation options and deployment resources. * [Install Cortex XSOAR with Bolt Database](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-6-installation-guides/6.13/cortex-xsoar-installation-guide/single-server-installation/install-cortex-xsoar-with-bolt-database.md): Install Cortex XSOAR 6.13 on a single server with the Bolt database. * [Installer Flags](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-6-installation-guides/6.13/cortex-xsoar-installation-guide/single-server-installation/install-cortex-xsoar-with-bolt-database/installer-flags.md): Supported installer flags for Cortex XSOAR 6.13. * [Install Cortex XSOAR with Elasticsearch](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-6-installation-guides/6.13/cortex-xsoar-installation-guide/single-server-installation/install-cortex-xsoar-with-elasticsearch.md): Install Cortex XSOAR 6.13 with Elasticsearch. * [Elasticsearch Configurations](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-6-installation-guides/6.13/cortex-xsoar-installation-guide/single-server-installation/install-cortex-xsoar-with-elasticsearch/elasticsearch-configurations.md): Supported Elasticsearch configurations for Cortex XSOAR 6.13. * [Elasticsearch General Security Guidelines](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-6-installation-guides/6.13/cortex-xsoar-installation-guide/single-server-installation/install-cortex-xsoar-with-elasticsearch/elasticsearch-general-security-guidelines.md): Elasticsearch security guidelines for Cortex XSOAR 6.13 single-server deployments. * [Elasticsearch Installation](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-6-installation-guides/6.13/cortex-xsoar-installation-guide/single-server-installation/install-cortex-xsoar-with-elasticsearch/elasticsearch-installation.md): Install a Cortex XSOAR 6.13 single-server deployment with Elasticsearch. * [Elasticsearch Best Practices](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-6-installation-guides/6.13/cortex-xsoar-installation-guide/single-server-installation/install-cortex-xsoar-with-elasticsearch/elasticsearch-best-practices.md): Elasticsearch configuration best practices for Cortex XSOAR 6.13 high availability. * [Install Cortex XSOAR Offline](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-6-installation-guides/6.13/cortex-xsoar-installation-guide/single-server-installation/install-cortex-xsoar-offline.md): Install Cortex XSOAR 6.13 without internet access. * [Dependencies for Offline Installation](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-6-installation-guides/6.13/cortex-xsoar-installation-guide/single-server-installation/install-cortex-xsoar-offline/dependencies-for-offline-installation.md): Offline installation dependencies for Cortex XSOAR 6.13 on CentOS, Red Hat, Ubuntu, and Debian. * [Uninstall the Server](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-6-installation-guides/6.13/cortex-xsoar-installation-guide/single-server-installation/uninstall-the-server.md): Uninstall Cortex XSOAR 6.13 while preserving configuration and engine-created files. * [Multi-Tenant Installation](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-6-installation-guides/6.13/cortex-xsoar-installation-guide/multi-tenant-installation.md): Plan your Cortex XSOAR 6.13 multi-tenant installation. * [Install Multi-Tenant with Bolt Database](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-6-installation-guides/6.13/cortex-xsoar-installation-guide/multi-tenant-installation/install-multi-tenant-with-bolt-database.md): Install Cortex XSOAR 6.13 for multi-tenant deployments with the Bolt or Bleve database. * [Installer Flags](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-6-installation-guides/6.13/cortex-xsoar-installation-guide/multi-tenant-installation/install-multi-tenant-with-bolt-database/installer-flags.md): Supported multi-tenant installer flags for Cortex XSOAR 6.13. * [Install Multi-Tenant with Elasticsearch](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-6-installation-guides/6.13/cortex-xsoar-installation-guide/multi-tenant-installation/install-multi-tenant-with-elasticsearch.md): Install Cortex XSOAR 6.13 multi-tenant deployments with Elasticsearch and review created files. * [Post Installation Checklist](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-6-installation-guides/6.13/cortex-xsoar-installation-guide/post-installation-checklist.md): Cortex XSOAR 6.13 post-installation checklist for verifying components and system health. * [Add a License](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-6-installation-guides/6.13/cortex-xsoar-installation-guide/post-installation-checklist/add-a-license.md): Add a Cortex XSOAR 6.13 license through the UI or directly on the server. * [Server Post-Installation Health Check](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-6-installation-guides/6.13/cortex-xsoar-installation-guide/post-installation-checklist/server-post-installation-health-check.md): Run Cortex XSOAR 6.13 post-installation health checks for Docker, integrations, commands, reporting, and content. * [Monitor Cortex XSOAR Components](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-6-installation-guides/6.13/cortex-xsoar-installation-guide/post-installation-checklist/monitor-cortex-xsoar-components.md): Monitor Cortex XSOAR 6.13 system components after installation. * [Upgrade Your Installation](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-6-installation-guides/6.13/cortex-xsoar-installation-guide/upgrade-your-installation.md): Upgrade Cortex XSOAR 6.13 single-server, multi-tenant, or live backup deployments. * [Upgrade the Cortex XSOAR Server](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-6-installation-guides/6.13/cortex-xsoar-installation-guide/upgrade-your-installation/upgrade-the-cortex-xsoar-server.md): Upgrade your Cortex XSOAR 6.13 server. * [Upgrade Your Multi-Tenant Deployment](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-6-installation-guides/6.13/cortex-xsoar-installation-guide/upgrade-your-installation/upgrade-your-multi-tenant-deployment.md): Upgrade Cortex XSOAR 6.13 multi-tenant deployments with preparation and post-upgrade steps. * [Upgrade the Live Backup Environment](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-6-installation-guides/6.13/cortex-xsoar-installation-guide/upgrade-your-installation/upgrade-the-live-backup-environment.md): Upgrade your Cortex XSOAR 6.13 live backup environment. - [Overview](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-6-installation-guides/6.12/cortex-xsoar-installation-guide/readme.md): Installation for single server and multi-tenant deployments in Cortex XSOAR 6.12. - [Installation Overview](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-6-installation-guides/6.12/cortex-xsoar-installation-guide/readme/installation-overview.md): Installation overview in Cortex XSOAR 6.12, including single server and multi-tenant deployments. - [Single Server Installation Overview](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-6-installation-guides/6.12/cortex-xsoar-installation-guide/readme/single-server-installation-overview.md): Single server deployment overview in Cortex XSOAR 6.12 with Bolt, Elasticsearch, and high availability. - [Multi-Tenant Installation Overview](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-6-installation-guides/6.12/cortex-xsoar-installation-guide/readme/multi-tenant-installation-overview.md): Multi-tenant installation overview in Cortex XSOAR 6.12 with Bolt, Elasticsearch, and high availability. - [System Requirements](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-6-installation-guides/6.12/cortex-xsoar-installation-guide/system-requirements.md): System requirements for installing Cortex XSOAR 6.12. - [Cortex XSOAR System Requirements](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-6-installation-guides/6.12/cortex-xsoar-installation-guide/system-requirements/cortex-xsoar-system-requirements.md): Cortex XSOAR 6.12 system requirements for operating systems, hardware, and Docker or Podman. - [Multi-Tenant System Requirements](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-6-installation-guides/6.12/cortex-xsoar-installation-guide/system-requirements/multi-tenant-system-requirements.md): Multi-tenant server requirements and examples in Cortex XSOAR 6.12. - [Elasticsearch System Requirements](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-6-installation-guides/6.12/cortex-xsoar-installation-guide/system-requirements/elasticsearch-system-requirements.md): Review Cortex XSOAR 6.12 requirements for Elasticsearch and its sizing options. - [Supported Web Browsers](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-6-installation-guides/6.12/cortex-xsoar-installation-guide/system-requirements/supported-web-browsers.md): Supported web browsers for Cortex XSOAR 6.12. - [Cloud Deployment Specifications](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-6-installation-guides/6.12/cortex-xsoar-installation-guide/system-requirements/cloud-deployment-specifications.md): Cloud deployment guidelines in Cortex XSOAR 6.12 for AWS, Azure, and GCP. - [AWS EC2 Deployment Guidelines](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-6-installation-guides/6.12/cortex-xsoar-installation-guide/system-requirements/cloud-deployment-specifications/aws-ec2-deployment-guidelines.md): AWS EC2 deployment requirements and best practices for Cortex XSOAR 6.12. - [Azure Virtual Machines Deployment Guidelines](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-6-installation-guides/6.12/cortex-xsoar-installation-guide/system-requirements/cloud-deployment-specifications/azure-virtual-machines-deployment-guidelines.md): Azure VM deployment requirements and best practices for Cortex XSOAR 6.12. - [GCP Compute Engine Deployment Guidelines](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-6-installation-guides/6.12/cortex-xsoar-installation-guide/system-requirements/cloud-deployment-specifications/gcp-compute-engine-deployment-guidelines.md): GCP Compute Engine requirements and best practices for Cortex XSOAR 6.12. - [Single Server Installation](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-6-installation-guides/6.12/cortex-xsoar-installation-guide/single-server-installation.md): Single server deployment resources in Cortex XSOAR 6.12. - [Install Cortex XSOAR with Bolt Database](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-6-installation-guides/6.12/cortex-xsoar-installation-guide/single-server-installation/install-cortex-xsoar-with-bolt-database.md): Install Cortex XSOAR 6.12 on one server with a Bolt database. - [Installer Flags](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-6-installation-guides/6.12/cortex-xsoar-installation-guide/single-server-installation/install-cortex-xsoar-with-bolt-database/installer-flags.md): Supported installer flags for Cortex XSOAR 6.12. - [Install Cortex XSOAR with Elasticsearch](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-6-installation-guides/6.12/cortex-xsoar-installation-guide/single-server-installation/install-cortex-xsoar-with-elasticsearch.md): Install Cortex XSOAR 6.12 with Elasticsearch. - [Elasticsearch Configurations](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-6-installation-guides/6.12/cortex-xsoar-installation-guide/single-server-installation/install-cortex-xsoar-with-elasticsearch/elasticsearch-configurations.md): Supported Elasticsearch configurations in Cortex XSOAR 6.12. - [Elasticsearch General Security Guidelines](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-6-installation-guides/6.12/cortex-xsoar-installation-guide/single-server-installation/install-cortex-xsoar-with-elasticsearch/elasticsearch-general-security-guidelines.md): Elasticsearch security guidelines for Cortex XSOAR 6.12 single-instance deployments. - [Elasticsearch Installation](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-6-installation-guides/6.12/cortex-xsoar-installation-guide/single-server-installation/install-cortex-xsoar-with-elasticsearch/elasticsearch-installation.md): Install a single server deployment with Elasticsearch in Cortex XSOAR 6.12. - [Elasticsearch Best Practices](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-6-installation-guides/6.12/cortex-xsoar-installation-guide/single-server-installation/install-cortex-xsoar-with-elasticsearch/elasticsearch-best-practices.md): Configure Elasticsearch for high availability in Cortex XSOAR 6.12. - [Install Cortex XSOAR Offline](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-6-installation-guides/6.12/cortex-xsoar-installation-guide/single-server-installation/install-cortex-xsoar-offline.md): Install Cortex XSOAR 6.12 without internet access. - [Dependencies for Offline Installation](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-6-installation-guides/6.12/cortex-xsoar-installation-guide/single-server-installation/install-cortex-xsoar-offline/dependencies-for-offline-installation.md): Offline installation dependencies for Cortex XSOAR 6.12 on supported Linux systems. - [Uninstall the Server](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-6-installation-guides/6.12/cortex-xsoar-installation-guide/single-server-installation/uninstall-the-server.md): Uninstall Cortex XSOAR 6.12 while preserving configuration and engine-created files. - [Multi-Tenant Installation](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-6-installation-guides/6.12/cortex-xsoar-installation-guide/multi-tenant-installation.md): Plan a multi-tenant installation in Cortex XSOAR 6.12. - [Install Multi-Tenant with Bolt Database](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-6-installation-guides/6.12/cortex-xsoar-installation-guide/multi-tenant-installation/install-multi-tenant-with-bolt-database.md): Install a multi-tenant Bolt or Bleve deployment in Cortex XSOAR 6.12. - [Installer Flags](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-6-installation-guides/6.12/cortex-xsoar-installation-guide/multi-tenant-installation/install-multi-tenant-with-bolt-database/installer-flags.md): Supported installer flags for Cortex XSOAR 6.12 multi-tenant deployments. - [Install Multi-Tenant with Elasticsearch](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-6-installation-guides/6.12/cortex-xsoar-installation-guide/multi-tenant-installation/install-multi-tenant-with-elasticsearch.md): Install a multi-tenant Elasticsearch deployment in Cortex XSOAR 6.12. - [Post Installation Checklist](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-6-installation-guides/6.12/cortex-xsoar-installation-guide/post-installation-checklist.md): Use the post-installation checklist in Cortex XSOAR 6.12 to verify system health. - [Add a License](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-6-installation-guides/6.12/cortex-xsoar-installation-guide/post-installation-checklist/add-a-license.md): Add a Cortex XSOAR 6.12 license through the UI or directly on the server. - [Server Post-Installation Health Check](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-6-installation-guides/6.12/cortex-xsoar-installation-guide/post-installation-checklist/server-post-installation-health-check.md): Run Cortex XSOAR 6.12 post-installation health checks for server components. - [Monitor Cortex XSOAR Components](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-6-installation-guides/6.12/cortex-xsoar-installation-guide/post-installation-checklist/monitor-cortex-xsoar-components.md): Monitor Cortex XSOAR 6.12 system components. - [Upgrade Your Installation](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-6-installation-guides/6.12/cortex-xsoar-installation-guide/upgrade-your-installation.md): Upgrade Cortex XSOAR 6.12 for single server, multi-tenant, or live backup deployments. - [Upgrade the Cortex XSOAR Server](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-6-installation-guides/6.12/cortex-xsoar-installation-guide/upgrade-your-installation/upgrade-the-cortex-xsoar-server.md): Upgrade your Cortex XSOAR 6.12 server. - [Upgrade Your Multi-Tenant Deployment](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-6-installation-guides/6.12/cortex-xsoar-installation-guide/upgrade-your-installation/upgrade-your-multi-tenant-deployment.md): Upgrade a Cortex XSOAR 6.12 multi-tenant deployment from preparation through validation. - [Upgrade the Live Backup Environment](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-6-installation-guides/6.12/cortex-xsoar-installation-guide/upgrade-your-installation/upgrade-the-live-backup-environment.md): Upgrade your Cortex XSOAR 6.12 live backup environment. ## Playbook Design Guide - [Playbooks](https://cortex-docs.paloaltonetworks.com/playbook-design-guide/playbook-design-guide/readme.md): Cortex XSOAR 6x playbooks enable you to organize and automate the security monitoring, orchestration, and response flow for your incident investigation. - [What Are Playbooks?](https://cortex-docs.paloaltonetworks.com/playbook-design-guide/playbook-design-guide/readme/what-are-playbooks.md): Cortex XSOAR 6x playbooks enable you to structure and automate many of your security processes. Parse incident information, interact with users, and remediate. - [Playbook Development](https://cortex-docs.paloaltonetworks.com/playbook-design-guide/playbook-design-guide/readme/playbook-development.md): Cortex XSOAR 6x playbooks enable you to structure and automate many of your security processes. - [Configure IoT Security Playbooks](https://cortex-docs.paloaltonetworks.com/playbook-design-guide/playbook-design-guide/readme/configure-iot-security-playbooks.md): IoT Security playbooks in Cortex XSOAR 6x enable you to structure and automate many of your third-party security processes. Parse incident information, interact with users, and remediate. - [Manage Playbook Settings](https://cortex-docs.paloaltonetworks.com/playbook-design-guide/playbook-design-guide/manage-playbook-settings.md): Manage Cortex XSOAR 6x playbook settings, including role access, which incident type triggers it, and options for Quiet Mode. - [Obtain Playbook Metadata](https://cortex-docs.paloaltonetworks.com/playbook-design-guide/playbook-design-guide/manage-playbook-settings/obtain-playbook-metadata.md): Analyze Cortex XSOAR 6x playbook metadata for troubleshooting custom playbooks. Use the getInvPlaybookMetaData command. - [Version Control](https://cortex-docs.paloaltonetworks.com/playbook-design-guide/playbook-design-guide/version-control.md): Save versions of your playbook in Cortex XSOAR 6x as you are developing it. - [Playbook Task Fields](https://cortex-docs.paloaltonetworks.com/playbook-design-guide/playbook-design-guide/playbook-task-fields.md): All of the fields available when defining a playbook task in Cortex XSOAR 6x. - [Create Section Headers](https://cortex-docs.paloaltonetworks.com/playbook-design-guide/playbook-design-guide/playbook-task-fields/create-section-headers.md): Section headers tasks are used to manage the flow of your playbook in Cortex XSOAR 6x and help you organize your tasks efficiently. - [Create a Conditional Task](https://cortex-docs.paloaltonetworks.com/playbook-design-guide/playbook-design-guide/playbook-task-fields/create-a-conditional-task.md): Create a conditional task in a Cortex XSOAR 6x playbook. - [Communication Tasks](https://cortex-docs.paloaltonetworks.com/playbook-design-guide/playbook-design-guide/playbook-task-fields/communication-tasks.md): Communication tasks in Cortex XSOAR 6x playbooks enable you to send surveys and collect data. - [Create an Ask Task](https://cortex-docs.paloaltonetworks.com/playbook-design-guide/playbook-design-guide/playbook-task-fields/communication-tasks/create-an-ask-task.md): Create a conditional Ask task in a playbook in Cortex XSOAR 6x. An Ask task is a single question survey that determines how the playbook proceeds. Answer is recorded in context. - [Ask Task Examples](https://cortex-docs.paloaltonetworks.com/playbook-design-guide/playbook-design-guide/playbook-task-fields/communication-tasks/create-an-ask-task/ask-task-examples.md): Examples for using the Ask task to send email messages and recurring surveys in Cortex XSOAR 6x. - [Customize an Ask Task](https://cortex-docs.paloaltonetworks.com/playbook-design-guide/playbook-design-guide/playbook-task-fields/communication-tasks/create-an-ask-task/customize-an-ask-task.md): Customize the HTML and CSS template used for Ask task messages in Cortex XSOAR 6x. - [Create a Data Collection Task](https://cortex-docs.paloaltonetworks.com/playbook-design-guide/playbook-design-guide/playbook-task-fields/communication-tasks/create-a-data-collection-task.md): Create a data collection task in a Cortex XSOAR 6x playbook. Multi-question survey (form), responses are recorded in incident’s context data. - [Data Collection Task Examples](https://cortex-docs.paloaltonetworks.com/playbook-design-guide/playbook-design-guide/playbook-task-fields/communication-tasks/create-a-data-collection-task/data-collection-task-examples.md): Common configurations for Data Collection tasks in Cortex XSOAR 6x. - [Customize a Data Collection Task](https://cortex-docs.paloaltonetworks.com/playbook-design-guide/playbook-design-guide/playbook-task-fields/communication-tasks/create-a-data-collection-task/customize-a-data-collection-task.md): Customize the HTML and CSS used in Data Collection task messages in Cortex XSOAR 6x. - [Customize the SOC Name](https://cortex-docs.paloaltonetworks.com/playbook-design-guide/playbook-design-guide/playbook-task-fields/communication-tasks/customize-the-soc-name.md): Add a server configuration to customize the name of the security operations center (SOC) that appears in communication tasks in Cortex XSOAR 6x. - [Create Communication Task Authentication](https://cortex-docs.paloaltonetworks.com/playbook-design-guide/playbook-design-guide/playbook-task-fields/communication-tasks/create-communication-task-authentication.md): Configure user authentication for a communication task in Cortex XSOAR 6x. - [Add Ad Hoc Tasks to a Work Plan](https://cortex-docs.paloaltonetworks.com/playbook-design-guide/playbook-design-guide/playbook-task-fields/add-ad-hoc-tasks-to-a-work-plan.md): Add ad hoc tasks to a Work Plan in Cortex XSOAR 6x for a specific iteration of a playbook. - [Handle Errors in a Playbook](https://cortex-docs.paloaltonetworks.com/playbook-design-guide/playbook-design-guide/playbook-task-fields/handle-errors-in-a-playbook.md): When defining a task in Cortex XSOAR 6x, you can decide if the playbook continues, stops, or continues on an error path. - [Playbook Task Fields](https://cortex-docs.paloaltonetworks.com/playbook-design-guide/playbook-design-guide/playbook-task-fields/playbook-task-fields.md): All of the fields available when defining a playbook task in Cortex XSOAR 6x. - [Playbook Inputs and Outputs](https://cortex-docs.paloaltonetworks.com/playbook-design-guide/playbook-design-guide/playbook-inputs-and-outputs.md): Cortex XSOAR 6x playbooks and tasks have inputs (data from incident or integration) and outputs that can then be used as input in other tasks. - [Task Cheat Sheet](https://cortex-docs.paloaltonetworks.com/playbook-design-guide/playbook-design-guide/playbook-inputs-and-outputs/task-cheat-sheet.md): Use the Cortex XSOAR 6x playbook task cheat sheet to quickly access system and custom fields for task inputs and outputs. - [Extend Context](https://cortex-docs.paloaltonetworks.com/playbook-design-guide/playbook-design-guide/extend-context.md): Extend context to retrieve specific information from integrations or commands and map to fields in Cortex XSOAR 6x. - [Extend Context in a Playbook Task](https://cortex-docs.paloaltonetworks.com/playbook-design-guide/playbook-design-guide/extend-context/extend-context-in-a-playbook-task.md): Extend context to retrieve additional data from integrations or commands and map to fields. Extend context in a Cortex XSOAR 6x playbook task. - [Extend Context using the Command Line](https://cortex-docs.paloaltonetworks.com/playbook-design-guide/playbook-design-guide/extend-context/extend-context-using-the-command-line.md): Extend context to retrieve additional data from integrations or commands and map it to fields. Extend context from the Cortex XSOAR 6x command line (CLI). - [Filters and Transformers](https://cortex-docs.paloaltonetworks.com/playbook-design-guide/playbook-design-guide/filters-and-transformers.md): Use filters and transformers to manipulate data in Cortex XSOAR 6x. Use filters and transformers in playbook tasks or when mapping an instance. - [Create Filters and Transformers in a Playbook](https://cortex-docs.paloaltonetworks.com/playbook-design-guide/playbook-design-guide/filters-and-transformers/create-filters-and-transformers-in-a-playbook.md): Create filters and transformers in Cortex XSOAR 6x playbooks. - [Create a Filter Example](https://cortex-docs.paloaltonetworks.com/playbook-design-guide/playbook-design-guide/filters-and-transformers/create-filters-and-transformers-in-a-playbook/create-a-filter-example.md): Example of how to create a filter in Cortex XSOAR 6x. Filter all EWS Item names with a particular extension. filters objects transformers playbooks - [Create a Filter (Advanced) Example](https://cortex-docs.paloaltonetworks.com/playbook-design-guide/playbook-design-guide/filters-and-transformers/create-filters-and-transformers-in-a-playbook/create-a-filter-advanced-example.md): Advanced example of how to create a filter in Cortex XSOAR 6x. - [Filter Operators](https://cortex-docs.paloaltonetworks.com/playbook-design-guide/playbook-design-guide/filters-and-transformers/filter-operators.md): Use filters to extract relevant data for use elsewhere in Cortex XSOAR 6x. - [Built-in Filters](https://cortex-docs.paloaltonetworks.com/playbook-design-guide/playbook-design-guide/filters-and-transformers/filter-operators/built-in-filters.md): Description of the built-in filters available for playbook tasks in Cortex XSOAR 6x. - [Transformers Operators](https://cortex-docs.paloaltonetworks.com/playbook-design-guide/playbook-design-guide/filters-and-transformers/transformers-operators.md): Transformers enable you to transfer or render one value to another value in Cortex XSOAR 6x. Description of system transformer operators. - [Create Custom Filter and Transformer Operators](https://cortex-docs.paloaltonetworks.com/playbook-design-guide/playbook-design-guide/filters-and-transformers/create-custom-filter-and-transformer-operators.md): Create a custom filter or transformer in Cortex XSOAR 6x. - [Automations](https://cortex-docs.paloaltonetworks.com/playbook-design-guide/playbook-design-guide/automations.md): Create and edit an automation in Cortex XSOAR 6x, including detach and attach, automation settings, etc. - [Special Automation Tags](https://cortex-docs.paloaltonetworks.com/playbook-design-guide/playbook-design-guide/automations/special-automation-tags.md): Special automation tags that make an automation available to a specific area in Cortex XSOAR 6x. - [Common Scripts to use in Automations](https://cortex-docs.paloaltonetworks.com/playbook-design-guide/playbook-design-guide/automations/common-scripts-to-use-in-automations.md): Scripts in the Common Scripts content pack and the Base content pack are available to use in other scripts in Cortex XSOAR 6x. - [Configure a Sub-playbook Loop](https://cortex-docs.paloaltonetworks.com/playbook-design-guide/playbook-design-guide/configure-a-sub-playbook-loop.md): Configure a sub-playbook to run in a loop Cortex XSOAR 6x. - [Sub-Playbook Loop Example](https://cortex-docs.paloaltonetworks.com/playbook-design-guide/playbook-design-guide/configure-a-sub-playbook-loop/sub-playbook-loop-example.md): This example illustrates the use of a sub-playbook loop using the Cortex XDR Investigation and Response integration Cortex XSOAR 6x. - [Playbook Polling](https://cortex-docs.paloaltonetworks.com/playbook-design-guide/playbook-design-guide/playbook-polling.md): Cortex XSOAR 6x Generic Polling playbook enables you to periodically poll the status of a process on a remote host. - [Create Incident Fields in a Playbook](https://cortex-docs.paloaltonetworks.com/playbook-design-guide/playbook-design-guide/create-incident-fields-in-a-playbook.md): Use the setIncident automation to set and update all system incident fields Cortex XSOAR 6x. - [Playbook Testing](https://cortex-docs.paloaltonetworks.com/playbook-design-guide/playbook-design-guide/playbook-testing.md): Test your playbook with ingested incidents Cortex XSOAR 6x. - [Debug a Playbook](https://cortex-docs.paloaltonetworks.com/playbook-design-guide/playbook-design-guide/playbook-testing/debug-a-playbook.md): Set breakpoints, conditional breakpoints, skip tasks, and input and output overrides in the Cortex XSOAR 6x playbook debugger. - [Debugger Troubleshooting](https://cortex-docs.paloaltonetworks.com/playbook-design-guide/playbook-design-guide/playbook-testing/debugger-troubleshooting.md): Find and fix potential issues with the Cortex XSOAR 6x Playbook Debugger. - [Best Practices](https://cortex-docs.paloaltonetworks.com/playbook-design-guide/playbook-design-guide/best-practices.md): Best practices for working with playbooks Cortex XSOAR 6x. ## Tutorials - [Tutorials](https://cortex-docs.paloaltonetworks.com/tutorials/cortex-xsoar-tutorials/readme.md): Tutorials that provide you with step-by-step instructions for setting up your workflows in Cortex XSOAR 6x, with four example use cases. - [Ingest Incidents from a SIEM Using QRadar](https://cortex-docs.paloaltonetworks.com/tutorials/cortex-xsoar-tutorials/readme/ingest-incidents-from-a-siem-using-qradar.md): Step-by-step tutorial for ingesting and handling incidents and events from QRadar in Cortex XSOAR 6x. - [Ingest Incidents from a SIEM Using Splunk](https://cortex-docs.paloaltonetworks.com/tutorials/cortex-xsoar-tutorials/readme/ingest-incidents-from-a-siem-using-splunk.md): A step-by-step tutorial for ingesting and handling incidents and events from Splunk in Cortex XSOAR 6x. - [Set up a Phishing Incident in Cortex XSOAR](https://cortex-docs.paloaltonetworks.com/tutorials/cortex-xsoar-tutorials/readme/set-up-a-phishing-incident-in-cortex-xsoar.md): A tutorial that takes you through a phishing incident from the initial planning stage to investigating an incident in Cortex XSOAR 6x. - [Set up a Malware Incident Using the Deployment Wizard](https://cortex-docs.paloaltonetworks.com/tutorials/cortex-xsoar-tutorials/readme/set-up-a-malware-incident-using-the-deployment-wizard.md): A tutorial that takes you through a malware incident from the initial planning stage through using the Deployment Wizard to set up and on to investigating an incident in Cortex XSOAR 6x. ## Python Development Quick Start Guide - [Cortex XSOAR Platform Overview](https://cortex-docs.paloaltonetworks.com/python-development-quick-start-guide/cortex-xsoar-python-development-quick-start-guide/readme.md): How the Cortex XSOAR platform is structured. - [Where Cortex XSOAR Uses Python Scripts](https://cortex-docs.paloaltonetworks.com/python-development-quick-start-guide/cortex-xsoar-python-development-quick-start-guide/readme/where-cortex-xsoar-uses-python-scripts.md): Overview of Python script use in Cortex XSOAR. - [Cortex XSOAR Script Development Process](https://cortex-docs.paloaltonetworks.com/python-development-quick-start-guide/cortex-xsoar-python-development-quick-start-guide/cortex-xsoar-script-development-process.md): Development flows for the different scripts. - [Development Tools and Resources](https://cortex-docs.paloaltonetworks.com/python-development-quick-start-guide/cortex-xsoar-python-development-quick-start-guide/development-tools-and-resources.md): Development tools include Demisto class, Common Server Python class, Common Scripts content pack, Cortex XSOAR IDE and script helper, and more. - [Cortex XSOAR Automation Scripts](https://cortex-docs.paloaltonetworks.com/python-development-quick-start-guide/cortex-xsoar-python-development-quick-start-guide/development-tools-and-resources/cortex-xsoar-automation-scripts.md): Overview of automation scripts in Cortex XSOAR. - [Set an Incident Field](https://cortex-docs.paloaltonetworks.com/python-development-quick-start-guide/cortex-xsoar-python-development-quick-start-guide/development-tools-and-resources/cortex-xsoar-automation-scripts/set-an-incident-field.md): Example automation script for setting an incident field in Cortex XSOAR. - [Close an Investigation](https://cortex-docs.paloaltonetworks.com/python-development-quick-start-guide/cortex-xsoar-python-development-quick-start-guide/development-tools-and-resources/cortex-xsoar-automation-scripts/close-an-investigation.md): Example automation script for closing an investigation in Cortex XSOAR. - [Query the Audit Trail](https://cortex-docs.paloaltonetworks.com/python-development-quick-start-guide/cortex-xsoar-python-development-quick-start-guide/development-tools-and-resources/cortex-xsoar-automation-scripts/query-the-audit-trail.md): Example automation script for using the Cortex XSOAR REST API to query the audit trail. - [Add a Table to the Incident Layout](https://cortex-docs.paloaltonetworks.com/python-development-quick-start-guide/cortex-xsoar-python-development-quick-start-guide/development-tools-and-resources/cortex-xsoar-automation-scripts/add-a-table-to-the-incident-layout.md): Example automation script for creating a new incident field of type grid (table). - [Field Change Trigger](https://cortex-docs.paloaltonetworks.com/python-development-quick-start-guide/cortex-xsoar-python-development-quick-start-guide/development-tools-and-resources/cortex-xsoar-automation-scripts/field-change-trigger.md): Create an automation that is triggered by a field change. - [Multi-select Field Display](https://cortex-docs.paloaltonetworks.com/python-development-quick-start-guide/cortex-xsoar-python-development-quick-start-guide/development-tools-and-resources/cortex-xsoar-automation-scripts/multi-select-field-display.md): Create an automation script for a display field with custom multi-select options. - [Export Incidents to CSV](https://cortex-docs.paloaltonetworks.com/python-development-quick-start-guide/cortex-xsoar-python-development-quick-start-guide/development-tools-and-resources/cortex-xsoar-automation-scripts/export-incidents-to-csv.md): Create an automation script to export incidents to CSV. - [Apply Tags to Indicators](https://cortex-docs.paloaltonetworks.com/python-development-quick-start-guide/cortex-xsoar-python-development-quick-start-guide/development-tools-and-resources/cortex-xsoar-automation-scripts/apply-tags-to-indicators.md): Create an automation script to apply a list of tags to found indicators. - [Script Code Snippets](https://cortex-docs.paloaltonetworks.com/python-development-quick-start-guide/cortex-xsoar-python-development-quick-start-guide/script-code-snippets.md): Code snippets for common automation script actions. - [Reference](https://cortex-docs.paloaltonetworks.com/python-development-quick-start-guide/cortex-xsoar-python-development-quick-start-guide/reference.md): Additional information on the Visual Studio Code Cortex XSOAR extension, links to developer documentation, and links to third party tools. ## Cortex XSOAR 6.x FAQs - [Cortex XSOAR 6 FAQs](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-6.x-faqs/cortex-xsoar-6-faqs.md): Frequently asked questions about Cortex XSOAR 6x. - [Content Feature Requests](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-6.x-faqs/cortex-xsoar-6-faqs/content-feature-requests.md): How to submit a content feature request in Cortex XSOAR 6x. - [Customer Support Portal FAQs](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-6.x-faqs/cortex-xsoar-6-faqs/customer-support-portal-faqs.md): Customer Support Portal FAQs and support guidance for Cortex XSOAR 6x. - [Licensing](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-6.x-faqs/cortex-xsoar-6-faqs/licensing.md): FAQs about Cortex XSOAR 6x licensing, user types, and entitlements. - [Resources](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-6.x-faqs/cortex-xsoar-6-faqs/resources.md): Resources and support links for Cortex XSOAR 6x. - [Upgrade from Cortex XSOAR 6](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-6.x-faqs/cortex-xsoar-6-faqs/upgrade-from-cortex-xsoar-6.md): FAQs about upgrading from Cortex XSOAR 6x to Cortex XSOAR 8 SaaS. ## Cortex XSOAR 6.12 Hosted Service Guide ## Cortex Data Security Documentation - [What is Cortex Data Security?](https://cortex-docs.paloaltonetworks.com/data-security-documentation/get-started-with-cortex-data-security/readme.md) - [Key features](https://cortex-docs.paloaltonetworks.com/data-security-documentation/get-started-with-cortex-data-security/key-features.md) - [Supported web browsers](https://cortex-docs.paloaltonetworks.com/data-security-documentation/get-started-with-cortex-data-security/supported-web-browsers.md) - [Use the interface](https://cortex-docs.paloaltonetworks.com/data-security-documentation/get-started-with-cortex-data-security/use-the-interface.md) - [Understand Cortex Data Security Licenses](https://cortex-docs.paloaltonetworks.com/data-security-documentation/get-started-with-cortex-data-security/understand-cortex-data-security-licenses.md) - [Data retention in Cortex Data Security](https://cortex-docs.paloaltonetworks.com/data-security-documentation/get-started-with-cortex-data-security/understand-cortex-data-security-licenses/data-retention-in-cortex-data-security.md) - [Data storage lifecycle](https://cortex-docs.paloaltonetworks.com/data-security-documentation/get-started-with-cortex-data-security/understand-cortex-data-security-licenses/data-storage-lifecycle.md) - [License allocation](https://cortex-docs.paloaltonetworks.com/data-security-documentation/get-started-with-cortex-data-security/understand-cortex-data-security-licenses/license-allocation.md) - [License expiration](https://cortex-docs.paloaltonetworks.com/data-security-documentation/get-started-with-cortex-data-security/understand-cortex-data-security-licenses/license-expiration.md) - [Cortex Data Security terminology](https://cortex-docs.paloaltonetworks.com/data-security-documentation/data-security/cortex-data-security-terminology.md) - [Data Security Posture Management](https://cortex-docs.paloaltonetworks.com/data-security-documentation/data-security/data-security-posture-management.md) - [Data Detection and Response](https://cortex-docs.paloaltonetworks.com/data-security-documentation/data-security/data-detection-and-response.md) - [DLP Harmonization](https://cortex-docs.paloaltonetworks.com/data-security-documentation/data-security/dlp-harmonization.md) - [AI Security Posture Management](https://cortex-docs.paloaltonetworks.com/data-security-documentation/data-security/ai-security-posture-management.md) - [Data Access Governance](https://cortex-docs.paloaltonetworks.com/data-security-documentation/data-security/data-access-governance.md) - [Supported assets in Cortex Data Security](https://cortex-docs.paloaltonetworks.com/data-security-documentation/data-security/supported-assets-in-cortex-data-security.md) - [Data Classification](https://cortex-docs.paloaltonetworks.com/data-security-documentation/data-security/data-classification.md) - [What is Cortex Data Classification?](https://cortex-docs.paloaltonetworks.com/data-security-documentation/data-security/data-classification/what-is-cortex-data-classification.md) - [How to create and validate a custom data pattern](https://cortex-docs.paloaltonetworks.com/data-security-documentation/data-security/data-classification/how-to-create-and-validate-a-custom-data-pattern.md) - [Custom data patterns: Guardrails and syntax guide](https://cortex-docs.paloaltonetworks.com/data-security-documentation/data-security/data-classification/how-to-create-and-validate-a-custom-data-pattern/custom-data-patterns-guardrails-and-syntax-guide.md) - [How to disable and enable data patterns in Data Classification](https://cortex-docs.paloaltonetworks.com/data-security-documentation/data-security/data-classification/how-to-disable-and-enable-data-patterns-in-data-classification.md) - [How to create and validate a custom data profile](https://cortex-docs.paloaltonetworks.com/data-security-documentation/data-security/data-classification/how-to-create-and-validate-a-custom-data-profile.md) - [How to disable and enable data profiles in Cortex Data Classification](https://cortex-docs.paloaltonetworks.com/data-security-documentation/data-security/data-classification/how-to-disable-and-enable-data-profiles-in-cortex-data-classification.md) - [How to use information protection labels in Cortex Data Security](https://cortex-docs.paloaltonetworks.com/data-security-documentation/data-security/data-classification/how-to-use-information-protection-labels-in-cortex-data-security.md) - [Topic classification](https://cortex-docs.paloaltonetworks.com/data-security-documentation/data-security/data-classification/topic-classification.md) - [About Agentic AI & the Cortex Agentic Assistant](https://cortex-docs.paloaltonetworks.com/data-security-documentation/agentic-ai-and-cortex-agentic-assistant/agentic-ai.md) - [Agentic Assistant use cases](https://cortex-docs.paloaltonetworks.com/data-security-documentation/agentic-ai-and-cortex-agentic-assistant/agentic-assistant-use-cases.md) - [Agentic Assistant security](https://cortex-docs.paloaltonetworks.com/data-security-documentation/agentic-ai-and-cortex-agentic-assistant/agentic-assistant-security.md) - [Data security agent](https://cortex-docs.paloaltonetworks.com/data-security-documentation/agentic-ai-and-cortex-agentic-assistant/data-security-agent.md) - [Plan and prepare](https://cortex-docs.paloaltonetworks.com/data-security-documentation/onboard-and-configure/plan-and-prepare.md) - [Deployment checklist](https://cortex-docs.paloaltonetworks.com/data-security-documentation/onboard-and-configure/deployment-checklist.md) - [Activation](https://cortex-docs.paloaltonetworks.com/data-security-documentation/onboard-and-configure/deployment-checklist/activation.md) - [Supported regions](https://cortex-docs.paloaltonetworks.com/data-security-documentation/onboard-and-configure/deployment-checklist/activation/supported-regions.md) - [Enable access to required PANW resources](https://cortex-docs.paloaltonetworks.com/data-security-documentation/onboard-and-configure/deployment-checklist/activation/enable-access-to-required-panw-resources.md) - [Regional egress resources](https://cortex-docs.paloaltonetworks.com/data-security-documentation/onboard-and-configure/deployment-checklist/activation/enable-access-to-required-panw-resources/regional-egress-resources.md) - [Engines IP addresses (outbound) - fix tables](https://cortex-docs.paloaltonetworks.com/data-security-documentation/onboard-and-configure/deployment-checklist/activation/enable-access-to-required-panw-resources/engines-ip-addresses-outbound-fix-tables.md) - [Inbound source resources - fix tables](https://cortex-docs.paloaltonetworks.com/data-security-documentation/onboard-and-configure/deployment-checklist/activation/enable-access-to-required-panw-resources/inbound-source-resources-fix-tables.md) - [FedRAMP and the US Federal Government required resources](https://cortex-docs.paloaltonetworks.com/data-security-documentation/onboard-and-configure/deployment-checklist/activation/enable-access-to-required-panw-resources/fedramp-and-the-us-federal-government-required-resources.md) - [Set up users, groups, and roles](https://cortex-docs.paloaltonetworks.com/data-security-documentation/onboard-and-configure/deployment-checklist/set-up-users-and-roles.md): Learn how to set up users and roles in Cortex Data Security. - [User group management](https://cortex-docs.paloaltonetworks.com/data-security-documentation/onboard-and-configure/deployment-checklist/set-up-users-and-roles/user-group-management.md): Create and manage user groups, roles, and scopes. - [Assign user roles and groups](https://cortex-docs.paloaltonetworks.com/data-security-documentation/onboard-and-configure/deployment-checklist/set-up-users-and-roles/assign-user-roles-and-groups.md): Assign roles and group memberships to users. - [Manage API keys](https://cortex-docs.paloaltonetworks.com/data-security-documentation/onboard-and-configure/deployment-checklist/manage-api-keys.md) - [Set up authentication](https://cortex-docs.paloaltonetworks.com/data-security-documentation/onboard-and-configure/deployment-checklist/set-up-authentication.md): Authenticate Cortex Data Security users using SAML 2.0 or Customer Support Portal (CSP). - [Authenticate users through the Customer Support Portal](https://cortex-docs.paloaltonetworks.com/data-security-documentation/onboard-and-configure/deployment-checklist/set-up-authentication/authenticate-users-through-the-customer-support-portal.md): Authenticate users through the Customer Support Portal. - [Authenticate users using SSO](https://cortex-docs.paloaltonetworks.com/data-security-documentation/onboard-and-configure/deployment-checklist/set-up-authentication/authenticate-users-using-sso.md): Configure SAML single sign-on for Cortex Data Security users. - [Set up Okta as the Identity Provider Using SAML 2.0](https://cortex-docs.paloaltonetworks.com/data-security-documentation/onboard-and-configure/deployment-checklist/set-up-authentication/set-up-okta-as-the-identity-provider-using-saml-2.0.md): Configure Okta as a SAML 2.0 identity provider. - [Set up Microsoft Entra ID as the Identity Provider Using SAML 2.0](https://cortex-docs.paloaltonetworks.com/data-security-documentation/onboard-and-configure/deployment-checklist/set-up-authentication/set-up-microsoft-entra-id-as-the-identity-provider-using-saml-2.0.md): Configure Microsoft Entra ID as a SAML 2.0 identity provider. - [Cloud service provider (CSP) onboarding](https://cortex-docs.paloaltonetworks.com/data-security-documentation/onboard-and-configure/csp-onboarding.md) - [Amazon Web Services cloud onboarding](https://cortex-docs.paloaltonetworks.com/data-security-documentation/onboard-and-configure/csp-onboarding/amazon-web-services-cloud-onboarding.md): Follow the AWS onboarding wizard, and Cortex Data Security creates a custom authentication template to be deployed in AWS. - [AWS security capabilities and deployment planning](https://cortex-docs.paloaltonetworks.com/data-security-documentation/onboard-and-configure/csp-onboarding/amazon-web-services-cloud-onboarding/aws-security-capabilities-and-deployment-planning.md) - [AWS resource inventory](https://cortex-docs.paloaltonetworks.com/data-security-documentation/onboard-and-configure/csp-onboarding/amazon-web-services-cloud-onboarding/aws-resource-inventory.md) - [AWS security model and authentication](https://cortex-docs.paloaltonetworks.com/data-security-documentation/onboard-and-configure/csp-onboarding/amazon-web-services-cloud-onboarding/aws-security-model-and-authentication.md) - [Cortex Data Security and AWS audit log collection architecture](https://cortex-docs.paloaltonetworks.com/data-security-documentation/onboard-and-configure/csp-onboarding/amazon-web-services-cloud-onboarding/cortex-cloud-and-aws-audit-log-collection-architecture.md) - [Onboard Amazon Web Services](https://cortex-docs.paloaltonetworks.com/data-security-documentation/onboard-and-configure/csp-onboarding/amazon-web-services-cloud-onboarding/onboard-amazon-web-services.md): Follow the AWS onboarding wizard, and Cortex Data Security creates a custom authentication template to be executed in AWS. - [Prerequisites for onboarding AWS](https://cortex-docs.paloaltonetworks.com/data-security-documentation/onboard-and-configure/csp-onboarding/amazon-web-services-cloud-onboarding/prerequisites-for-onboarding-aws.md): Before you begin onboarding AWS, you must review the following prerequisites. - [How to onboard Amazon Web Services](https://cortex-docs.paloaltonetworks.com/data-security-documentation/onboard-and-configure/csp-onboarding/amazon-web-services-cloud-onboarding/how-to-onboard-amazon-web-services.md): Follow the AWS onboarding wizard and Cortex Data Security creates a custom authentication template to be deployed in AWS CloudFormation. - [Deploy the authentication template in AWS](https://cortex-docs.paloaltonetworks.com/data-security-documentation/onboard-and-configure/csp-onboarding/amazon-web-services-cloud-onboarding/deploy-the-authentication-template-in-aws.md): Learn how to deploy the Terraform or CloudFormation authentication template in Amazon Web Services. - [Post-deployment: Custom (BYOB) and Control Tower audit log collection](https://cortex-docs.paloaltonetworks.com/data-security-documentation/onboard-and-configure/csp-onboarding/amazon-web-services-cloud-onboarding/post-deployment-custom-byob-audit-log-collection.md) - [Grant cross-account KMS key access for Control Tower BYOB log collection](https://cortex-docs.paloaltonetworks.com/data-security-documentation/onboard-and-configure/csp-onboarding/amazon-web-services-cloud-onboarding/grant-cross-account-kms-key-access-for-control-tower-byob-log-collection.md): Learn how to configure cross-account AWS KMS key permissions for Cortex Control Tower BYOB log collection. Step-by-step guide to updating KMS key policies. - [AWS post-deployment verification](https://cortex-docs.paloaltonetworks.com/data-security-documentation/onboard-and-configure/csp-onboarding/amazon-web-services-cloud-onboarding/aws-post-deployment-verification.md): After you have completed the AWS onboarding wizard and you have deployed the authentication template in AWS (using CloudFormation or Terraform), verify that the deployment succeeded. - [Amazon Web Services (AWS) provider permissions](https://cortex-docs.paloaltonetworks.com/data-security-documentation/onboard-and-configure/csp-onboarding/amazon-web-services-cloud-onboarding/amazon-web-services-provider-permissions.md): List of Amazon Web Services (AWS) permissions for use during Cortex Data Security onboarding to enable continuous monitoring in your cloud environment. - [Microsoft Azure cloud onboarding](https://cortex-docs.paloaltonetworks.com/data-security-documentation/onboard-and-configure/csp-onboarding/microsoft-azure-cloud-onboarding.md) - [Onboard Microsoft Azure](https://cortex-docs.paloaltonetworks.com/data-security-documentation/onboard-and-configure/csp-onboarding/microsoft-azure-cloud-onboarding/onboard-microsoft-azure.md): Follow the Azure onboarding wizard, and Cortex Data Security creates a custom authentication template to be executed in Azure. - [Prerequisites for onboarding Azure](https://cortex-docs.paloaltonetworks.com/data-security-documentation/onboard-and-configure/csp-onboarding/microsoft-azure-cloud-onboarding/prerequisites-for-onboarding-azure.md): Before you begin onboarding Microsoft Azure, you must review the following prerequisites. - [How to onboard Microsoft Azure](https://cortex-docs.paloaltonetworks.com/data-security-documentation/onboard-and-configure/csp-onboarding/microsoft-azure-cloud-onboarding/how-to-onboard-microsoft-azure.md): Follow the Azure onboarding wizard, and Cortex creates a custom authentication template to be executed in Azure. - [Finalize Microsoft Azure onboarding by executing the authentication template](https://cortex-docs.paloaltonetworks.com/data-security-documentation/onboard-and-configure/csp-onboarding/microsoft-azure-cloud-onboarding/finalize-microsoft-azure-onboarding-by-executing-the-authentication-template.md): Learn how to execute the authentication template file in Microsoft Azure for subscriptions, tenants, and management groups. We provide instructions both for applying the Terraform template's configura - [Microsoft Azure offboarding overview](https://cortex-docs.paloaltonetworks.com/data-security-documentation/onboard-and-configure/csp-onboarding/microsoft-azure-cloud-onboarding/microsoft-azure-offboarding-overview.md): This section contains the technical procedures required to safely decommission and offboard your Cortex Data Security resources in Microsoft Azure. - [Offboard Terraform-based Azure deployments (all scopes)](https://cortex-docs.paloaltonetworks.com/data-security-documentation/onboard-and-configure/csp-onboarding/microsoft-azure-cloud-onboarding/microsoft-azure-offboarding-overview/offboard-terraform-based-azure-deployments-all-scopes.md): How to offboard all Terraform-based Microsoft Azure scopes from Cortex Data Security: A step-by-step technical guide to safely running Terraform destroy and cleaning up policy-deployed resources. - [Offboard Azure subscription (ARM)](https://cortex-docs.paloaltonetworks.com/data-security-documentation/onboard-and-configure/csp-onboarding/microsoft-azure-cloud-onboarding/microsoft-azure-offboarding-overview/offboard-azure-subscription-arm.md): How to offboard a Microsoft Azure subscription scope that was onboarded using ARM: A step-by-step technical guide to safely running the interactive offboarding script and cleaning up all resources. - [Offboard Azure management group or tenant scope (ARM)](https://cortex-docs.paloaltonetworks.com/data-security-documentation/onboard-and-configure/csp-onboarding/microsoft-azure-cloud-onboarding/microsoft-azure-offboarding-overview/offboard-azure-management-group-or-tenant-scope-arm.md): How to offboard Microsoft Azure management group or tenant scopes from Cortex Cloud: A step-by-step technical guide to safely removing all Azure resources deployed by Cortex onboarding templates. - [Offboard Azure tenant with Entra ID only](https://cortex-docs.paloaltonetworks.com/data-security-documentation/onboard-and-configure/csp-onboarding/microsoft-azure-cloud-onboarding/microsoft-azure-offboarding-overview/offboard-azure-tenant-with-entra-id-only.md): How to offboard a Microsoft Azure tenant onboarded with the Entra ID only option from Cortex Data Security: A step-by-step technical guide to safely removing deployed resources. - [Microsoft Azure provider permissions](https://cortex-docs.paloaltonetworks.com/data-security-documentation/onboard-and-configure/csp-onboarding/microsoft-azure-cloud-onboarding/microsoft-azure-provider-permissions.md): List of Microsoft Azure permissions for use during Cortex Data Security onboarding to enable continuous monitoring in your cloud environment. - [Google Cloud Platform cloud onboarding](https://cortex-docs.paloaltonetworks.com/data-security-documentation/onboard-and-configure/csp-onboarding/google-cloud-platform-cloud-onboarding.md) - [Onboard Google Cloud Platform](https://cortex-docs.paloaltonetworks.com/data-security-documentation/onboard-and-configure/csp-onboarding/google-cloud-platform-cloud-onboarding/onboard-google-cloud-platform.md): Follow the GCP onboarding wizard, and Cortex creates a custom authentication template to be executed in GCP. - [Prerequisites for onboarding GCP](https://cortex-docs.paloaltonetworks.com/data-security-documentation/onboard-and-configure/csp-onboarding/google-cloud-platform-cloud-onboarding/prerequisites-for-onboarding-gcp.md): Before you begin onboarding GCP, you must review the following prerequisites. - [Required APIs](https://cortex-docs.paloaltonetworks.com/data-security-documentation/onboard-and-configure/csp-onboarding/google-cloud-platform-cloud-onboarding/prerequisites-for-onboarding-gcp/required-apis.md) - [How to onboard Google Cloud Platform](https://cortex-docs.paloaltonetworks.com/data-security-documentation/onboard-and-configure/csp-onboarding/google-cloud-platform-cloud-onboarding/how-to-onboard-google-cloud-platform.md): Follow the GCP onboarding wizard, and Cortex Data Security creates a custom authentication template to be applied in GCP. - [Deploy the Terraform authentication template in GCP](https://cortex-docs.paloaltonetworks.com/data-security-documentation/onboard-and-configure/csp-onboarding/google-cloud-platform-cloud-onboarding/deploy-the-terraform-authentication-template-in-gcp.md): Learn how to deploy the Terraform authentication template in Google Cloud Console. - [Connect Google Workspace with your GCP cloud instance](https://cortex-docs.paloaltonetworks.com/data-security-documentation/onboard-and-configure/csp-onboarding/google-cloud-platform-cloud-onboarding/connect-google-workspace-with-your-gcp-cloud-instance.md) - [Monitor GCP resources inside service perimeters](https://cortex-docs.paloaltonetworks.com/data-security-documentation/onboard-and-configure/csp-onboarding/google-cloud-platform-cloud-onboarding/monitor-gcp-resources-inside-service-perimeters.md): Learn how to grant authorization to Cortex Data Security to scan within your GCP service perimeter. - [Google Cloud Platform (GCP) provider permissions](https://cortex-docs.paloaltonetworks.com/data-security-documentation/onboard-and-configure/csp-onboarding/google-cloud-platform-cloud-onboarding/google-cloud-platform-gcp-provider-permissions.md): List of Google Cloud Platform (GCP) permissions for use during Cortex Data Security onboarding to enable continuous monitoring in your cloud environment. - [Oracle Cloud Infrastructure cloud onboarding](https://cortex-docs.paloaltonetworks.com/data-security-documentation/onboard-and-configure/csp-onboarding/oracle-cloud-infrastructure-cloud-onboarding.md): Follow the Oracle Cloud Infrastructure onboarding wizard and Cortex Data Security creates a custom Terraform authentication template to be deployed in Oracle Cloud Infrastructure. - [Onboard Oracle Cloud Infrastructure](https://cortex-docs.paloaltonetworks.com/data-security-documentation/onboard-and-configure/csp-onboarding/oracle-cloud-infrastructure-cloud-onboarding/onboard-oracle-cloud-infrastructure.md): Follow the OCI onboarding wizard, and Cortex creates a custom authentication template to be executed in OCI. - [Prerequisites for onboarding OCI](https://cortex-docs.paloaltonetworks.com/data-security-documentation/onboard-and-configure/csp-onboarding/oracle-cloud-infrastructure-cloud-onboarding/prerequisites-for-onboarding-oci.md): Before you begin onboarding Oracle Cloud Infrastructure, you must review the following prerequisites. - [How to onboard Oracle Cloud Infrastructure](https://cortex-docs.paloaltonetworks.com/data-security-documentation/onboard-and-configure/csp-onboarding/oracle-cloud-infrastructure-cloud-onboarding/how-to-onboard-oracle-cloud-infrastructure.md): Follow the OCI onboarding wizard and Cortex Data Security creates a custom authentication template to be applied in OCI. - [Deploy the Terraform authentication template in OCI](https://cortex-docs.paloaltonetworks.com/data-security-documentation/onboard-and-configure/csp-onboarding/oracle-cloud-infrastructure-cloud-onboarding/deploy-the-terraform-authentication-template-in-oci.md): Learn how to deploy the Terraform authentication template in Oracle Cloud Infrastructure. - [Oracle Cloud Infrastructure provider permissions](https://cortex-docs.paloaltonetworks.com/data-security-documentation/onboard-and-configure/csp-onboarding/oracle-cloud-infrastructure-cloud-onboarding/oracle-cloud-infrastructure-provider-permissions.md): List of Oracle Cloud Infrastructure (OCI) permissions for use during Cortex Data Security onboarding to enable continuous monitoring in your cloud environment. - [Outpost onboarding](https://cortex-docs.paloaltonetworks.com/data-security-documentation/onboard-and-configure/csp-onboarding/outpost-onboarding.md): Learn about outposts, which are a dedicated set of infrastructure resources that extends the reach of Cortex Data Security into your environment. - [Outpost fundamentals and planning](https://cortex-docs.paloaltonetworks.com/data-security-documentation/onboard-and-configure/csp-onboarding/outpost-onboarding/outpost-fundamentals-and-planning.md): An outpost enables you to have security scans performed on infrastructure in a cloud account owned by you. Learn about outpost fundamentals and what to consider when planning your outpost. - [Outpost creation workflow](https://cortex-docs.paloaltonetworks.com/data-security-documentation/onboard-and-configure/csp-onboarding/outpost-onboarding/outpost-creation-workflow.md): Learn about the creation process for an outposts, which facilitate security scanning performed on infrastructure in a cloud account owned by you. - [Working with standard outposts](https://cortex-docs.paloaltonetworks.com/data-security-documentation/onboard-and-configure/csp-onboarding/outpost-onboarding/working-with-standard-outposts.md): Standard outposts are the recommended way to create dedicated set of infrastructure resources that extends the reach of Cortex Data Security into your environment. - [Create a standard outpost](https://cortex-docs.paloaltonetworks.com/data-security-documentation/onboard-and-configure/csp-onboarding/outpost-onboarding/working-with-standard-outposts/create-a-standard-outpost.md): Instructions for creating a standard outpost while onboarding your CSP. - [Working with Bringing your own Azure app (BYOA) outposts](https://cortex-docs.paloaltonetworks.com/data-security-documentation/onboard-and-configure/csp-onboarding/outpost-onboarding/working-with-bringing-your-own-azure-app-byoa-outposts.md): Using advanced settings while creating your outpost, you can deploy a Cortex Data Security Azure outpost using your own pre-created Entra ID app registration. - [Task 1: Meet the prerequisites for Azure BYOA outposts](https://cortex-docs.paloaltonetworks.com/data-security-documentation/onboard-and-configure/csp-onboarding/outpost-onboarding/working-with-bringing-your-own-azure-app-byoa-outposts/task-1-meet-the-prerequisites-for-azure-byoa-outposts.md): You can customize your own Azure outpost by bringing your own app (BYOA). This page lists the prerequisites that must be met before customizing your outpost in this way. - [Task 2: Create the app registration for the Azure BYOA outpost](https://cortex-docs.paloaltonetworks.com/data-security-documentation/onboard-and-configure/csp-onboarding/outpost-onboarding/working-with-bringing-your-own-azure-app-byoa-outposts/task-2-create-the-app-registration-for-the-azure-byoa-outpost.md): You can customize your own outpost for Azure by bringing your own app (BYOA). This page describes the steps for creating the app registration. - [Task 3: Deploy the Azure BYOA outpost](https://cortex-docs.paloaltonetworks.com/data-security-documentation/onboard-and-configure/csp-onboarding/outpost-onboarding/working-with-bringing-your-own-azure-app-byoa-outposts/task-3-deploy-the-azure-byoa-outpost.md): You can customize your own outpost by bringing your own app (BYOA). This page describes the steps for deploying the Azure BYOA outpost. - [Task 4: Verify the BYOA outpost deployment](https://cortex-docs.paloaltonetworks.com/data-security-documentation/onboard-and-configure/csp-onboarding/outpost-onboarding/working-with-bringing-your-own-azure-app-byoa-outposts/task-4-verify-the-byoa-outpost-deployment.md): You can customize your own Azure outpost by bringing your own app (BYOA). This page describes the steps for verifying your BYOA outpost deployment. - [The shell script for Azure app registration](https://cortex-docs.paloaltonetworks.com/data-security-documentation/onboard-and-configure/csp-onboarding/outpost-onboarding/working-with-bringing-your-own-azure-app-byoa-outposts/the-shell-script-for-azure-app-registration.md) - [Outpost troubleshooting](https://cortex-docs.paloaltonetworks.com/data-security-documentation/onboard-and-configure/csp-onboarding/outpost-onboarding/outpost-troubleshooting.md): Check here for solutions to issues that might occur while configuring, deploying, and operating outposts. - [Outpost Cloud Service Provider (CSP) permissions](https://cortex-docs.paloaltonetworks.com/data-security-documentation/onboard-and-configure/csp-onboarding/outpost-onboarding/outpost-cloud-service-provider-csp-permissions.md): This page lists and explains the various roles and permissions needed for working with resources for outposts by CSP. - [Amazon Web Services (AWS) outpost permissions](https://cortex-docs.paloaltonetworks.com/data-security-documentation/onboard-and-configure/csp-onboarding/outpost-onboarding/outpost-cloud-service-provider-csp-permissions/amazon-web-services-aws-outpost-permissions.md): List of Amazon Web Services (AWS) permissions for use during Cortex Data Security outpost onboarding to enable continuous monitoring in your cloud environment. - [Microsoft Azure outpost permissions](https://cortex-docs.paloaltonetworks.com/data-security-documentation/onboard-and-configure/csp-onboarding/outpost-onboarding/outpost-cloud-service-provider-csp-permissions/microsoft-azure-outpost-permissions.md): List of Microsoft Azure provider outpost permissions for Cortex Data Security. - [Google Cloud Platform (GCP) outpost permissions](https://cortex-docs.paloaltonetworks.com/data-security-documentation/onboard-and-configure/csp-onboarding/outpost-onboarding/outpost-cloud-service-provider-csp-permissions/google-cloud-platform-gcp-outpost-permissions.md): List of Google Cloud Platform (GCP) permissions for use during Cortex Data Security onboarding outposts to enable continuous monitoring in your cloud environment. - [Manually connect a cloud instance](https://cortex-docs.paloaltonetworks.com/data-security-documentation/onboard-and-configure/csp-onboarding/manually-connect-a-cloud-instance-fix-tables.md) - [Manage cloud instances](https://cortex-docs.paloaltonetworks.com/data-security-documentation/onboard-and-configure/csp-onboarding/manage-cloud-instances.md) - [Pending cloud instances](https://cortex-docs.paloaltonetworks.com/data-security-documentation/onboard-and-configure/csp-onboarding/pending-cloud-instances.md) - [Edit your onboarded CSP configuration](https://cortex-docs.paloaltonetworks.com/data-security-documentation/onboard-and-configure/csp-onboarding/edit-your-onboarded-csp-configuration.md) - [Update cloud permissions after Cortex release updates](https://cortex-docs.paloaltonetworks.com/data-security-documentation/onboard-and-configure/csp-onboarding/update-cloud-permissions-after-cortex-release-updates.md) - [Troubleshoot errors on cloud instances](https://cortex-docs.paloaltonetworks.com/data-security-documentation/onboard-and-configure/csp-onboarding/troubleshoot-errors-on-cloud-instances.md) - [Introduction to Terraform for Cloud service provider (CSP) onboarding](https://cortex-docs.paloaltonetworks.com/data-security-documentation/onboard-and-configure/csp-onboarding/introduction-to-terraform-for-cloud-service-provider-csp-onboarding.md) - [Cloud service provider permissions](https://cortex-docs.paloaltonetworks.com/data-security-documentation/onboard-and-configure/csp-onboarding/cloud-service-provider-permissions.md) - [FedRAMP onboarding](https://cortex-docs.paloaltonetworks.com/data-security-documentation/onboard-and-configure/fedramp-onboarding.md) - [Cortex Data Security federal compliance](https://cortex-docs.paloaltonetworks.com/data-security-documentation/onboard-and-configure/fedramp-onboarding/cortex-cloud-federal-compliance.md) - [Onboarding & configuration](https://cortex-docs.paloaltonetworks.com/data-security-documentation/onboard-and-configure/fedramp-onboarding/onboarding-and-configuration.md) - [Limitations & supported regions](https://cortex-docs.paloaltonetworks.com/data-security-documentation/onboard-and-configure/fedramp-onboarding/limitations-and-supported-regions.md) - [Post-onboarding](https://cortex-docs.paloaltonetworks.com/data-security-documentation/onboard-and-configure/post-onboarding.md) - [How to configure the scanning settings for supported services](https://cortex-docs.paloaltonetworks.com/data-security-documentation/onboard-and-configure/post-onboarding/how-to-configure-the-scanning-settings-for-supported-services.md) - [How to review errors in Cortex Data Security](https://cortex-docs.paloaltonetworks.com/data-security-documentation/onboard-and-configure/post-onboarding/how-to-review-errors-in-cortex-data-security.md) - [Cortex MCP Server](https://cortex-docs.paloaltonetworks.com/data-security-documentation/onboard-and-configure/post-onboarding/cortex-mcp-server.md) - [Broker VM](https://cortex-docs.paloaltonetworks.com/data-security-documentation/data-management/broker-vm.md) - [What is the Broker VM?](https://cortex-docs.paloaltonetworks.com/data-security-documentation/data-management/broker-vm/what-is-the-broker-vm.md) - [Set up and configure Broker VM](https://cortex-docs.paloaltonetworks.com/data-security-documentation/data-management/broker-vm/set-up-and-configure-broker-vm.md) - [Broker VM image installations](https://cortex-docs.paloaltonetworks.com/data-security-documentation/data-management/broker-vm/set-up-and-configure-broker-vm/broker-vm-image-installations.md) - [Set up Broker VM on Alibaba Cloud](https://cortex-docs.paloaltonetworks.com/data-security-documentation/data-management/broker-vm/set-up-and-configure-broker-vm/broker-vm-image-installations/set-up-broker-vm-on-alibaba-cloud.md) - [Set up Broker VM on Amazon Web Services](https://cortex-docs.paloaltonetworks.com/data-security-documentation/data-management/broker-vm/set-up-and-configure-broker-vm/broker-vm-image-installations/set-up-broker-vm-on-amazon-web-services.md) - [Set up Broker VM on Google Cloud Platform (GCP)](https://cortex-docs.paloaltonetworks.com/data-security-documentation/data-management/broker-vm/set-up-and-configure-broker-vm/broker-vm-image-installations/set-up-broker-vm-on-google-cloud-platform-gcp.md) - [Set up Broker VM on KVM using Ubuntu](https://cortex-docs.paloaltonetworks.com/data-security-documentation/data-management/broker-vm/set-up-and-configure-broker-vm/broker-vm-image-installations/set-up-broker-vm-on-kvm-using-ubuntu.md) - [Set up Broker VM on Microsoft Azure](https://cortex-docs.paloaltonetworks.com/data-security-documentation/data-management/broker-vm/set-up-and-configure-broker-vm/broker-vm-image-installations/set-up-broker-vm-on-microsoft-azure.md) - [Set up Broker VM on Microsoft Hyper-V](https://cortex-docs.paloaltonetworks.com/data-security-documentation/data-management/broker-vm/set-up-and-configure-broker-vm/broker-vm-image-installations/set-up-broker-vm-on-microsoft-hyper-v.md) - [Set up Broker VM on Nutanix Hypervisor](https://cortex-docs.paloaltonetworks.com/data-security-documentation/data-management/broker-vm/set-up-and-configure-broker-vm/broker-vm-image-installations/set-up-broker-vm-on-nutanix-hypervisor.md) - [Set up Broker VM on VMware ESXi using vSphere Client](https://cortex-docs.paloaltonetworks.com/data-security-documentation/data-management/broker-vm/set-up-and-configure-broker-vm/broker-vm-image-installations/set-up-broker-vm-on-vmware-esxi-using-vsphere-client.md) - [Broker VM data collector applets](https://cortex-docs.paloaltonetworks.com/data-security-documentation/data-management/broker-vm/set-up-and-configure-broker-vm/broker-vm-data-collector-applets.md) - [Manage Broker VM](https://cortex-docs.paloaltonetworks.com/data-security-documentation/data-management/broker-vm/manage-broker-vm.md) - [Edit Broker VM Configuration](https://cortex-docs.paloaltonetworks.com/data-security-documentation/data-management/broker-vm/manage-broker-vm/edit-broker-vm-configuration.md) - [Increase Broker VM storage allocated for data caching](https://cortex-docs.paloaltonetworks.com/data-security-documentation/data-management/broker-vm/manage-broker-vm/increase-broker-vm-storage-allocated-for-data-caching.md) - [Monitor Broker VM using Prometheus](https://cortex-docs.paloaltonetworks.com/data-security-documentation/data-management/broker-vm/manage-broker-vm/monitor-broker-vm-using-prometheus.md) - [Collect Broker VM Logs](https://cortex-docs.paloaltonetworks.com/data-security-documentation/data-management/broker-vm/manage-broker-vm/collect-broker-vm-logs.md) - [Upgrade Broker VM](https://cortex-docs.paloaltonetworks.com/data-security-documentation/data-management/broker-vm/manage-broker-vm/upgrade-broker-vm.md) - [Update Broker VM applets independently](https://cortex-docs.paloaltonetworks.com/data-security-documentation/data-management/broker-vm/manage-broker-vm/update-broker-vm-applets-independently.md) - [Import Broker VM Configuration](https://cortex-docs.paloaltonetworks.com/data-security-documentation/data-management/broker-vm/manage-broker-vm/import-broker-vm-configuration.md) - [Open Live Terminal](https://cortex-docs.paloaltonetworks.com/data-security-documentation/data-management/broker-vm/manage-broker-vm/open-live-terminal.md) - [Add Broker VM to cluster](https://cortex-docs.paloaltonetworks.com/data-security-documentation/data-management/broker-vm/manage-broker-vm/add-broker-vm-to-cluster.md) - [Switchover Primary Node in Cluster](https://cortex-docs.paloaltonetworks.com/data-security-documentation/data-management/broker-vm/manage-broker-vm/switchover-primary-node-in-cluster.md) - [Remove from Cluster](https://cortex-docs.paloaltonetworks.com/data-security-documentation/data-management/broker-vm/manage-broker-vm/remove-from-cluster.md) - [Manage Broker VM data collector applets](https://cortex-docs.paloaltonetworks.com/data-security-documentation/data-management/broker-vm/manage-broker-vm-data-collector-applets.md) - [Broker VM High Availability Cluster](https://cortex-docs.paloaltonetworks.com/data-security-documentation/data-management/broker-vm/broker-vm-high-availability-cluster.md) - [Configure High Availability Cluster](https://cortex-docs.paloaltonetworks.com/data-security-documentation/data-management/broker-vm/broker-vm-high-availability-cluster/configure-high-availability-cluster.md) - [Manage Broker VM clusters](https://cortex-docs.paloaltonetworks.com/data-security-documentation/data-management/broker-vm/broker-vm-high-availability-cluster/manage-broker-vm-clusters.md) - [View cluster details](https://cortex-docs.paloaltonetworks.com/data-security-documentation/data-management/broker-vm/broker-vm-high-availability-cluster/manage-broker-vm-clusters/view-cluster-details.md) - [Edit cluster](https://cortex-docs.paloaltonetworks.com/data-security-documentation/data-management/broker-vm/broker-vm-high-availability-cluster/manage-broker-vm-clusters/edit-cluster.md) - [Add applet to cluster](https://cortex-docs.paloaltonetworks.com/data-security-documentation/data-management/broker-vm/broker-vm-high-availability-cluster/manage-broker-vm-clusters/add-applet-to-cluster.md) - [Add Broker VM to cluster](https://cortex-docs.paloaltonetworks.com/data-security-documentation/data-management/broker-vm/broker-vm-high-availability-cluster/manage-broker-vm-clusters/add-broker-vm-to-cluster.md) - [Remove cluster](https://cortex-docs.paloaltonetworks.com/data-security-documentation/data-management/broker-vm/broker-vm-high-availability-cluster/manage-broker-vm-clusters/remove-cluster.md) - [Broker VM notifications](https://cortex-docs.paloaltonetworks.com/data-security-documentation/data-management/broker-vm/broker-vm-notifications.md) - [Monitor Broker VM activity](https://cortex-docs.paloaltonetworks.com/data-security-documentation/data-management/broker-vm/monitor-broker-vm-activity.md) - [Troubleshoot Broker VM applet errors](https://cortex-docs.paloaltonetworks.com/data-security-documentation/data-management/broker-vm/troubleshoot-broker-vm-applet-errors.md) - [Dataset management](https://cortex-docs.paloaltonetworks.com/data-security-documentation/data-management/dataset-management.md): Learn more about managing your datasets and understanding your overall data storage, period-based retention. - [What are datasets?](https://cortex-docs.paloaltonetworks.com/data-security-documentation/data-management/dataset-management/what-are-datasets.md): Learn how to import, delete, and interact with custom or third-party datasets in Cortex Data Security. - [Lookup datasets](https://cortex-docs.paloaltonetworks.com/data-security-documentation/data-management/dataset-management/lookup-datasets.md): Learn more about lookup datasets to correlate data from a data source with events in your environment. - [Import a lookup dataset](https://cortex-docs.paloaltonetworks.com/data-security-documentation/data-management/dataset-management/lookup-datasets/import-a-lookup-dataset.md) - [Download JSON file of lookup dataset](https://cortex-docs.paloaltonetworks.com/data-security-documentation/data-management/dataset-management/lookup-datasets/download-json-file-of-lookup-dataset.md) - [Set time to live for lookup datasets](https://cortex-docs.paloaltonetworks.com/data-security-documentation/data-management/dataset-management/lookup-datasets/set-time-to-live-for-lookup-datasets.md) - [Monitor datasets and dataset views activity](https://cortex-docs.paloaltonetworks.com/data-security-documentation/data-management/dataset-management/monitor-datasets-and-dataset-views-activity.md): Learn more about the monitored Cortex Data Security datasets and dataset views activities. - [Manage compute units](https://cortex-docs.paloaltonetworks.com/data-security-documentation/data-management/manage-compute-units.md): Learn more about managing and tracking your compute units usage for API and Cold Storage XQL queries. - [Compute units usage](https://cortex-docs.paloaltonetworks.com/data-security-documentation/data-management/manage-compute-units/compute-units-usage.md): Learn more about how to compute units CU) works according to your license and available options after reaching your quota. - [What are Cortex Data Security data sources and connectors?](https://cortex-docs.paloaltonetworks.com/data-security-documentation/cortex-data-security-data-sources-and-connectors/what-are-cortex-data-security-data-sources-and-connectors.md): Learn more about Cortex Data Security data sources and connectors with a unified approach to integrations. - [What is the data source and connector catalog?](https://cortex-docs.paloaltonetworks.com/data-security-documentation/cortex-data-security-data-sources-and-connectors/what-is-the-data-source-and-connector-catalog.md): Learn more about the complete data source and connector catalog available in Cortex Data Security. - [Vendor-specific data sources and connectors](https://cortex-docs.paloaltonetworks.com/data-security-documentation/cortex-data-security-data-sources-and-connectors/vendor-specific-data-sources-and-connectors.md): Browse vendor-specific data sources and connectors for Cortex Data Security. - [Amazon](https://cortex-docs.paloaltonetworks.com/data-security-documentation/cortex-data-security-data-sources-and-connectors/vendor-specific-data-sources-and-connectors/amazon.md): Configure the Amazon data source for Cortex Data Security. - [Amazon Web Services](https://cortex-docs.paloaltonetworks.com/data-security-documentation/cortex-data-security-data-sources-and-connectors/vendor-specific-data-sources-and-connectors/amazon/amazon-web-services.md): Use Amazon Web Services in Cortex Data Security. - [Anthropic](https://cortex-docs.paloaltonetworks.com/data-security-documentation/cortex-data-security-data-sources-and-connectors/vendor-specific-data-sources-and-connectors/anthropic.md): Configure the Anthropic connector for Cortex XSIAM. - [Claude](https://cortex-docs.paloaltonetworks.com/data-security-documentation/cortex-data-security-data-sources-and-connectors/vendor-specific-data-sources-and-connectors/anthropic/claude.md): Use Claude with Cortex Data Security. - [Atlassian](https://cortex-docs.paloaltonetworks.com/data-security-documentation/cortex-data-security-data-sources-and-connectors/vendor-specific-data-sources-and-connectors/atlassian.md): Configure the Atlassian connector for Cortex Data Security. - [Atlassian](https://cortex-docs.paloaltonetworks.com/data-security-documentation/cortex-data-security-data-sources-and-connectors/vendor-specific-data-sources-and-connectors/atlassian/atlassian.md): Use Atlassian data with Cortex Data Security. - [Box](https://cortex-docs.paloaltonetworks.com/data-security-documentation/cortex-data-security-data-sources-and-connectors/vendor-specific-data-sources-and-connectors/box.md): Configure the Box data source for Cortex Data Security. - [Ingest logs and data from Box](https://cortex-docs.paloaltonetworks.com/data-security-documentation/cortex-data-security-data-sources-and-connectors/vendor-specific-data-sources-and-connectors/box/ingest-logs-and-data-from-box.md): Collect Box data from Cortex Data Security. - [Databricks](https://cortex-docs.paloaltonetworks.com/data-security-documentation/cortex-data-security-data-sources-and-connectors/vendor-specific-data-sources-and-connectors/databricks.md): Configure the Databricks data source and connector for Cortex Data Security. - [How to onboard Databricks](https://cortex-docs.paloaltonetworks.com/data-security-documentation/cortex-data-security-data-sources-and-connectors/vendor-specific-data-sources-and-connectors/databricks/how-to-onboard-databricks.md): Collect Databricks data in Cortex Data Security. - [Databricks](https://cortex-docs.paloaltonetworks.com/data-security-documentation/cortex-data-security-data-sources-and-connectors/vendor-specific-data-sources-and-connectors/databricks/databricks.md): Use Databricks data with Cortex Data Security. - [Dropbox](https://cortex-docs.paloaltonetworks.com/data-security-documentation/cortex-data-security-data-sources-and-connectors/vendor-specific-data-sources-and-connectors/dropbox.md): Configure the Dropbox data source for Cortex Data Security. - [Ingest logs and data from Dropbox](https://cortex-docs.paloaltonetworks.com/data-security-documentation/cortex-data-security-data-sources-and-connectors/vendor-specific-data-sources-and-connectors/dropbox/ingest-logs-and-data-from-dropbox.md): Collect dropbox data in Cortex Data Security. - [Google](https://cortex-docs.paloaltonetworks.com/data-security-documentation/cortex-data-security-data-sources-and-connectors/vendor-specific-data-sources-and-connectors/google.md): Configure the Google data source and connector for Cortex Data Security. - [Google Workspace](https://cortex-docs.paloaltonetworks.com/data-security-documentation/cortex-data-security-data-sources-and-connectors/vendor-specific-data-sources-and-connectors/google/google-workspace.md): Use Google Workspace data with Cortex Data Security. - [Ingest logs and data from Google Workspace](https://cortex-docs.paloaltonetworks.com/data-security-documentation/cortex-data-security-data-sources-and-connectors/vendor-specific-data-sources-and-connectors/google/google-workspace/ingest-logs-and-data-from-google-workspace.md): Collect Google Workspace data with Cortex Data Security. - [Google Workspace connector](https://cortex-docs.paloaltonetworks.com/data-security-documentation/cortex-data-security-data-sources-and-connectors/vendor-specific-data-sources-and-connectors/google/google-workspace/google-workspace-connector.md): Use Google Workspace with Cortex Data Security. - [Microsoft](https://cortex-docs.paloaltonetworks.com/data-security-documentation/cortex-data-security-data-sources-and-connectors/vendor-specific-data-sources-and-connectors/microsoft.md): Configure the Microsoft data sources and connectors for Cortex Data Security. - [Microsoft Azure](https://cortex-docs.paloaltonetworks.com/data-security-documentation/cortex-data-security-data-sources-and-connectors/vendor-specific-data-sources-and-connectors/microsoft/microsoft-azure.md): Use Microsoft Azure data with Cortex Data Security. - [Microsoft Entra ID](https://cortex-docs.paloaltonetworks.com/data-security-documentation/cortex-data-security-data-sources-and-connectors/vendor-specific-data-sources-and-connectors/microsoft/microsoft-entra-id.md): Use Microsoft Entra ID data with Cortex Data Security. - [Microsoft Office 365](https://cortex-docs.paloaltonetworks.com/data-security-documentation/cortex-data-security-data-sources-and-connectors/vendor-specific-data-sources-and-connectors/microsoft/microsoft-office-365.md): Use Microsoft Office 365 data with Cortex Data Security. - [Ingest logs from Microsoft Office 365](https://cortex-docs.paloaltonetworks.com/data-security-documentation/cortex-data-security-data-sources-and-connectors/vendor-specific-data-sources-and-connectors/microsoft/microsoft-office-365/ingest-logs-from-microsoft-office-365.md): Collect Microsoft Office 365 data with Cortex Data Security. - [Microsoft 365 (new)](https://cortex-docs.paloaltonetworks.com/data-security-documentation/cortex-data-security-data-sources-and-connectors/vendor-specific-data-sources-and-connectors/microsoft/microsoft-office-365/microsoft-365-new.md): Use Microsoft 365 data with Cortex Data Security. - [Create a Microsoft Entra ID](https://cortex-docs.paloaltonetworks.com/data-security-documentation/cortex-data-security-data-sources-and-connectors/vendor-specific-data-sources-and-connectors/microsoft/microsoft-office-365/microsoft-365-new/create-a-microsoft-entra-id.md): Learn more about creating a Microsoft Entra ID. - [Microsoft365 (legacy)](https://cortex-docs.paloaltonetworks.com/data-security-documentation/cortex-data-security-data-sources-and-connectors/vendor-specific-data-sources-and-connectors/microsoft/microsoft-office-365/microsoft365-legacy.md): Use Microsoft365 data with Cortex Data Security. - [Migrate to new Microsoft 365 connector](https://cortex-docs.paloaltonetworks.com/data-security-documentation/cortex-data-security-data-sources-and-connectors/vendor-specific-data-sources-and-connectors/microsoft/microsoft-office-365/microsoft365-legacy/migrate-to-new-microsoft-365-connector.md) - [Microsoft Security](https://cortex-docs.paloaltonetworks.com/data-security-documentation/cortex-data-security-data-sources-and-connectors/vendor-specific-data-sources-and-connectors/microsoft/microsoft-security.md): Use Microsoft Security data with Cortex Data Security. - [Microsoft Teams](https://cortex-docs.paloaltonetworks.com/data-security-documentation/cortex-data-security-data-sources-and-connectors/vendor-specific-data-sources-and-connectors/microsoft/microsoft-teams.md): Use Microsoft Teams data with Cortex Data Security. - [MongoDB](https://cortex-docs.paloaltonetworks.com/data-security-documentation/cortex-data-security-data-sources-and-connectors/vendor-specific-data-sources-and-connectors/mongodb.md): Configure the MongoDB data source and connector for Cortex Data Security. - [How to onboard MongoDB Atlas (Posture)](https://cortex-docs.paloaltonetworks.com/data-security-documentation/cortex-data-security-data-sources-and-connectors/vendor-specific-data-sources-and-connectors/mongodb/how-to-onboard-mongodb-atlas.md): Use MongoDB Atlas (Posture) data with Cortex Data Security. - [MongoDB Atlas](https://cortex-docs.paloaltonetworks.com/data-security-documentation/cortex-data-security-data-sources-and-connectors/vendor-specific-data-sources-and-connectors/mongodb/mongodb-atlas.md): Use MongoDB Atlas data with Cortex Data Security. - [Okta](https://cortex-docs.paloaltonetworks.com/data-security-documentation/cortex-data-security-data-sources-and-connectors/vendor-specific-data-sources-and-connectors/okta.md): Configure the Okta data source for Cortex Data Security. - [Ingest logs and data from Okta](https://cortex-docs.paloaltonetworks.com/data-security-documentation/cortex-data-security-data-sources-and-connectors/vendor-specific-data-sources-and-connectors/okta/ingest-logs-and-data-from-okta.md): Configure Okta log and data collection for Cortex Data Security. - [OneLogin](https://cortex-docs.paloaltonetworks.com/data-security-documentation/cortex-data-security-data-sources-and-connectors/vendor-specific-data-sources-and-connectors/onelogin.md): Configure the OneLogin data source for Cortex Data Security. - [Ingest logs and data from OneLogin](https://cortex-docs.paloaltonetworks.com/data-security-documentation/cortex-data-security-data-sources-and-connectors/vendor-specific-data-sources-and-connectors/onelogin/ingest-logs-and-data-from-onelogin.md): Configure OneLogin log and directory data collection for Cortex Data Security. - [Oracle](https://cortex-docs.paloaltonetworks.com/data-security-documentation/cortex-data-security-data-sources-and-connectors/vendor-specific-data-sources-and-connectors/oracle.md): Configure the Oracle data source for Cortex Data Security. - [Oracle Cloud Infrastructure](https://cortex-docs.paloaltonetworks.com/data-security-documentation/cortex-data-security-data-sources-and-connectors/vendor-specific-data-sources-and-connectors/oracle/oracle-cloud-infrastructure.md): Configure Oracle Cloud Infrastructure data source for Cortex Data Security. - [Ping Identity](https://cortex-docs.paloaltonetworks.com/data-security-documentation/cortex-data-security-data-sources-and-connectors/vendor-specific-data-sources-and-connectors/ping-identity.md): Configure the Ping Identity data source for Cortex Data Security. - [PingOne](https://cortex-docs.paloaltonetworks.com/data-security-documentation/cortex-data-security-data-sources-and-connectors/vendor-specific-data-sources-and-connectors/ping-identity/pingone.md): Configure PingOne data source for Cortex Data Security. - [Ingest authentication logs and data from PingOne](https://cortex-docs.paloaltonetworks.com/data-security-documentation/cortex-data-security-data-sources-and-connectors/vendor-specific-data-sources-and-connectors/ping-identity/pingone/ingest-authentication-logs-and-data-from-pingone.md): Ingest PingOne authentication logs and data into Cortex Data Security. - [Salesforce](https://cortex-docs.paloaltonetworks.com/data-security-documentation/cortex-data-security-data-sources-and-connectors/vendor-specific-data-sources-and-connectors/salesforce.md): Configure the Salesforce data source and connector for Cortex Data Security. - [Ingest logs and data from Salesforce](https://cortex-docs.paloaltonetworks.com/data-security-documentation/cortex-data-security-data-sources-and-connectors/vendor-specific-data-sources-and-connectors/salesforce/ingest-logs-and-data-from-salesforce.md): Ingest Salesforce logs and data into Cortex Data Security. - [Salesforce connector](https://cortex-docs.paloaltonetworks.com/data-security-documentation/cortex-data-security-data-sources-and-connectors/vendor-specific-data-sources-and-connectors/salesforce/ingest-and-run-salesforce-automation-and-remediation.md): Use Salesforce data in Cortex Data Security. - [ServiceNow](https://cortex-docs.paloaltonetworks.com/data-security-documentation/cortex-data-security-data-sources-and-connectors/vendor-specific-data-sources-and-connectors/servicenow.md): Configure the ServiceNow connector for Cortex Data Security. - [ServiceNow](https://cortex-docs.paloaltonetworks.com/data-security-documentation/cortex-data-security-data-sources-and-connectors/vendor-specific-data-sources-and-connectors/servicenow/servicenow.md): Use ServiceNow data in Cortex Data Security. - [Slack](https://cortex-docs.paloaltonetworks.com/data-security-documentation/cortex-data-security-data-sources-and-connectors/vendor-specific-data-sources-and-connectors/slack.md): Configure the Slack connector for Cortex Data Security. - [Slack Enterprise](https://cortex-docs.paloaltonetworks.com/data-security-documentation/cortex-data-security-data-sources-and-connectors/vendor-specific-data-sources-and-connectors/slack/slack-enterprise.md): Configure Slack Enterprise identity and SaaS posture monitoring for Cortex Data Security. - [Snowflake](https://cortex-docs.paloaltonetworks.com/data-security-documentation/cortex-data-security-data-sources-and-connectors/vendor-specific-data-sources-and-connectors/snowflake.md): Configure the Snowflake data source for Cortex Data Security. - [How to onboard Snowflake](https://cortex-docs.paloaltonetworks.com/data-security-documentation/cortex-data-security-data-sources-and-connectors/vendor-specific-data-sources-and-connectors/snowflake/how-to-onboard-snowflake.md): Onboard Snowflake as a data source in Cortex Data Security. - [Connectors](https://cortex-docs.paloaltonetworks.com/data-security-documentation/cortex-data-security-data-sources-and-connectors/connectors.md): Configure connectors that collect and enrich data in Cortex Data Security. - [Standard data sources](https://cortex-docs.paloaltonetworks.com/data-security-documentation/cortex-data-security-data-sources-and-connectors/standard-data-sources.md): Configure standard data sources to ingest telemetry into Cortex Data Security. - [Cloud service provider (CSP) onboarding](https://cortex-docs.paloaltonetworks.com/data-security-documentation/cortex-data-security-data-sources-and-connectors/cloud-service-provider-csp-onboarding.md): Learn about onboarding your cloud service provider to Cortex Data Security. - [Generic on-premise data collectors](https://cortex-docs.paloaltonetworks.com/data-security-documentation/cortex-data-security-data-sources-and-connectors/generic-on-premise-data-collectors.md): Configure generic on-premise data collectors for Cortex Data Security. - [Broker VM data collector applets](https://cortex-docs.paloaltonetworks.com/data-security-documentation/cortex-data-security-data-sources-and-connectors/generic-on-premise-data-collectors/broker-vm-data-collector-applets.md): Configure Broker VM data collector applets for Cortex Data Security. - [Activate DSPM Database](https://cortex-docs.paloaltonetworks.com/data-security-documentation/cortex-data-security-data-sources-and-connectors/generic-on-premise-data-collectors/broker-vm-data-collector-applets/activate-dspm-database.md): Configure the DSPM Database applet for Cortex Data Security. - [Activate DSPM Fileshare](https://cortex-docs.paloaltonetworks.com/data-security-documentation/cortex-data-security-data-sources-and-connectors/generic-on-premise-data-collectors/broker-vm-data-collector-applets/activate-dspm-fileshare.md): Configure the DSPM Fileshare applet for Cortex Data Security. - [Activate Transporter](https://cortex-docs.paloaltonetworks.com/data-security-documentation/cortex-data-security-data-sources-and-connectors/generic-on-premise-data-collectors/broker-vm-data-collector-applets/activate-transporter.md): Configure Transporter applet for Cortex Data Security. - [Administration and troubleshooting](https://cortex-docs.paloaltonetworks.com/data-security-documentation/cortex-data-security-data-sources-and-connectors/administration-and-troubleshooting.md): Learn more about the administration and troubleshooting of the different data collector integrations in Cortex Cloud. - [Manage instances](https://cortex-docs.paloaltonetworks.com/data-security-documentation/cortex-data-security-data-sources-and-connectors/administration-and-troubleshooting/manage-instances.md) - [Add a new data source or instance](https://cortex-docs.paloaltonetworks.com/data-security-documentation/cortex-data-security-data-sources-and-connectors/administration-and-troubleshooting/manage-instances/add-a-new-data-source-or-instance.md) - [How to configure the scanning settings for supported services](https://cortex-docs.paloaltonetworks.com/data-security-documentation/cortex-data-security-data-sources-and-connectors/administration-and-troubleshooting/manage-instances/how-to-configure-the-scanning-settings-for-supported-services.md) - [Manage cloud instances](https://cortex-docs.paloaltonetworks.com/data-security-documentation/cortex-data-security-data-sources-and-connectors/administration-and-troubleshooting/manage-instances/manage-cloud-instances.md): Manage cloud instances connected to Cortex Data Security. - [Update cloud permissions after Cortex release updates](https://cortex-docs.paloaltonetworks.com/data-security-documentation/cortex-data-security-data-sources-and-connectors/administration-and-troubleshooting/manage-instances/update-cloud-permissions-after-cortex-release-updates.md): Update cloud permissions after Cortex Data Security releases. - [Pending cloud instances](https://cortex-docs.paloaltonetworks.com/data-security-documentation/cortex-data-security-data-sources-and-connectors/administration-and-troubleshooting/manage-instances/pending-cloud-instances.md): Review pending cloud instances in Cortex Data Security. - [Troubleshoot errors on cloud instances](https://cortex-docs.paloaltonetworks.com/data-security-documentation/cortex-data-security-data-sources-and-connectors/administration-and-troubleshooting/manage-instances/troubleshoot-errors-on-cloud-instances.md): Troubleshoot errors on cloud instances in Cortex Data Security. - [Manage Kubernetes Connector instances](https://cortex-docs.paloaltonetworks.com/data-security-documentation/cortex-data-security-data-sources-and-connectors/administration-and-troubleshooting/manage-instances/manage-kubernetes-connector-instances.md): Manage Kubernetes Connector instances in Cortex Data Security. - [Integrations](https://cortex-docs.paloaltonetworks.com/data-security-documentation/cortex-data-security-data-sources-and-connectors/administration-and-troubleshooting/integrations.md): Manage and configure integrations in Cortex Data Security. - [Add an integration instance](https://cortex-docs.paloaltonetworks.com/data-security-documentation/cortex-data-security-data-sources-and-connectors/administration-and-troubleshooting/integrations/add-an-integration-instance.md): Add and configure an integration instance in Cortex Data Security. - [Configure integration permissions](https://cortex-docs.paloaltonetworks.com/data-security-documentation/cortex-data-security-data-sources-and-connectors/administration-and-troubleshooting/integrations/configure-integration-permissions.md): Configure permissions for integrations in Cortex Data Security. - [Troubleshoot Integrations](https://cortex-docs.paloaltonetworks.com/data-security-documentation/cortex-data-security-data-sources-and-connectors/administration-and-troubleshooting/integrations/troubleshoot-integrations.md): Troubleshoot integration issues in Cortex Data Security. - [Verify collector connectivity](https://cortex-docs.paloaltonetworks.com/data-security-documentation/cortex-data-security-data-sources-and-connectors/administration-and-troubleshooting/verify-collector-connectivity.md): Check collector connection status, investigate errors, and track connectivity changes in Cortex Data Security. - [About health issues](https://cortex-docs.paloaltonetworks.com/data-security-documentation/cortex-data-security-data-sources-and-connectors/administration-and-troubleshooting/about-health-issues.md): Understand Cortex Data Security health issues, their types, and how to view and investigate them. - [Investigate and resolve health issues](https://cortex-docs.paloaltonetworks.com/data-security-documentation/cortex-data-security-data-sources-and-connectors/administration-and-troubleshooting/about-health-issues/investigate-and-resolve-health-issues.md): Investigate and resolve ingestion, collection, correlation, and automation health issues in Cortex Data Security. - [Monitor data ingestion health (BETA)](https://cortex-docs.paloaltonetworks.com/data-security-documentation/cortex-data-security-data-sources-and-connectors/administration-and-troubleshooting/about-health-issues/monitor-data-ingestion-health.md): Monitor data ingestion health using metrics, custom rules, and built-in issue detection in Cortex Data Security. - [Asset management](https://cortex-docs.paloaltonetworks.com/data-security-documentation/inventory-and-monitoring/asset-management.md) - [Data Inventory](https://cortex-docs.paloaltonetworks.com/data-security-documentation/inventory-and-monitoring/asset-management/data-inventory.md) - [Dashboards and reports](https://cortex-docs.paloaltonetworks.com/data-security-documentation/inventory-and-monitoring/dashboards-and-reports.md) - [Overview of dashboards and reports](https://cortex-docs.paloaltonetworks.com/data-security-documentation/inventory-and-monitoring/dashboards-and-reports/overview-of-dashboards-and-reports.md) - [Dashboard interface basics](https://cortex-docs.paloaltonetworks.com/data-security-documentation/inventory-and-monitoring/dashboards-and-reports/overview-of-dashboards-and-reports/dashboard-interface-basics.md) - [Dashboard types](https://cortex-docs.paloaltonetworks.com/data-security-documentation/inventory-and-monitoring/dashboards-and-reports/overview-of-dashboards-and-reports/dashboard-types.md) - [Report basics](https://cortex-docs.paloaltonetworks.com/data-security-documentation/inventory-and-monitoring/dashboards-and-reports/overview-of-dashboards-and-reports/report-basics.md) - [Widget Library](https://cortex-docs.paloaltonetworks.com/data-security-documentation/inventory-and-monitoring/dashboards-and-reports/overview-of-dashboards-and-reports/widget-library.md) - [Data Security dashboards](https://cortex-docs.paloaltonetworks.com/data-security-documentation/inventory-and-monitoring/dashboards-and-reports/data-security-dashboards.md) - [Cortex Data Security Command Center](https://cortex-docs.paloaltonetworks.com/data-security-documentation/inventory-and-monitoring/dashboards-and-reports/data-security-dashboards/cortex-data-security-command-center.md) - [Cortex DDR Dashboard](https://cortex-docs.paloaltonetworks.com/data-security-documentation/inventory-and-monitoring/dashboards-and-reports/data-security-dashboards/cortex-ddr-dashboard.md) - [Data Security dashboard](https://cortex-docs.paloaltonetworks.com/data-security-documentation/inventory-and-monitoring/dashboards-and-reports/data-security-dashboards/data-security-dashboard.md) - [Access and visibility for dashboards and reports](https://cortex-docs.paloaltonetworks.com/data-security-documentation/inventory-and-monitoring/dashboards-and-reports/access-and-visibility-for-dashboards-and-reports.md) - [Visibility settings](https://cortex-docs.paloaltonetworks.com/data-security-documentation/inventory-and-monitoring/dashboards-and-reports/access-and-visibility-for-dashboards-and-reports/visibility-settings.md) - [Access to widgets](https://cortex-docs.paloaltonetworks.com/data-security-documentation/inventory-and-monitoring/dashboards-and-reports/access-and-visibility-for-dashboards-and-reports/access-to-widgets.md) - [Sharing icons](https://cortex-docs.paloaltonetworks.com/data-security-documentation/inventory-and-monitoring/dashboards-and-reports/access-and-visibility-for-dashboards-and-reports/sharing-icons.md) - [Access and sharing cheat sheet](https://cortex-docs.paloaltonetworks.com/data-security-documentation/inventory-and-monitoring/dashboards-and-reports/access-and-visibility-for-dashboards-and-reports/access-and-sharing-cheat-sheet.md) - [Manage dashboards and reports](https://cortex-docs.paloaltonetworks.com/data-security-documentation/inventory-and-monitoring/dashboards-and-reports/manage-dashboards-and-reports.md) - [Dashboard Manager](https://cortex-docs.paloaltonetworks.com/data-security-documentation/inventory-and-monitoring/dashboards-and-reports/manage-dashboards-and-reports/dashboard-manager.md) - [Reports](https://cortex-docs.paloaltonetworks.com/data-security-documentation/inventory-and-monitoring/dashboards-and-reports/manage-dashboards-and-reports/reports.md) - [Duplicate dashboards and reports](https://cortex-docs.paloaltonetworks.com/data-security-documentation/inventory-and-monitoring/dashboards-and-reports/manage-dashboards-and-reports/duplicate-dashboards-and-reports.md) - [Share custom dashboards and report templates](https://cortex-docs.paloaltonetworks.com/data-security-documentation/inventory-and-monitoring/dashboards-and-reports/manage-dashboards-and-reports/share-custom-dashboards-and-report-templates.md) - [Change ownership to dashboards and report templates](https://cortex-docs.paloaltonetworks.com/data-security-documentation/inventory-and-monitoring/dashboards-and-reports/manage-dashboards-and-reports/change-ownership-to-dashboards-and-report-templates.md) - [Import and export dashboards and report templates](https://cortex-docs.paloaltonetworks.com/data-security-documentation/inventory-and-monitoring/dashboards-and-reports/manage-dashboards-and-reports/import-and-export-dashboards-and-report-templates.md) - [Configure the notification rule for a failed report](https://cortex-docs.paloaltonetworks.com/data-security-documentation/inventory-and-monitoring/dashboards-and-reports/manage-dashboards-and-reports/configure-the-notification-rule-for-a-failed-report.md) - [Deleted content](https://cortex-docs.paloaltonetworks.com/data-security-documentation/inventory-and-monitoring/dashboards-and-reports/manage-dashboards-and-reports/deleted-content.md) - [Create dashboards](https://cortex-docs.paloaltonetworks.com/data-security-documentation/inventory-and-monitoring/dashboards-and-reports/create-dashboards.md) - [Create a dashboard](https://cortex-docs.paloaltonetworks.com/data-security-documentation/inventory-and-monitoring/dashboards-and-reports/create-dashboards/create-a-dashboard.md) - [Create reports](https://cortex-docs.paloaltonetworks.com/data-security-documentation/inventory-and-monitoring/dashboards-and-reports/create-reports.md) - [Create a report template from scratch](https://cortex-docs.paloaltonetworks.com/data-security-documentation/inventory-and-monitoring/dashboards-and-reports/create-reports/create-a-report-template-from-scratch.md) - [Advanced configuration](https://cortex-docs.paloaltonetworks.com/data-security-documentation/inventory-and-monitoring/dashboards-and-reports/advanced-configuration.md) - [Create custom widgets](https://cortex-docs.paloaltonetworks.com/data-security-documentation/inventory-and-monitoring/dashboards-and-reports/advanced-configuration/create-custom-widgets.md) - [Create widgets using AI](https://cortex-docs.paloaltonetworks.com/data-security-documentation/inventory-and-monitoring/dashboards-and-reports/advanced-configuration/create-custom-widgets/create-widgets-using-ai.md) - [Create XQL widgets](https://cortex-docs.paloaltonetworks.com/data-security-documentation/inventory-and-monitoring/dashboards-and-reports/advanced-configuration/create-custom-widgets/create-xql-widgets.md) - [Add parameters to a custom XQL widget](https://cortex-docs.paloaltonetworks.com/data-security-documentation/inventory-and-monitoring/dashboards-and-reports/advanced-configuration/create-custom-widgets/add-parameters-to-a-custom-xql-widget.md) - [Create script-based widgets](https://cortex-docs.paloaltonetworks.com/data-security-documentation/inventory-and-monitoring/dashboards-and-reports/advanced-configuration/create-custom-widgets/create-script-based-widgets.md) - [Configure global filters](https://cortex-docs.paloaltonetworks.com/data-security-documentation/inventory-and-monitoring/dashboards-and-reports/advanced-configuration/configure-global-filters.md) - [Configure drilldowns](https://cortex-docs.paloaltonetworks.com/data-security-documentation/inventory-and-monitoring/dashboards-and-reports/advanced-configuration/configure-drilldowns.md) - [Cases and issues](https://cortex-docs.paloaltonetworks.com/data-security-documentation/issue-management/cases-and-issues.md) - [Investigation and response](https://cortex-docs.paloaltonetworks.com/data-security-documentation/issue-management/investigation-and-response.md) - [How to report a false positive in Cortex Data Classification](https://cortex-docs.paloaltonetworks.com/data-security-documentation/issue-management/how-to-report-a-false-positive-in-cortex-data-classification.md) - [Rules and policies](https://cortex-docs.paloaltonetworks.com/data-security-documentation/advanced-tools/rules-and-policies.md) - [XQL query language](https://cortex-docs.paloaltonetworks.com/data-security-documentation/advanced-tools/xql-query-language.md) - [Graph search](https://cortex-docs.paloaltonetworks.com/data-security-documentation/advanced-tools/graph-search.md) ## Xpanse Expander Documentation - [Learn about Cortex Xpanse](https://cortex-docs.paloaltonetworks.com/cortex-xpanse/learn-about-cortex-xpanse.md): Understand how Cortex Xpanse discovers and enables you to protect your attack surface. - [What is Cortex Xpanse?](https://cortex-docs.paloaltonetworks.com/cortex-xpanse/learn-about-cortex-xpanse/what-is-cortex-xpanse.md): Cortex Xpanse is a cloud-based attack surface management (ASM) platform that collects and correlates information about every device and service connected to the public internet. - [Network mapping](https://cortex-docs.paloaltonetworks.com/cortex-xpanse/learn-about-cortex-xpanse/network-mapping.md): Cortex Xpanse discovers and intelligently attributes assets to organizations using AI and human experts. - [Scanning](https://cortex-docs.paloaltonetworks.com/cortex-xpanse/learn-about-cortex-xpanse/scanning.md): Cortex Xpanse provides targeted scanning of customer networks from an attributed scanning infrastructure. - [Scanning cadences](https://cortex-docs.paloaltonetworks.com/cortex-xpanse/learn-about-cortex-xpanse/scanning/scanning-cadences.md): Cortex Xpanse scans the internet to discover new services at varying cadences depending on several factors such as port, protocol, cloud provider ranges, and customer-attributed assets. - [Known Assets Monitoring](https://cortex-docs.paloaltonetworks.com/cortex-xpanse/learn-about-cortex-xpanse/scanning/known-assets-monitoring.md): Cortex Xpanse performs targeted daily scans of known assets for customers who opt in. - [Scanning ports and protocols](https://cortex-docs.paloaltonetworks.com/cortex-xpanse/learn-about-cortex-xpanse/scanning/scanning-ports-and-protocols.md): Cortex Xpanse detects protocol-validated services on the IPv4 and IPv6 space of the internet. - [GeoIP data collection](https://cortex-docs.paloaltonetworks.com/cortex-xpanse/learn-about-cortex-xpanse/geoip-data-collection.md): Cortex Xpanse geoIP data confirms your global network distribution. - [Cortex Xpanse use cases](https://cortex-docs.paloaltonetworks.com/cortex-xpanse/learn-about-cortex-xpanse/cortex-xpanse-use-cases.md): Common use cases for protecting your attack surface with Cortex Xpanse. - [Cortex Xpanse licenses](https://cortex-docs.paloaltonetworks.com/cortex-xpanse/learn-about-cortex-xpanse/cortex-xpanse-licenses.md): Cortex Xpanse offers several different products and licenses. - [Onboard and configure Cortex Xpanse](https://cortex-docs.paloaltonetworks.com/cortex-xpanse/onboard-and-configure-cortex-xpanse.md) - [Onboarding checklist](https://cortex-docs.paloaltonetworks.com/cortex-xpanse/onboard-and-configure-cortex-xpanse/onboarding-checklist.md): Review these steps to deploy and onboard Cortex Xpanse. - [Step 1: Activate Cortex Xpanse](https://cortex-docs.paloaltonetworks.com/cortex-xpanse/onboard-and-configure-cortex-xpanse/step-1-activate-cortex-xpanse.md): Learn how to activate Cortex Xpanse in the Cortex Gateway. - [Step 2: Set up users and roles](https://cortex-docs.paloaltonetworks.com/cortex-xpanse/onboard-and-configure-cortex-xpanse/step-2-set-up-users-and-roles.md): Set up users, roles, groups, and user scope as part of the onboarding process. - [Step 3: Set up authentication](https://cortex-docs.paloaltonetworks.com/cortex-xpanse/onboard-and-configure-cortex-xpanse/step-3-set-up-authentication.md): Authenticate users through the Customer Support Portal or using SAML SSO. - [Step 4: Provide seed data for your enhanced production map](https://cortex-docs.paloaltonetworks.com/cortex-xpanse/onboard-and-configure-cortex-xpanse/step-4-provide-seed-data-for-your-enhanced-production-map.md): Provide basic information about your organization to create a more comprehensive and customized inventory of your external-facing assets. - [Step 5: Begin asset validation and asset enrichment](https://cortex-docs.paloaltonetworks.com/cortex-xpanse/onboard-and-configure-cortex-xpanse/step-5-begin-asset-validation-and-asset-enrichment.md): Validate assets in your inventory as part of the onboarding process. - [Step 6: Configure priority integrations](https://cortex-docs.paloaltonetworks.com/cortex-xpanse/onboard-and-configure-cortex-xpanse/step-6-configure-priority-integrations.md): Set up collection, automation, and outbound integrations as part of the Cortex Xpanse onboarding process. - [Post-deployment steps](https://cortex-docs.paloaltonetworks.com/cortex-xpanse/onboard-and-configure-cortex-xpanse/post-deployment-steps.md): Configure server settings, security settings, and log forwarding. - [Server Settings](https://cortex-docs.paloaltonetworks.com/cortex-xpanse/onboard-and-configure-cortex-xpanse/post-deployment-steps/server-settings.md): Configure server settings such as keyboard shortcuts and timestamp format. - [Security Settings](https://cortex-docs.paloaltonetworks.com/cortex-xpanse/onboard-and-configure-cortex-xpanse/post-deployment-steps/security-settings.md): Configure security settings such as session expiration, user login expiration, and dashboard expiration. - [Log Forwarding](https://cortex-docs.paloaltonetworks.com/cortex-xpanse/onboard-and-configure-cortex-xpanse/post-deployment-steps/log-forwarding.md): Cortex Xpanse enables you to forward alerts, management audit logs, and reports to external applications. - [Configure Cortex Xpanse](https://cortex-docs.paloaltonetworks.com/cortex-xpanse/onboard-and-configure-cortex-xpanse/configure-cortex-xpanse.md): Configure attack surface rules, risk scoring, dashboards, and other customizable features to match your use cases. - [Users and roles](https://cortex-docs.paloaltonetworks.com/cortex-xpanse/users-and-roles.md): Learn how to configure and manage Cortex Xpanse users, roles, and user groups. Assign roles and set up authentication for users. - [Manage Users](https://cortex-docs.paloaltonetworks.com/cortex-xpanse/users-and-roles/manage-users.md): Manage users and user permissions in the Access Management section of Cortex Xpanse. - [Manage Roles](https://cortex-docs.paloaltonetworks.com/cortex-xpanse/users-and-roles/manage-roles.md): Cortex Xpanse enables you to manage roles in the Access Management console. - [Predefined User Roles](https://cortex-docs.paloaltonetworks.com/cortex-xpanse/users-and-roles/manage-roles/predefined-user-roles.md): Use predefined roles to easily assign View and Edit permissions to Expander users. - [Manage User Groups](https://cortex-docs.paloaltonetworks.com/cortex-xpanse/users-and-roles/manage-user-groups.md): User groups enable you to define a common role and scope for multiple users at once in a Cortex Xpanse tenant. - [Manage User Scope](https://cortex-docs.paloaltonetworks.com/cortex-xpanse/users-and-roles/manage-user-scope.md): Use tags and business units to restrict user access to data in Expander. - [User authentication](https://cortex-docs.paloaltonetworks.com/cortex-xpanse/users-and-roles/user-authentication.md): Authenticate Cortex Xpanse users using SAML 2.0 or the Cortex Gateway. - [Authenticate users through the Customer Support Portal](https://cortex-docs.paloaltonetworks.com/cortex-xpanse/users-and-roles/user-authentication/authenticate-users-through-the-customer-support-portal.md): Authenticate Cortex Xpanse users when using the Customer Support portal. - [Authenticate users through the Cortex Xpanse tenant using SSO](https://cortex-docs.paloaltonetworks.com/cortex-xpanse/users-and-roles/user-authentication/authenticate-users-through-the-cortex-xpanse-tenant-using-sso.md): Set up authentication in the Cortex Xpanse tenant using SSO. - [Set up Okta as the Identity Provider Using SAML 2.0](https://cortex-docs.paloaltonetworks.com/cortex-xpanse/users-and-roles/user-authentication/set-up-okta-as-the-identity-provider-using-saml-2.0.md): Use Okta to authenticate your Cortex Xpanse users. - [Set up Microsoft Entra ID as the Identity Provider Using SAML 2.0](https://cortex-docs.paloaltonetworks.com/cortex-xpanse/users-and-roles/user-authentication/set-up-microsoft-entra-id-as-the-identity-provider-using-saml-2.0.md): Use Microsoft Entra ID to authenticate your Cortex Xpanse users. - [Use Multiple SAML 2.0 Providers](https://cortex-docs.paloaltonetworks.com/cortex-xpanse/users-and-roles/user-authentication/use-multiple-saml-2.0-providers.md): Configure multiple SAML SSO providers and route users to the correct identity provider by email domain. - [Troubleshoot SAML 2.0 Issues](https://cortex-docs.paloaltonetworks.com/cortex-xpanse/users-and-roles/user-authentication/troubleshoot-saml-2.0-issues.md): Resolve common SAML 2.0 authentication issues, including IdP configuration, attribute mapping, and group mapping errors. - [Dataset management](https://cortex-docs.paloaltonetworks.com/cortex-xpanse/dataset-management.md): Learn more about managing your datasets and understanding your overall data storage, period-based retention. - [Dashboards and reports](https://cortex-docs.paloaltonetworks.com/cortex-xpanse/dashboards-and-reports.md): Create or modify dashboards and reports, schedule automated reports for recurring needs, and design custom widgets to suit your visualization goals. - [Dashboards](https://cortex-docs.paloaltonetworks.com/cortex-xpanse/dashboards-and-reports/dashboards.md): Cortex Xpanse provides a comprehensive set of predefined dashboards and the ability to create custom dashboards. - [Predefined dashboards](https://cortex-docs.paloaltonetworks.com/cortex-xpanse/dashboards-and-reports/dashboards/predefined-dashboards.md) - [Create a dashboard](https://cortex-docs.paloaltonetworks.com/cortex-xpanse/dashboards-and-reports/dashboards/create-a-dashboard.md): Create custom Cortex Xpanse dashboards to display information that is most relevant to your organization. - [Manage dashboards](https://cortex-docs.paloaltonetworks.com/cortex-xpanse/dashboards-and-reports/dashboards/manage-dashboards.md): From Dashboards Manager, you can delete, edit, disable, and perform additional management actions on your dashboards. - [Reports](https://cortex-docs.paloaltonetworks.com/cortex-xpanse/dashboards-and-reports/reports.md): Overview of Cortex Xpanse reports and how to create, edit, and download them. - [Report templates](https://cortex-docs.paloaltonetworks.com/cortex-xpanse/dashboards-and-reports/reports/report-templates.md) - [Run a Report](https://cortex-docs.paloaltonetworks.com/cortex-xpanse/dashboards-and-reports/reports/run-a-report.md): Run reports and download them in PDF format. - [Create a report based on a dashboard](https://cortex-docs.paloaltonetworks.com/cortex-xpanse/dashboards-and-reports/reports/create-a-report-based-on-a-dashboard.md): Create a report based on any dashboard in Cortex Xpanse. - [Create a new report](https://cortex-docs.paloaltonetworks.com/cortex-xpanse/dashboards-and-reports/reports/create-a-new-report.md): Create a new report template from scratch or by modifying an existing report template. - [Create the notification rule for a failed report](https://cortex-docs.paloaltonetworks.com/cortex-xpanse/dashboards-and-reports/reports/create-the-notification-rule-for-a-failed-report.md): You can receive an email notification if a report fails to run. - [Widget Library](https://cortex-docs.paloaltonetworks.com/cortex-xpanse/dashboards-and-reports/widget-library.md): Create, search, and view custom widgets in Cortex Xpanse, or use predefined widgets. - [Attack surface rules](https://cortex-docs.paloaltonetworks.com/cortex-xpanse/attack-surface-rules.md): Cortex Xpanse attack surface rules can be customized for your organization's specific needs and priorities. - [Customize risk scoring](https://cortex-docs.paloaltonetworks.com/cortex-xpanse/customize-risk-scoring.md): Create custom risk-scoring rules or manually assign risk scores to prioritize incidents based on your organization's unique requirements. - [Integrations](https://cortex-docs.paloaltonetworks.com/cortex-xpanse/integrations.md): Cortex Xpanse integrates with third-party tools and services to support many use cases. - [Ingest Cloud Resources from Prisma Cloud](https://cortex-docs.paloaltonetworks.com/cortex-xpanse/integrations/ingest-cloud-resources-from-prisma-cloud.md): Cortex Xpanse supports an integration with Prisma Cloud. - [Generate an API Access Key in Prisma Cloud](https://cortex-docs.paloaltonetworks.com/cortex-xpanse/integrations/ingest-cloud-resources-from-prisma-cloud/generate-an-api-access-key-in-prisma-cloud.md): Steps for generating an API access key in Prisma Cloud to use in the API integration with Cortex Xpanse. - [Configure the Prisma Cloud Integration in Cortex Xpanse](https://cortex-docs.paloaltonetworks.com/cortex-xpanse/integrations/ingest-cloud-resources-from-prisma-cloud/configure-the-prisma-cloud-integration-in-cortex-xpanse.md): Enable Cortex Xpanse to ingest Prisma Cloud data. - [Prisma Cloud resource types](https://cortex-docs.paloaltonetworks.com/cortex-xpanse/integrations/ingest-cloud-resources-from-prisma-cloud/prisma-cloud-resource-types.md): Review cloud resource types ingested from Prisma Cloud CSPM through the Cortex Xpanse cloud integration. - [Configure Collection Integrations](https://cortex-docs.paloaltonetworks.com/cortex-xpanse/integrations/configure-collection-integrations.md): Configure Cortex Xpanse collection integrations to ingest cloud assets from third-party sources. - [Ingest Cloud Assets from AWS](https://cortex-docs.paloaltonetworks.com/cortex-xpanse/integrations/configure-collection-integrations/ingest-cloud-assets-from-aws.md): Extend Cortex Xpanse visibility into cloud assets from AWS. - [Ingest Cloud Assets from Google Cloud Platform](https://cortex-docs.paloaltonetworks.com/cortex-xpanse/integrations/configure-collection-integrations/ingest-cloud-assets-from-google-cloud-platform.md): Extend Cortex Xpanse visibility into cloud assets from Google Cloud Platform. - [Ingest Cloud Assets from Microsoft Azure](https://cortex-docs.paloaltonetworks.com/cortex-xpanse/integrations/configure-collection-integrations/ingest-cloud-assets-from-microsoft-azure.md): Extend Cortex Xpanse visibility into cloud assets from Microsoft Azure. - [Generate an API Key](https://cortex-docs.paloaltonetworks.com/cortex-xpanse/integrations/generate-an-api-key.md): Before using the Expander API, generate an API Key and collect the API Key ID and FQDN. - [Security rating](https://cortex-docs.paloaltonetworks.com/cortex-xpanse/security-rating.md): The Cortex Xpanse Security Rating represents the overall hygiene of an organization’s external-facing attack surface and the risk of a breach originating from external-facing assets. - [Inventory](https://cortex-docs.paloaltonetworks.com/cortex-xpanse/inventory.md): Access a comprehensive inventory of all the assets Cortex Xpanse has attributed to your organization. - [Asset Types](https://cortex-docs.paloaltonetworks.com/cortex-xpanse/inventory/asset-types.md): Explore the asset types available in the Cortex Xpanse Inventory. - [Domains](https://cortex-docs.paloaltonetworks.com/cortex-xpanse/inventory/asset-types/domains.md): Cortex Xpanse gets its domains and DNS data from a combination of active and passive global collection techniques. - [Certificates](https://cortex-docs.paloaltonetworks.com/cortex-xpanse/inventory/asset-types/certificates.md): View detailed information about each certificate in your inventory. - [Cloud Inventory](https://cortex-docs.paloaltonetworks.com/cortex-xpanse/inventory/asset-types/cloud-inventory.md): View your Cloud Inventory, which includes assets discovered through our cloud integrations and Prisma Cloud integration. - [Owned Responsive IPs](https://cortex-docs.paloaltonetworks.com/cortex-xpanse/inventory/asset-types/owned-responsive-ips.md): Owned responsive IPs provide a single IP reference point when an active service is detected on an IPv4 or IPv6 range that has been attributed to an organization. - [Services](https://cortex-docs.paloaltonetworks.com/cortex-xpanse/inventory/asset-types/services.md): Cortex Xpanse provides a complete inventory of all of the public internet-facing services attributed to your organization. - [Owned IPv4 Ranges](https://cortex-docs.paloaltonetworks.com/cortex-xpanse/inventory/asset-types/owned-ipv4-ranges.md): View all the IPv4 addresses, in the form of ranges, that Cortex Xpanse has attributed to your organization. - [Owned IPv6 Ranges](https://cortex-docs.paloaltonetworks.com/cortex-xpanse/inventory/asset-types/owned-ipv6-ranges.md): View all the IPv6 addresses that you have provided or Cortex Xpanse has attributed to your organization. - [Websites](https://cortex-docs.paloaltonetworks.com/cortex-xpanse/inventory/asset-types/websites.md): Cortex Xpanse scans your public-facing websites, identifying insecure websites, web components, and technologies running on your web assets. - [Unified Inventory](https://cortex-docs.paloaltonetworks.com/cortex-xpanse/inventory/unified-inventory.md): View all the assets Cortex Xpanse has attributed to your organization (excluding services, websites, and IP ranges) in the Unified Inventory table. - [Manage Business Units](https://cortex-docs.paloaltonetworks.com/cortex-xpanse/inventory/manage-business-units.md): Cortex Xpanse defines a business unit or BU as an organizational unit that is responsible for a specific set of assets. - [Business Unit Management for Domains and Subdomains](https://cortex-docs.paloaltonetworks.com/cortex-xpanse/inventory/manage-business-units/business-unit-management-for-domains-and-subdomains.md): Learn how to manage business unit assignments for domains and subdomains. - [Business Unit Management for IP Ranges](https://cortex-docs.paloaltonetworks.com/cortex-xpanse/inventory/manage-business-units/business-unit-management-for-ip-ranges.md): Learn about business unit assignments for user-defined and system-defined IPv4 ranges. - [Create a user-defined IPv4 range](https://cortex-docs.paloaltonetworks.com/cortex-xpanse/inventory/manage-business-units/create-a-user-defined-ipv4-range.md): Create a new IPv4 address range and modify the business unit assignment. - [Modify the Business Unit for an IPv4 Range](https://cortex-docs.paloaltonetworks.com/cortex-xpanse/inventory/manage-business-units/modify-the-business-unit-for-an-ipv4-range.md): Update the BU assignment for an IPv4 address range. - [Modify the Business Unit for an Asset](https://cortex-docs.paloaltonetworks.com/cortex-xpanse/inventory/manage-business-units/modify-the-business-unit-for-an-asset.md): Update the business unit assignment for an asset in the context of an incident or in the Inventory. - [Bulk business unit management](https://cortex-docs.paloaltonetworks.com/cortex-xpanse/inventory/manage-business-units/bulk-business-unit-management.md): Bulk update business unit assignments for domains and IP ranges using a CSV file. - [Asset Attribution](https://cortex-docs.paloaltonetworks.com/cortex-xpanse/inventory/asset-attribution.md): Learn about the attribution information Cortex Xpanse provides about your assets, so you know why each asset was attributed to your organization. - [Asset Tagging](https://cortex-docs.paloaltonetworks.com/cortex-xpanse/inventory/asset-tagging.md): Learn about how Cortex Xpanse uses tags to support advanced data filtering, customized data, and to restrict or permit access to data. - [Create a New Tag](https://cortex-docs.paloaltonetworks.com/cortex-xpanse/inventory/asset-tagging/create-a-new-tag.md): Create asset or IP range tags and optionally assign them to users and groups for scoped access. - [Add an Existing Tag to an Asset](https://cortex-docs.paloaltonetworks.com/cortex-xpanse/inventory/asset-tagging/add-an-existing-tag-to-an-asset.md): Add an existing tag to one or more assets in your Inventory. - [Remove Tags from Assets](https://cortex-docs.paloaltonetworks.com/cortex-xpanse/inventory/asset-tagging/remove-tags-from-assets.md): Remove tags from one or more assets. - [Create Inventory Tag Rules](https://cortex-docs.paloaltonetworks.com/cortex-xpanse/inventory/asset-tagging/create-inventory-tag-rules.md): Define inventory tag rules to apply tags automatically to assets that match your rule criteria, including any new assets that are attributed to your organization. - [Asset Notes](https://cortex-docs.paloaltonetworks.com/cortex-xpanse/inventory/asset-notes.md): Add and manage notes for individual assets from the Inventory or an incident. - [Upload or remove assets](https://cortex-docs.paloaltonetworks.com/cortex-xpanse/inventory/upload-or-remove-assets.md): Adjust your inventory by adding or removing assets yourself through the Cortex Xpanse UI. - [Upload assets](https://cortex-docs.paloaltonetworks.com/cortex-xpanse/inventory/upload-or-remove-assets/upload-assets.md): Add assets to your inventory through the UI. - [Remove assets](https://cortex-docs.paloaltonetworks.com/cortex-xpanse/inventory/upload-or-remove-assets/remove-assets.md): Remove assets from your inventory through the UI. - [Undo an asset removal](https://cortex-docs.paloaltonetworks.com/cortex-xpanse/inventory/upload-or-remove-assets/undo-an-asset-removal.md): Restore a previously removed asset to the Cortex Xpanse inventory. - [Investigating Assets](https://cortex-docs.paloaltonetworks.com/cortex-xpanse/inventory/investigating-assets.md): Use filters to monitor and find potentially vulnerable assets in your Inventory - [Incidents and alerts](https://cortex-docs.paloaltonetworks.com/cortex-xpanse/incidents-and-alerts.md): Learn about workflows and playbook-driven automation for monitoring, prioritizing, investigating, and remediating incidents and alerts. - [Incidents](https://cortex-docs.paloaltonetworks.com/cortex-xpanse/incidents-and-alerts/incidents.md): Cortex Xpanse provides an Incidents table that you can use to view all the incidents reported to and surfaced from your Cortex Xpanse instance. - [Export an incident as a PDF](https://cortex-docs.paloaltonetworks.com/cortex-xpanse/incidents-and-alerts/incidents/export-an-incident-as-a-pdf.md): Export incident details as a PDF report from the Incidents page. - [Incident Status](https://cortex-docs.paloaltonetworks.com/cortex-xpanse/incidents-and-alerts/incidents/incident-status.md): Learn about each incident status. - [Incident Starring](https://cortex-docs.paloaltonetworks.com/cortex-xpanse/incidents-and-alerts/incidents/incident-starring.md): Create an incident starring configuration that categorizes and stars incidents when alerts contain attributes that you decide are important. - [Incidents Fields](https://cortex-docs.paloaltonetworks.com/cortex-xpanse/incidents-and-alerts/incidents/incidents-fields.md): You can sort, filter, and configure the fields to display in the Incidents table. - [Risk Scoring](https://cortex-docs.paloaltonetworks.com/cortex-xpanse/incidents-and-alerts/risk-scoring.md): Learn about Cortex Xpanse risk scores and how they are calculated. - [Incident Risk Details](https://cortex-docs.paloaltonetworks.com/cortex-xpanse/incidents-and-alerts/risk-scoring/incident-risk-details.md): Understand how inferred CVEs, exploit data, and risk factors contribute to an incident’s risk score. - [Risk Factors](https://cortex-docs.paloaltonetworks.com/cortex-xpanse/incidents-and-alerts/risk-scoring/risk-factors.md): Cortex Xpanse uses a set of Risk Factors when calculating incident risk scores. - [Alerts](https://cortex-docs.paloaltonetworks.com/cortex-xpanse/incidents-and-alerts/alerts.md): An alert is a potential security risk identified by Cortex Xpanse on your services and assets. - [Alert Status](https://cortex-docs.paloaltonetworks.com/cortex-xpanse/incidents-and-alerts/alerts/alert-status.md): Learn about the alert lifecycle and definition of each alert status. - [Alert Fields](https://cortex-docs.paloaltonetworks.com/cortex-xpanse/incidents-and-alerts/alerts/alert-fields.md): Review the descriptions of the fields in the Alerts table. - [Alert exclusions](https://cortex-docs.paloaltonetworks.com/cortex-xpanse/incidents-and-alerts/alerts/alert-exclusions.md): Create a rule to exclude certain criteria from raising or reopening alerts in Cortex Xpanse. - [Export an alert as a PDF](https://cortex-docs.paloaltonetworks.com/cortex-xpanse/incidents-and-alerts/alerts/export-an-alert-as-a-pdf.md) - [Threat Response Center](https://cortex-docs.paloaltonetworks.com/cortex-xpanse/threat-response-center.md): Research and respond to zero-day exploits and global threat events in the Threat Response Center. - [Review the list of threat events](https://cortex-docs.paloaltonetworks.com/cortex-xpanse/threat-response-center/review-the-list-of-threat-events.md): Review a curated list of zero-day exploits and global threat events on the Emerging Vulnerabilities page. - [Research a threat event](https://cortex-docs.paloaltonetworks.com/cortex-xpanse/threat-response-center/research-a-threat-event.md): Review detailed information about a threat event, including related alerts and incidents, in the Threat Response Center. - [Active Response](https://cortex-docs.paloaltonetworks.com/cortex-xpanse/active-response.md): Automate ASM alert investigation and remediation with the Cortex Xpanse Active Response add-on module. - [How Active Response Works](https://cortex-docs.paloaltonetworks.com/cortex-xpanse/active-response/how-active-response-works.md): Learn how Active Response automates alert investigation, remediation, and resolution validation. - [Active Response License](https://cortex-docs.paloaltonetworks.com/cortex-xpanse/active-response/active-response-license.md): Review Active Response licensing options and start a 60-day free trial. - [Set Up Active Response](https://cortex-docs.paloaltonetworks.com/cortex-xpanse/active-response/set-up-active-response.md): Configure automation integrations and remediation path rules for Active Response. - [Automation Integrations](https://cortex-docs.paloaltonetworks.com/cortex-xpanse/active-response/set-up-active-response/automation-integrations.md): Automation integrations enable Active Response to enrich an alert or respond to an alert with an action, such as sending notifications or directly modifying the configuration of an asset, service, or - [Remediation Path Rules](https://cortex-docs.paloaltonetworks.com/cortex-xpanse/active-response/set-up-active-response/remediation-path-rules.md): Create remediation path rules to customize Active Response to automatically respond to alerts with actions that meet your business requirements. - [Playbook Configuration](https://cortex-docs.paloaltonetworks.com/cortex-xpanse/active-response/set-up-active-response/playbook-configuration.md): Customize the email and ticket notifications generated by the Active Response playbook. - [Resolve Incidents with Active Response](https://cortex-docs.paloaltonetworks.com/cortex-xpanse/active-response/resolve-incidents-with-active-response.md): Use Active Response to automate the investigation and resolution of alerts and incidents in Expander. - [Troubleshoot Active Response](https://cortex-docs.paloaltonetworks.com/cortex-xpanse/active-response/troubleshoot-active-response.md) - [Automated Remediation Capabilities Matrix](https://cortex-docs.paloaltonetworks.com/cortex-xpanse/active-response/automated-remediation-capabilities-matrix.md): Learn about the specific ASM automated remediation and enrichment capabilities and criteria. - [Active Response FAQ](https://cortex-docs.paloaltonetworks.com/cortex-xpanse/active-response/active-response-faq.md) - [Engines](https://cortex-docs.paloaltonetworks.com/cortex-xpanse/active-response/engines.md): Install, manage, configure, and troubleshoot engines. - [Engines Use Case](https://cortex-docs.paloaltonetworks.com/cortex-xpanse/active-response/engines/engines-use-case.md): Understand engine architecture and load balancing groups. - [Engine Installation](https://cortex-docs.paloaltonetworks.com/cortex-xpanse/active-response/engines/engine-installation.md): Install, deploy and configure Cortex Xpanse engines. - [Docker](https://cortex-docs.paloaltonetworks.com/cortex-xpanse/active-response/engines/docker.md): Cortex Xpanse Docker installation, configuration, security, and troubleshooting guides. - [Podman](https://cortex-docs.paloaltonetworks.com/cortex-xpanse/active-response/engines/podman.md): Run Podman containers instead of Docker for RHEL v8. - [Configure Engines](https://cortex-docs.paloaltonetworks.com/cortex-xpanse/active-response/engines/configure-engines.md): Configure Cortex Xpanse engines to use custom certificates and notify users if engine disconnects - [Manage Engines](https://cortex-docs.paloaltonetworks.com/cortex-xpanse/active-response/engines/manage-engines.md): Manage engines and load balancing groups. - [Use an Engine in an Integration](https://cortex-docs.paloaltonetworks.com/cortex-xpanse/active-response/engines/use-an-engine-in-an-integration.md): Use an engine or load-balancing group of engines to fetch alerts and run commands for an integration. - [Run a Script Using an Engine](https://cortex-docs.paloaltonetworks.com/cortex-xpanse/active-response/engines/run-a-script-using-an-engine.md): Run a script on an engine or load-balancing group to distribute the workload and improve performance. - [Remove an Engine](https://cortex-docs.paloaltonetworks.com/cortex-xpanse/active-response/engines/remove-an-engine.md): Remove an engine by running the relevant command, depending on your operating system. - [Troubleshoot Engines](https://cortex-docs.paloaltonetworks.com/cortex-xpanse/active-response/engines/troubleshoot-engines.md): Troubleshoot engines by accessing logs and viewing errors. - [Attack Surface Testing](https://cortex-docs.paloaltonetworks.com/cortex-xpanse/attack-surface-testing.md): Attack Surface Testing runs benign exploits against your externally facing assets to confirm the presence of vulnerabilities. - [Attack surface tests](https://cortex-docs.paloaltonetworks.com/cortex-xpanse/attack-surface-testing/attack-surface-tests.md): Attack surface tests are designed to minimize the potential impact to scanned and tested services. - [Attack surface tests for default credentials](https://cortex-docs.paloaltonetworks.com/cortex-xpanse/attack-surface-testing/attack-surface-tests/attack-surface-tests-for-default-credentials.md): Identify default-credential attack surface tests and their non-invasive login checks. - [Attack Surface Testing intrusivity](https://cortex-docs.paloaltonetworks.com/cortex-xpanse/attack-surface-testing/attack-surface-testing-intrusivity.md): Attack surface tests are categorized by their intrusiveness, enabling you to choose more intrusive methods to confirm specific vulnerabilities. - [Set up Attack Surface Testing](https://cortex-docs.paloaltonetworks.com/cortex-xpanse/attack-surface-testing/set-up-attack-surface-testing.md): Set up Attack Surface Testing by verifying permissions, accepting the EULA, and selecting targets. - [Select targets for Attack Surface Testing](https://cortex-docs.paloaltonetworks.com/cortex-xpanse/attack-surface-testing/select-targets-for-attack-surface-testing.md): Choose specific or all directly-discovered services for Attack Surface Testing. - [View attack surface test results](https://cortex-docs.paloaltonetworks.com/cortex-xpanse/attack-surface-testing/view-attack-surface-test-results.md): Find, filter, and review Attack Surface Testing results in the Services inventory. - [Alerts for positive attack surface test results](https://cortex-docs.paloaltonetworks.com/cortex-xpanse/attack-surface-testing/alerts-for-positive-attack-surface-test-results.md): Confirmed positive Attack Surface Testing (AST) results automatically generate alerts. - [AST Scan Now](https://cortex-docs.paloaltonetworks.com/cortex-xpanse/attack-surface-testing/ast-scan-now.md): Trigger on-demand AST rescans from alerts to verify vulnerabilities and automatically update alert status. - [Enable new attack surface tests by default](https://cortex-docs.paloaltonetworks.com/cortex-xpanse/attack-surface-testing/enable-new-attack-surface-tests-by-default.md): Configure which new attack surface tests will be enabled by default. - [View attack surface tests](https://cortex-docs.paloaltonetworks.com/cortex-xpanse/attack-surface-testing/view-attack-surface-tests.md) - [View source IP addresses for Attack Surface Testing scans](https://cortex-docs.paloaltonetworks.com/cortex-xpanse/attack-surface-testing/view-source-ip-addresses-for-attack-surface-testing-scans.md): Locate Attack Surface Testing scan source IPs and apply recommended allow-list guidance. - [Reference](https://cortex-docs.paloaltonetworks.com/cortex-xpanse/reference.md) - [Cortex Xpanse Expander FedRAMP support](https://cortex-docs.paloaltonetworks.com/cortex-xpanse/reference/cortex-xpanse-expander-fedramp-support.md): Cortex Xpanse Expander supports features for FedRAMP Moderate and High environments. - [Scanning activity](https://cortex-docs.paloaltonetworks.com/cortex-xpanse/reference/scanning-activity.md): Cortex Xpanse scanning activity on listed ranges is CFAA-compliant - [Cortex Xpanse Product Policies](https://cortex-docs.paloaltonetworks.com/cortex-xpanse/reference/cortex-xpanse-product-policies.md) - [Data Privacy](https://cortex-docs.paloaltonetworks.com/cortex-xpanse/reference/cortex-xpanse-product-policies/data-privacy.md): Learn where Cortex Xpanse processes and hosts data, and how long it retains it. - [Data Retention Policy](https://cortex-docs.paloaltonetworks.com/cortex-xpanse/reference/cortex-xpanse-product-policies/data-retention-policy.md): Cortex Xpanse data retention policy. - [API Use Policy](https://cortex-docs.paloaltonetworks.com/cortex-xpanse/reference/cortex-xpanse-product-policies/api-use-policy.md): Cortex Xpanse API Use Policy. - [Cortex Xpanse Product Security](https://cortex-docs.paloaltonetworks.com/cortex-xpanse/reference/cortex-xpanse-product-policies/cortex-xpanse-product-security.md): Cortex Xpanse product security - [Browser Support Policy](https://cortex-docs.paloaltonetworks.com/cortex-xpanse/reference/cortex-xpanse-product-policies/browser-support-policy.md): Cortex Xpanse Browser Support Policy - [Management Audit Logs](https://cortex-docs.paloaltonetworks.com/cortex-xpanse/reference/management-audit-logs.md): View and export management audit logs in Cortex Xpanse. - [Monitor Compliance Violations](https://cortex-docs.paloaltonetworks.com/cortex-xpanse/reference/monitor-compliance-violations.md): The Attack Surface Compliance Violations Dashboard helps customers better understand how the issues on their external network impact compliance controls. - [CMMC L1-L5 Unevaluated Controls](https://cortex-docs.paloaltonetworks.com/cortex-xpanse/reference/monitor-compliance-violations/cmmc-l1-l5-unevaluated-controls.md): Cortex Xpanse does not make a determination regarding compliance with the listed CMMC L1-L5 controls. - [NIST 800-53 Unevaluated Controls](https://cortex-docs.paloaltonetworks.com/cortex-xpanse/reference/monitor-compliance-violations/nist-800-53-unevaluated-controls.md): Cortex Xpanse does not make a determination regarding compliance with the listed NIST 800-53 controls. - [NIST 800-171 Unevaluated Controls](https://cortex-docs.paloaltonetworks.com/cortex-xpanse/reference/monitor-compliance-violations/nist-800-171-unevaluated-controls.md): Cortex Xpanse does not make a determination regarding compliance with the listed NIST 800-171 controls. - [Navigation Cheat Sheet](https://cortex-docs.paloaltonetworks.com/cortex-xpanse/reference/navigation-cheat-sheet.md): Cortex Xpanse provides an easy-to-use interface. - [List View Options](https://cortex-docs.paloaltonetworks.com/cortex-xpanse/reference/list-view-options.md): In the Cortex Xpanse Expander, you can filter page results, manage columns and rows, and save or share the filters. - [Search Page Results](https://cortex-docs.paloaltonetworks.com/cortex-xpanse/reference/list-view-options/search-page-results.md): You can search the content in the Alerts and Incidents tables. - [Filter Page Results](https://cortex-docs.paloaltonetworks.com/cortex-xpanse/reference/list-view-options/filter-page-results.md) - [Save and Share Filters](https://cortex-docs.paloaltonetworks.com/cortex-xpanse/reference/list-view-options/save-and-share-filters.md) - [Manage Columns and Rows](https://cortex-docs.paloaltonetworks.com/cortex-xpanse/reference/list-view-options/manage-columns-and-rows.md) - [Show or Hide Results](https://cortex-docs.paloaltonetworks.com/cortex-xpanse/reference/list-view-options/show-or-hide-results.md): Temporarily show or hide table results by pivoting on field values or empty values. - [Export Results to File](https://cortex-docs.paloaltonetworks.com/cortex-xpanse/reference/list-view-options/export-results-to-file.md) ## Cortex XSIAM - [Cortex XSIAM Release Information](https://cortex-docs.paloaltonetworks.com/cortex-xsiam-rn/cortex-xsiam-release-information.md) - [Features introduced in 2026](https://cortex-docs.paloaltonetworks.com/cortex-xsiam-rn/cortex-xsiam-release-information/features-introduced-in-2026-xsiam.md) - [September 6, 2026](https://cortex-docs.paloaltonetworks.com/cortex-xsiam-rn/cortex-xsiam-release-information/features-introduced-in-2026-xsiam/september-6-2026.md) - [July 2026](https://cortex-docs.paloaltonetworks.com/cortex-xsiam-rn/cortex-xsiam-release-information/features-introduced-in-2026-xsiam/july-2026.md) - [Release Highlights](https://cortex-docs.paloaltonetworks.com/cortex-xsiam-rn/cortex-xsiam-release-information/features-introduced-in-2026-xsiam/july-2026/release-highlights.md) - [Feature Enhancements](https://cortex-docs.paloaltonetworks.com/cortex-xsiam-rn/cortex-xsiam-release-information/features-introduced-in-2026-xsiam/july-2026/feature-enhancements.md) - [Changed Features](https://cortex-docs.paloaltonetworks.com/cortex-xsiam-rn/cortex-xsiam-release-information/features-introduced-in-2026-xsiam/july-2026/changed-features.md) - [Cortex Cloud Posture Management and Cortex Cloud Runtime Security](https://cortex-docs.paloaltonetworks.com/cortex-xsiam-rn/cortex-xsiam-release-information/features-introduced-in-2026-xsiam/july-2026/cortex-cloud-posture-management-and-cortex-cloud-runtime-security.md) - [July 20, 2026](https://cortex-docs.paloaltonetworks.com/cortex-xsiam-rn/cortex-xsiam-release-information/features-introduced-in-2026-xsiam/july-20-2026.md) - [May 17, 2026](https://cortex-docs.paloaltonetworks.com/cortex-xsiam-rn/cortex-xsiam-release-information/features-introduced-in-2026-xsiam/may-17-2026.md) - [May 2026](https://cortex-docs.paloaltonetworks.com/cortex-xsiam-rn/cortex-xsiam-release-information/features-introduced-in-2026-xsiam/may-2026.md) - [Release Highlights](https://cortex-docs.paloaltonetworks.com/cortex-xsiam-rn/cortex-xsiam-release-information/features-introduced-in-2026-xsiam/may-2026/release-highlights.md) - [Feature Enhancements](https://cortex-docs.paloaltonetworks.com/cortex-xsiam-rn/cortex-xsiam-release-information/features-introduced-in-2026-xsiam/may-2026/feature-enhancements.md) - [Changed Features](https://cortex-docs.paloaltonetworks.com/cortex-xsiam-rn/cortex-xsiam-release-information/features-introduced-in-2026-xsiam/may-2026/changed-features.md) - [Marketplace content changes](https://cortex-docs.paloaltonetworks.com/cortex-xsiam-rn/cortex-xsiam-release-information/features-introduced-in-2026-xsiam/may-2026/marketplace-content-changes.md) - [Cortex Cloud Posture Management and Cortex Cloud Runtime Security](https://cortex-docs.paloaltonetworks.com/cortex-xsiam-rn/cortex-xsiam-release-information/features-introduced-in-2026-xsiam/may-2026/cortex-cloud-posture-management-and-cortex-cloud-runtime-security.md) - [February 22, 2026](https://cortex-docs.paloaltonetworks.com/cortex-xsiam-rn/cortex-xsiam-release-information/features-introduced-in-2026-xsiam/february-22-2026.md) - [February 8, 2026](https://cortex-docs.paloaltonetworks.com/cortex-xsiam-rn/cortex-xsiam-release-information/features-introduced-in-2026-xsiam/february-08-2026.md) - [February 2026](https://cortex-docs.paloaltonetworks.com/cortex-xsiam-rn/cortex-xsiam-release-information/features-introduced-in-2026-xsiam/february-2026.md) - [Release Highlights](https://cortex-docs.paloaltonetworks.com/cortex-xsiam-rn/cortex-xsiam-release-information/features-introduced-in-2026-xsiam/february-2026/release-highlights.md) - [Feature Enhancements](https://cortex-docs.paloaltonetworks.com/cortex-xsiam-rn/cortex-xsiam-release-information/features-introduced-in-2026-xsiam/february-2026/feature-enhancements.md) - [Changed Features](https://cortex-docs.paloaltonetworks.com/cortex-xsiam-rn/cortex-xsiam-release-information/features-introduced-in-2026-xsiam/february-2026/changed-features.md) - [Cortex Cloud Posture Management and Cortex Cloud Runtime Security](https://cortex-docs.paloaltonetworks.com/cortex-xsiam-rn/cortex-xsiam-release-information/features-introduced-in-2026-xsiam/february-2026/cortex-cloud-posture-management-and-cortex-cloud-runtime-security.md) - [Features Introduced in 2025](https://cortex-docs.paloaltonetworks.com/cortex-xsiam-rn/cortex-xsiam-release-information/features-introduced-in-2025-xsiam.md) - [December 22, 2025](https://cortex-docs.paloaltonetworks.com/cortex-xsiam-rn/cortex-xsiam-release-information/features-introduced-in-2025-xsiam/december-22-2025.md) - [November 23, 2025](https://cortex-docs.paloaltonetworks.com/cortex-xsiam-rn/cortex-xsiam-release-information/features-introduced-in-2025-xsiam/november-23-2025.md) - [November 2025](https://cortex-docs.paloaltonetworks.com/cortex-xsiam-rn/cortex-xsiam-release-information/features-introduced-in-2025-xsiam/november-2025.md) - [Release Highlights](https://cortex-docs.paloaltonetworks.com/cortex-xsiam-rn/cortex-xsiam-release-information/features-introduced-in-2025-xsiam/november-2025/release-highlights.md) - [Feature Enhancements](https://cortex-docs.paloaltonetworks.com/cortex-xsiam-rn/cortex-xsiam-release-information/features-introduced-in-2025-xsiam/november-2025/feature-enhancements.md) - [Changed Features](https://cortex-docs.paloaltonetworks.com/cortex-xsiam-rn/cortex-xsiam-release-information/features-introduced-in-2025-xsiam/november-2025/changed-features.md) - [Marketplace content changes](https://cortex-docs.paloaltonetworks.com/cortex-xsiam-rn/cortex-xsiam-release-information/features-introduced-in-2025-xsiam/november-2025/marketplace-content-changes.md) - [July 2025](https://cortex-docs.paloaltonetworks.com/cortex-xsiam-rn/cortex-xsiam-release-information/features-introduced-in-2025-xsiam/july-2025.md) - [Release Highlights](https://cortex-docs.paloaltonetworks.com/cortex-xsiam-rn/cortex-xsiam-release-information/features-introduced-in-2025-xsiam/july-2025/release-highlights.md) - [Feature Enhancements](https://cortex-docs.paloaltonetworks.com/cortex-xsiam-rn/cortex-xsiam-release-information/features-introduced-in-2025-xsiam/july-2025/feature-enhancements.md) - [Changed features](https://cortex-docs.paloaltonetworks.com/cortex-xsiam-rn/cortex-xsiam-release-information/features-introduced-in-2025-xsiam/july-2025/changed-features.md) - [April 2025](https://cortex-docs.paloaltonetworks.com/cortex-xsiam-rn/cortex-xsiam-release-information/features-introduced-in-2025-xsiam/april-2025.md) - [Release highlights](https://cortex-docs.paloaltonetworks.com/cortex-xsiam-rn/cortex-xsiam-release-information/features-introduced-in-2025-xsiam/april-2025/release-highlights.md) - [Feature enhancements](https://cortex-docs.paloaltonetworks.com/cortex-xsiam-rn/cortex-xsiam-release-information/features-introduced-in-2025-xsiam/april-2025/feature-enhancements.md) - [Changed Features](https://cortex-docs.paloaltonetworks.com/cortex-xsiam-rn/cortex-xsiam-release-information/features-introduced-in-2025-xsiam/april-2025/changed-features.md) - [Known Issues](https://cortex-docs.paloaltonetworks.com/cortex-xsiam-rn/cortex-xsiam-release-information/known-issues-xsiam.md) - [Maintenance releases](https://cortex-docs.paloaltonetworks.com/cortex-xsiam-rn/cortex-xsiam-release-information/maintenance-releases.md) - [Broker VM 32.0.52 (Major)](https://cortex-docs.paloaltonetworks.com/cortex-xsiam-rn/cortex-xsiam-release-information/maintenance-releases/broker-vm-32052-major.md) - [Broker VM 31.100.2](https://cortex-docs.paloaltonetworks.com/cortex-xsiam-rn/cortex-xsiam-release-information/maintenance-releases/broker-vm-311002.md) - [Broker VM 32.0.51 (Major)](https://cortex-docs.paloaltonetworks.com/cortex-xsiam-rn/cortex-xsiam-release-information/maintenance-releases/broker-vm-32051-major.md) - [XDR Collectors 1.5.3 (Major)](https://cortex-docs.paloaltonetworks.com/cortex-xsiam-rn/cortex-xsiam-release-information/maintenance-releases/xdr-collectors-153-major.md) - [XDR Collectors 1.4.3 (Major)](https://cortex-docs.paloaltonetworks.com/cortex-xsiam-rn/cortex-xsiam-release-information/maintenance-releases/xdr-collectors-143-major.md) - [Cortex XDR Agent Release Information](https://cortex-docs.paloaltonetworks.com/cortex-xsiam-rn/cortex-xsiam-release-information/cortex-xdr-agent-release-information.md) - [Previous maintenance releases](https://cortex-docs.paloaltonetworks.com/cortex-xsiam-rn/cortex-xsiam-release-information/previous-maintenance-releases.md) - [Broker VM](https://cortex-docs.paloaltonetworks.com/cortex-xsiam-rn/cortex-xsiam-release-information/previous-maintenance-releases/broker-vm.md) - [Broker VM 31.0.58 (Major)](https://cortex-docs.paloaltonetworks.com/cortex-xsiam-rn/cortex-xsiam-release-information/previous-maintenance-releases/broker-vm/broker-vm-31058-major.md) - [Broker VM 31.0.57 (Major)](https://cortex-docs.paloaltonetworks.com/cortex-xsiam-rn/cortex-xsiam-release-information/previous-maintenance-releases/broker-vm/broker-vm-31057-major.md) - [Broker VM 30.0.63 (Major)](https://cortex-docs.paloaltonetworks.com/cortex-xsiam-rn/cortex-xsiam-release-information/previous-maintenance-releases/broker-vm/broker-vm-30063-major.md) - [Broker VM 30.0.61 (Major)](https://cortex-docs.paloaltonetworks.com/cortex-xsiam-rn/cortex-xsiam-release-information/previous-maintenance-releases/broker-vm/broker-vm-30061-major.md) - [Broker VM 30.0.52 (Major)](https://cortex-docs.paloaltonetworks.com/cortex-xsiam-rn/cortex-xsiam-release-information/previous-maintenance-releases/broker-vm/broker-vm-30052-major.md) - [Broker VM 29.0.77 (Major)](https://cortex-docs.paloaltonetworks.com/cortex-xsiam-rn/cortex-xsiam-release-information/previous-maintenance-releases/broker-vm/broker-vm-29077-major.md) - [Broker VM 29.0.71 (Major)](https://cortex-docs.paloaltonetworks.com/cortex-xsiam-rn/cortex-xsiam-release-information/previous-maintenance-releases/broker-vm/broker-vm-29071-major.md) - [Broker VM 28.0.99 (Major)](https://cortex-docs.paloaltonetworks.com/cortex-xsiam-rn/cortex-xsiam-release-information/previous-maintenance-releases/broker-vm/broker-vm-28099-major.md) - [Broker VM 28.0.96](https://cortex-docs.paloaltonetworks.com/cortex-xsiam-rn/cortex-xsiam-release-information/previous-maintenance-releases/broker-vm/broker-vm-28096-major.md) - [Broker VM 27.100.18](https://cortex-docs.paloaltonetworks.com/cortex-xsiam-rn/cortex-xsiam-release-information/previous-maintenance-releases/broker-vm/broker-vm-2710018.md) - [Broker VM 27.100.17](https://cortex-docs.paloaltonetworks.com/cortex-xsiam-rn/cortex-xsiam-release-information/previous-maintenance-releases/broker-vm/broker-vm-2710017.md) - [Broker VM 27.0.47](https://cortex-docs.paloaltonetworks.com/cortex-xsiam-rn/cortex-xsiam-release-information/previous-maintenance-releases/broker-vm/broker-vm-27047-major.md) - [Broker VM 26.100.10](https://cortex-docs.paloaltonetworks.com/cortex-xsiam-rn/cortex-xsiam-release-information/previous-maintenance-releases/broker-vm/broker-vm-2610010.md) - [Broker VM 26.100.3](https://cortex-docs.paloaltonetworks.com/cortex-xsiam-rn/cortex-xsiam-release-information/previous-maintenance-releases/broker-vm/broker-vm-261003.md) - [Broker VM 26.0.119](https://cortex-docs.paloaltonetworks.com/cortex-xsiam-rn/cortex-xsiam-release-information/previous-maintenance-releases/broker-vm/broker-vm-260119-major.md) - [XDR Collectors](https://cortex-docs.paloaltonetworks.com/cortex-xsiam-rn/cortex-xsiam-release-information/previous-maintenance-releases/xdr-collectors.md) - [XDR Collectors 1.5.2 (Major)](https://cortex-docs.paloaltonetworks.com/cortex-xsiam-rn/cortex-xsiam-release-information/previous-maintenance-releases/xdr-collectors/xdr-collectors-152-major-35.md) - [XDR Collectors 1.4.3 (Major)](https://cortex-docs.paloaltonetworks.com/cortex-xsiam-rn/cortex-xsiam-release-information/previous-maintenance-releases/xdr-collectors/xdr-collectors-143-major-35.md) - [XDR Collectors 1.5.2 (Major)](https://cortex-docs.paloaltonetworks.com/cortex-xsiam-rn/cortex-xsiam-release-information/previous-maintenance-releases/xdr-collectors/xdr-collectors-152-major-34.md) - [XDR Collectors 1.5.1 (Major)](https://cortex-docs.paloaltonetworks.com/cortex-xsiam-rn/cortex-xsiam-release-information/previous-maintenance-releases/xdr-collectors/xdr-collectors-151-major-34.md) - [XDR Collectors 1.4.3 (Major)](https://cortex-docs.paloaltonetworks.com/cortex-xsiam-rn/cortex-xsiam-release-information/previous-maintenance-releases/xdr-collectors/xdr-collectors-143-major-34.md) - [XDR Collectors 1.5.1 (Major)](https://cortex-docs.paloaltonetworks.com/cortex-xsiam-rn/cortex-xsiam-release-information/previous-maintenance-releases/xdr-collectors/xdr-collectors-151-major-33.md) - [XDR Collectors 1.4.3 (Major)](https://cortex-docs.paloaltonetworks.com/cortex-xsiam-rn/cortex-xsiam-release-information/previous-maintenance-releases/xdr-collectors/xdr-collectors-143-major-33.md) - [XDR Collectors 1.5.1 (Major)](https://cortex-docs.paloaltonetworks.com/cortex-xsiam-rn/cortex-xsiam-release-information/previous-maintenance-releases/xdr-collectors/xdr-collectors-151-major.md) - [XDR Collectors 1.4.3 (Major)](https://cortex-docs.paloaltonetworks.com/cortex-xsiam-rn/cortex-xsiam-release-information/previous-maintenance-releases/xdr-collectors/xdr-collectors-143-major.md) - [XDR Collectors 1.5.0 (Major)](https://cortex-docs.paloaltonetworks.com/cortex-xsiam-rn/cortex-xsiam-release-information/previous-maintenance-releases/xdr-collectors/xdr-collectors-150-major.md) - [Compliance standards updates](https://cortex-docs.paloaltonetworks.com/cortex-xsiam-rn/cortex-xsiam-release-information/compliance-standards-updates.md) - [October 2026](https://cortex-docs.paloaltonetworks.com/cortex-xsiam-rn/cortex-xsiam-release-information/compliance-standards-updates/october-2026.md) - [July 2026](https://cortex-docs.paloaltonetworks.com/cortex-xsiam-rn/cortex-xsiam-release-information/compliance-standards-updates/july-2026.md) - [June 2026](https://cortex-docs.paloaltonetworks.com/cortex-xsiam-rn/cortex-xsiam-release-information/compliance-standards-updates/june-2026.md) - [April 2026](https://cortex-docs.paloaltonetworks.com/cortex-xsiam-rn/cortex-xsiam-release-information/compliance-standards-updates/april-2026.md) - [February 2026](https://cortex-docs.paloaltonetworks.com/cortex-xsiam-rn/cortex-xsiam-release-information/compliance-standards-updates/february-2026.md) - [API Ingestions](https://cortex-docs.paloaltonetworks.com/cortex-xsiam-rn/cortex-xsiam-release-information/api-ingestions.md) - [September 2026](https://cortex-docs.paloaltonetworks.com/cortex-xsiam-rn/cortex-xsiam-release-information/api-ingestions/september-2026.md) - [August 2026](https://cortex-docs.paloaltonetworks.com/cortex-xsiam-rn/cortex-xsiam-release-information/api-ingestions/august-2026.md) - [July 2026](https://cortex-docs.paloaltonetworks.com/cortex-xsiam-rn/cortex-xsiam-release-information/api-ingestions/july-2026.md) - [May 2026](https://cortex-docs.paloaltonetworks.com/cortex-xsiam-rn/cortex-xsiam-release-information/api-ingestions/may-2026.md) ## Cortex XDR 5.x - [Release Information](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x-rn/release-information.md) - [Features introduced in 2026](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x-rn/release-information/features-introduced-in-2026-xdr-5x.md) - [September 6, 2026](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x-rn/release-information/features-introduced-in-2026-xdr-5x/september-6-2026.md) - [July 2026](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x-rn/release-information/features-introduced-in-2026-xdr-5x/july-2026.md) - [Release Highlights](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x-rn/release-information/features-introduced-in-2026-xdr-5x/july-2026/release-highlights.md) - [Feature Enhancements](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x-rn/release-information/features-introduced-in-2026-xdr-5x/july-2026/feature-enhancements.md) - [Changed Features](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x-rn/release-information/features-introduced-in-2026-xdr-5x/july-2026/changed-features.md) - [Cortex Cloud Posture Management and Cortex Cloud Runtime Security](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x-rn/release-information/features-introduced-in-2026-xdr-5x/july-2026/cortex-cloud-posture-management-and-cortex-cloud-runtime-security.md) - [July 20, 2026](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x-rn/release-information/features-introduced-in-2026-xdr-5x/july-20-2026.md) - [May 17, 2026](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x-rn/release-information/features-introduced-in-2026-xdr-5x/may-17-2026.md) - [May 2026](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x-rn/release-information/features-introduced-in-2026-xdr-5x/may-2026.md) - [Release Highlights](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x-rn/release-information/features-introduced-in-2026-xdr-5x/may-2026/release-highlights.md) - [Feature Enhancements](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x-rn/release-information/features-introduced-in-2026-xdr-5x/may-2026/feature-enhancements.md) - [Changed Features](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x-rn/release-information/features-introduced-in-2026-xdr-5x/may-2026/changed-features.md) - [Cortex Cloud Posture Management and Cortex Cloud Runtime Security](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x-rn/release-information/features-introduced-in-2026-xdr-5x/may-2026/cortex-cloud-posture-management-and-cortex-cloud-runtime-security.md) - [February 22, 2026](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x-rn/release-information/features-introduced-in-2026-xdr-5x/february-22-2026.md) - [February 8, 2026](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x-rn/release-information/features-introduced-in-2026-xdr-5x/february-08-2026.md) - [February 2026](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x-rn/release-information/features-introduced-in-2026-xdr-5x/february-2026.md) - [Release Highlights](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x-rn/release-information/features-introduced-in-2026-xdr-5x/february-2026/release-highlights.md) - [Feature Enhancements](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x-rn/release-information/features-introduced-in-2026-xdr-5x/february-2026/feature-enhancements.md) - [Changed Features](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x-rn/release-information/features-introduced-in-2026-xdr-5x/february-2026/changed-features.md) - [Cortex Cloud Posture Management and Cortex Cloud Runtime Security](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x-rn/release-information/features-introduced-in-2026-xdr-5x/february-2026/cortex-cloud-posture-management-and-cortex-cloud-runtime-security.md) - [Features Introduced in 2025](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x-rn/release-information/features-introduced-in-2025-xdr-4x.md) - [December 22, 2025](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x-rn/release-information/features-introduced-in-2025-xdr-4x/december-22-2025.md) - [November 23, 2025](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x-rn/release-information/features-introduced-in-2025-xdr-4x/november-23-2025.md) - [November 2025](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x-rn/release-information/features-introduced-in-2025-xdr-4x/november-2025.md) - [Release Highlights](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x-rn/release-information/features-introduced-in-2025-xdr-4x/november-2025/release-highlights.md) - [Feature Enhancements](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x-rn/release-information/features-introduced-in-2025-xdr-4x/november-2025/feature-enhancements.md) - [Changed Features](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x-rn/release-information/features-introduced-in-2025-xdr-4x/november-2025/changed-features.md) - [July 2025](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x-rn/release-information/features-introduced-in-2025-xdr-4x/july-2025.md) - [Release Highlights](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x-rn/release-information/features-introduced-in-2025-xdr-4x/july-2025/release-highlights.md) - [Feature Enhancements](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x-rn/release-information/features-introduced-in-2025-xdr-4x/july-2025/feature-enhancements.md) - [Changed Features](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x-rn/release-information/features-introduced-in-2025-xdr-4x/july-2025/changed-features.md) - [April 2025](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x-rn/release-information/features-introduced-in-2025-xdr-4x/april-2025.md) - [Release Highlights](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x-rn/release-information/features-introduced-in-2025-xdr-4x/april-2025/release-highlights.md) - [Feature Enhancements](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x-rn/release-information/features-introduced-in-2025-xdr-4x/april-2025/feature-enhancements.md) - [Changed Features](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x-rn/release-information/features-introduced-in-2025-xdr-4x/april-2025/changed-features.md) - [Known Issues](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x-rn/release-information/known-issues-xdr.md) - [Maintenance releases](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x-rn/release-information/maintenance-releases.md) - [Broker VM 32.0.52 (Major)](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x-rn/release-information/maintenance-releases/broker-vm-32052-major.md) - [Broker VM 31.100.2](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x-rn/release-information/maintenance-releases/broker-vm-311002.md) - [Broker VM 32.0.51 (Major)](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x-rn/release-information/maintenance-releases/broker-vm-32051-major.md) - [XDR Collectors 1.5.3 (Major)](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x-rn/release-information/maintenance-releases/xdr-collectors-153-major.md) - [XDR Collectors 1.4.3 (Major)](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x-rn/release-information/maintenance-releases/xdr-collectors-143-major.md) - [Associated Software and Content Versions](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x-rn/release-information/associated-software-and-content-versions.md) - [Cortex XDR Agent Release Information](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x-rn/release-information/cortex-xdr-agent-release-information.md) - [Previous maintenance releases](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x-rn/release-information/previous-maintenance-releases.md) - [Broker VM](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x-rn/release-information/previous-maintenance-releases/broker-vm.md) - [Broker VM 31.0.58 (Major)](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x-rn/release-information/previous-maintenance-releases/broker-vm/broker-vm-31058-major.md) - [Broker VM 31.0.57 (Major)](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x-rn/release-information/previous-maintenance-releases/broker-vm/broker-vm-31057-major.md) - [Broker VM 30.0.63 (Major)](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x-rn/release-information/previous-maintenance-releases/broker-vm/broker-vm-30063-major.md) - [Broker VM 30.0.61 (Major)](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x-rn/release-information/previous-maintenance-releases/broker-vm/broker-vm-30061-major.md) - [Broker VM 30.0.52 (Major)](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x-rn/release-information/previous-maintenance-releases/broker-vm/broker-vm-30052-major.md) - [Broker VM 29.0.77 (Major)](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x-rn/release-information/previous-maintenance-releases/broker-vm/broker-vm-29077-major.md) - [Broker VM 29.0.71 (Major)](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x-rn/release-information/previous-maintenance-releases/broker-vm/broker-vm-29071-major.md) - [Broker VM 28.0.99 (Major)](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x-rn/release-information/previous-maintenance-releases/broker-vm/broker-vm-28099-major.md) - [Broker VM 28.0.96](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x-rn/release-information/previous-maintenance-releases/broker-vm/broker-vm-28096-major.md) - [Broker VM 27.100.18](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x-rn/release-information/previous-maintenance-releases/broker-vm/broker-vm-2710018.md) - [Broker VM 27.100.17](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x-rn/release-information/previous-maintenance-releases/broker-vm/broker-vm-2710017.md) - [Broker VM 27.0.47](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x-rn/release-information/previous-maintenance-releases/broker-vm/broker-vm-27047-major.md) - [Broker VM 26.100.10](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x-rn/release-information/previous-maintenance-releases/broker-vm/broker-vm-2610010.md) - [Broker VM 26.100.3](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x-rn/release-information/previous-maintenance-releases/broker-vm/broker-vm-261003.md) - [Broker VM 26.0.119](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x-rn/release-information/previous-maintenance-releases/broker-vm/broker-vm-260119-major.md) - [XDR Collectors](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x-rn/release-information/previous-maintenance-releases/xdr-collectors.md) - [XDR Collectors 1.5.2 (Major)](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x-rn/release-information/previous-maintenance-releases/xdr-collectors/xdr-collectors-152-major-51.md) - [XDR Collectors 1.4.3 (Major)](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x-rn/release-information/previous-maintenance-releases/xdr-collectors/xdr-collectors-143-major-51.md) - [XDR Collectors 1.5.2 (Major)](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x-rn/release-information/previous-maintenance-releases/xdr-collectors/xdr-collectors-152-major-50.md) - [XDR Collectors 1.5.1 (Major)](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x-rn/release-information/previous-maintenance-releases/xdr-collectors/xdr-collectors-151-major-50.md) - [XDR Collectors 1.4.3 (Major)](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x-rn/release-information/previous-maintenance-releases/xdr-collectors/xdr-collectors-143-major-50.md) - [XDR Collectors 1.5.1 (Major)](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x-rn/release-information/previous-maintenance-releases/xdr-collectors/xdr-collectors-151-major-43.md) - [XDR Collectors 1.4.3 (Major)](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x-rn/release-information/previous-maintenance-releases/xdr-collectors/xdr-collectors-143-major-43.md) - [XDR Collectors 1.5.1 (Major)](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x-rn/release-information/previous-maintenance-releases/xdr-collectors/xdr-collectors-151-major.md) - [XDR Collectors 1.4.3 (Major)](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x-rn/release-information/previous-maintenance-releases/xdr-collectors/xdr-collectors-143-major.md) - [XDR Collectors 1.5.0 (Major)](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x-rn/release-information/previous-maintenance-releases/xdr-collectors/xdr-collectors-150-major.md) - [Compliance standards updates](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x-rn/release-information/compliance-standards-updates.md) - [October 2026](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x-rn/release-information/compliance-standards-updates/october-2026.md) - [July 2026](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x-rn/release-information/compliance-standards-updates/july-2026.md) - [June 2026](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x-rn/release-information/compliance-standards-updates/june-2026.md) - [April 2026](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x-rn/release-information/compliance-standards-updates/april-2026.md) - [February 2026](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x-rn/release-information/compliance-standards-updates/february-2026.md) ## Cortex XDR 3.x - [Release Information](https://cortex-docs.paloaltonetworks.com/cortex-xdr-3.x-rn/cortex-xdr-release-information.md) - [Features introduced in 2026](https://cortex-docs.paloaltonetworks.com/cortex-xdr-3.x-rn/cortex-xdr-release-information/features-introduced-in-2026-xdr.md) - [July 2026](https://cortex-docs.paloaltonetworks.com/cortex-xdr-3.x-rn/cortex-xdr-release-information/features-introduced-in-2026-xdr/july-2026.md) - [Release Highlights](https://cortex-docs.paloaltonetworks.com/cortex-xdr-3.x-rn/cortex-xdr-release-information/features-introduced-in-2026-xdr/july-2026/release-highlights.md) - [Feature Enhancements](https://cortex-docs.paloaltonetworks.com/cortex-xdr-3.x-rn/cortex-xdr-release-information/features-introduced-in-2026-xdr/july-2026/feature-enhancements.md) - [July 20, 2026](https://cortex-docs.paloaltonetworks.com/cortex-xdr-3.x-rn/cortex-xdr-release-information/features-introduced-in-2026-xdr/july-20-2026.md) - [May 17, 2026](https://cortex-docs.paloaltonetworks.com/cortex-xdr-3.x-rn/cortex-xdr-release-information/features-introduced-in-2026-xdr/may-17-2026.md) - [May 2026](https://cortex-docs.paloaltonetworks.com/cortex-xdr-3.x-rn/cortex-xdr-release-information/features-introduced-in-2026-xdr/may-2026.md) - [Release Highlights](https://cortex-docs.paloaltonetworks.com/cortex-xdr-3.x-rn/cortex-xdr-release-information/features-introduced-in-2026-xdr/may-2026/release-highlights.md) - [Feature Enhancements](https://cortex-docs.paloaltonetworks.com/cortex-xdr-3.x-rn/cortex-xdr-release-information/features-introduced-in-2026-xdr/may-2026/feature-enhancements.md) - [Changed Features](https://cortex-docs.paloaltonetworks.com/cortex-xdr-3.x-rn/cortex-xdr-release-information/features-introduced-in-2026-xdr/may-2026/changed-features.md) - [February 22, 2026](https://cortex-docs.paloaltonetworks.com/cortex-xdr-3.x-rn/cortex-xdr-release-information/features-introduced-in-2026-xdr/february-22-2026.md) - [February 8, 2026](https://cortex-docs.paloaltonetworks.com/cortex-xdr-3.x-rn/cortex-xdr-release-information/features-introduced-in-2026-xdr/february-08-2026.md) - [February 2026](https://cortex-docs.paloaltonetworks.com/cortex-xdr-3.x-rn/cortex-xdr-release-information/features-introduced-in-2026-xdr/february-2026.md) - [Release Highlights](https://cortex-docs.paloaltonetworks.com/cortex-xdr-3.x-rn/cortex-xdr-release-information/features-introduced-in-2026-xdr/february-2026/release-highlights.md) - [Feature Enhancements](https://cortex-docs.paloaltonetworks.com/cortex-xdr-3.x-rn/cortex-xdr-release-information/features-introduced-in-2026-xdr/february-2026/feature-enhancements.md) - [Changed Features](https://cortex-docs.paloaltonetworks.com/cortex-xdr-3.x-rn/cortex-xdr-release-information/features-introduced-in-2026-xdr/february-2026/changed-features.md) - [Features Introduced in 2025](https://cortex-docs.paloaltonetworks.com/cortex-xdr-3.x-rn/cortex-xdr-release-information/features-introduced-in-2025-xdr.md) - [December 22, 2025](https://cortex-docs.paloaltonetworks.com/cortex-xdr-3.x-rn/cortex-xdr-release-information/features-introduced-in-2025-xdr/december-22-2025.md) - [November 23, 2025](https://cortex-docs.paloaltonetworks.com/cortex-xdr-3.x-rn/cortex-xdr-release-information/features-introduced-in-2025-xdr/november-23-2025.md) - [November 2025](https://cortex-docs.paloaltonetworks.com/cortex-xdr-3.x-rn/cortex-xdr-release-information/features-introduced-in-2025-xdr/november-2025.md) - [Release Highlights](https://cortex-docs.paloaltonetworks.com/cortex-xdr-3.x-rn/cortex-xdr-release-information/features-introduced-in-2025-xdr/november-2025/release-highlights.md) - [Feature Enhancements](https://cortex-docs.paloaltonetworks.com/cortex-xdr-3.x-rn/cortex-xdr-release-information/features-introduced-in-2025-xdr/november-2025/feature-enhancements.md) - [Changed Features](https://cortex-docs.paloaltonetworks.com/cortex-xdr-3.x-rn/cortex-xdr-release-information/features-introduced-in-2025-xdr/november-2025/changed-features.md) - [July 2025](https://cortex-docs.paloaltonetworks.com/cortex-xdr-3.x-rn/cortex-xdr-release-information/features-introduced-in-2025-xdr/july-2025.md) - [Release Highlights](https://cortex-docs.paloaltonetworks.com/cortex-xdr-3.x-rn/cortex-xdr-release-information/features-introduced-in-2025-xdr/july-2025/release-highlights.md) - [Feature Enhancements](https://cortex-docs.paloaltonetworks.com/cortex-xdr-3.x-rn/cortex-xdr-release-information/features-introduced-in-2025-xdr/july-2025/feature-enhancements.md) - [Changed Features](https://cortex-docs.paloaltonetworks.com/cortex-xdr-3.x-rn/cortex-xdr-release-information/features-introduced-in-2025-xdr/july-2025/changed-features.md) - [April 2025](https://cortex-docs.paloaltonetworks.com/cortex-xdr-3.x-rn/cortex-xdr-release-information/features-introduced-in-2025-xdr/april-2025.md) - [Release Highlights](https://cortex-docs.paloaltonetworks.com/cortex-xdr-3.x-rn/cortex-xdr-release-information/features-introduced-in-2025-xdr/april-2025/release-highlights.md) - [Feature Enhancements](https://cortex-docs.paloaltonetworks.com/cortex-xdr-3.x-rn/cortex-xdr-release-information/features-introduced-in-2025-xdr/april-2025/feature-enhancements.md) - [Changed Features](https://cortex-docs.paloaltonetworks.com/cortex-xdr-3.x-rn/cortex-xdr-release-information/features-introduced-in-2025-xdr/april-2025/changed-features.md) - [March 16, 2025](https://cortex-docs.paloaltonetworks.com/cortex-xdr-3.x-rn/cortex-xdr-release-information/features-introduced-in-2025-xdr/march-16-2025.md) - [March 9, 2025](https://cortex-docs.paloaltonetworks.com/cortex-xdr-3.x-rn/cortex-xdr-release-information/features-introduced-in-2025-xdr/march-9-2025.md) - [February 16, 2025](https://cortex-docs.paloaltonetworks.com/cortex-xdr-3.x-rn/cortex-xdr-release-information/features-introduced-in-2025-xdr/february-16-2025.md) - [February 2025](https://cortex-docs.paloaltonetworks.com/cortex-xdr-3.x-rn/cortex-xdr-release-information/features-introduced-in-2025-xdr/february-2025.md) - [Release Highlights](https://cortex-docs.paloaltonetworks.com/cortex-xdr-3.x-rn/cortex-xdr-release-information/features-introduced-in-2025-xdr/february-2025/release-highlights.md) - [Feature Enhancements](https://cortex-docs.paloaltonetworks.com/cortex-xdr-3.x-rn/cortex-xdr-release-information/features-introduced-in-2025-xdr/february-2025/feature-enhancements.md) - [Features Introduced in 2024](https://cortex-docs.paloaltonetworks.com/cortex-xdr-3.x-rn/cortex-xdr-release-information/features-introduced-in-2024-xdr.md) - [September 2024](https://cortex-docs.paloaltonetworks.com/cortex-xdr-3.x-rn/cortex-xdr-release-information/features-introduced-in-2024-xdr/september-2024.md) - [Release Highlights](https://cortex-docs.paloaltonetworks.com/cortex-xdr-3.x-rn/cortex-xdr-release-information/features-introduced-in-2024-xdr/september-2024/release-highlights.md) - [Feature Enhancements](https://cortex-docs.paloaltonetworks.com/cortex-xdr-3.x-rn/cortex-xdr-release-information/features-introduced-in-2024-xdr/september-2024/feature-enhancements.md) - [Changed Features](https://cortex-docs.paloaltonetworks.com/cortex-xdr-3.x-rn/cortex-xdr-release-information/features-introduced-in-2024-xdr/september-2024/changed-features.md) - [July 2024](https://cortex-docs.paloaltonetworks.com/cortex-xdr-3.x-rn/cortex-xdr-release-information/features-introduced-in-2024-xdr/july-2024.md) - [June 2024](https://cortex-docs.paloaltonetworks.com/cortex-xdr-3.x-rn/cortex-xdr-release-information/features-introduced-in-2024-xdr/june-2024.md) - [Release Highlights](https://cortex-docs.paloaltonetworks.com/cortex-xdr-3.x-rn/cortex-xdr-release-information/features-introduced-in-2024-xdr/june-2024/release-highlights.md) - [Feature Enhancements](https://cortex-docs.paloaltonetworks.com/cortex-xdr-3.x-rn/cortex-xdr-release-information/features-introduced-in-2024-xdr/june-2024/feature-enhancements.md) - [Changed Features](https://cortex-docs.paloaltonetworks.com/cortex-xdr-3.x-rn/cortex-xdr-release-information/features-introduced-in-2024-xdr/june-2024/changed-features.md) - [May 2024](https://cortex-docs.paloaltonetworks.com/cortex-xdr-3.x-rn/cortex-xdr-release-information/features-introduced-in-2024-xdr/may-2024.md) - [April 2024](https://cortex-docs.paloaltonetworks.com/cortex-xdr-3.x-rn/cortex-xdr-release-information/features-introduced-in-2024-xdr/april-2024.md) - [Release Highlights](https://cortex-docs.paloaltonetworks.com/cortex-xdr-3.x-rn/cortex-xdr-release-information/features-introduced-in-2024-xdr/april-2024/release-highlights.md) - [Feature Enhancements](https://cortex-docs.paloaltonetworks.com/cortex-xdr-3.x-rn/cortex-xdr-release-information/features-introduced-in-2024-xdr/april-2024/feature-enhancements.md) - [Changed Features](https://cortex-docs.paloaltonetworks.com/cortex-xdr-3.x-rn/cortex-xdr-release-information/features-introduced-in-2024-xdr/april-2024/changed-features.md) - [February 2024](https://cortex-docs.paloaltonetworks.com/cortex-xdr-3.x-rn/cortex-xdr-release-information/features-introduced-in-2024-xdr/february-2024.md) - [Release Highlights](https://cortex-docs.paloaltonetworks.com/cortex-xdr-3.x-rn/cortex-xdr-release-information/features-introduced-in-2024-xdr/february-2024/release-highlights.md) - [Feature Enhancements](https://cortex-docs.paloaltonetworks.com/cortex-xdr-3.x-rn/cortex-xdr-release-information/features-introduced-in-2024-xdr/february-2024/feature-enhancements.md) - [Changed Features](https://cortex-docs.paloaltonetworks.com/cortex-xdr-3.x-rn/cortex-xdr-release-information/features-introduced-in-2024-xdr/february-2024/changed-features.md) - [Features Introduced in 2023](https://cortex-docs.paloaltonetworks.com/cortex-xdr-3.x-rn/cortex-xdr-release-information/features-introduced-in-2023-xdr.md) - [October 2023](https://cortex-docs.paloaltonetworks.com/cortex-xdr-3.x-rn/cortex-xdr-release-information/features-introduced-in-2023-xdr/october-2023.md) - [Release Highlights](https://cortex-docs.paloaltonetworks.com/cortex-xdr-3.x-rn/cortex-xdr-release-information/features-introduced-in-2023-xdr/october-2023/release-highlights.md) - [Feature Enhancements](https://cortex-docs.paloaltonetworks.com/cortex-xdr-3.x-rn/cortex-xdr-release-information/features-introduced-in-2023-xdr/october-2023/feature-enhancements.md) - [Changed Features](https://cortex-docs.paloaltonetworks.com/cortex-xdr-3.x-rn/cortex-xdr-release-information/features-introduced-in-2023-xdr/october-2023/changed-features.md) - [Maintenance Releases](https://cortex-docs.paloaltonetworks.com/cortex-xdr-3.x-rn/cortex-xdr-release-information/maintenance-releases.md) - [Broker VM 32.0.52 (Major)](https://cortex-docs.paloaltonetworks.com/cortex-xdr-3.x-rn/cortex-xdr-release-information/maintenance-releases/broker-vm-32052-major.md) - [Broker VM 31.100.2](https://cortex-docs.paloaltonetworks.com/cortex-xdr-3.x-rn/cortex-xdr-release-information/maintenance-releases/broker-vm-311002.md) - [Broker VM 32.0.51 (Major)](https://cortex-docs.paloaltonetworks.com/cortex-xdr-3.x-rn/cortex-xdr-release-information/maintenance-releases/broker-vm-32051-major.md) - [XDR Collectors 1.5.3 (Major)](https://cortex-docs.paloaltonetworks.com/cortex-xdr-3.x-rn/cortex-xdr-release-information/maintenance-releases/xdr-collectors-153-major.md) - [XDR Collectors 1.4.3 (Major)](https://cortex-docs.paloaltonetworks.com/cortex-xdr-3.x-rn/cortex-xdr-release-information/maintenance-releases/xdr-collectors-143-major.md) - [Hotfix Releases](https://cortex-docs.paloaltonetworks.com/cortex-xdr-3.x-rn/cortex-xdr-release-information/hot-fix-releases.md) - [Associated Software and Content Versions](https://cortex-docs.paloaltonetworks.com/cortex-xdr-3.x-rn/cortex-xdr-release-information/associated-software-and-content-versions.md) - [Cortex XDR Agent Release Information](https://cortex-docs.paloaltonetworks.com/cortex-xdr-3.x-rn/cortex-xdr-release-information/cortex-xdr-agent-release-information.md) - [Known Issues](https://cortex-docs.paloaltonetworks.com/cortex-xdr-3.x-rn/cortex-xdr-release-information/known-issues-xdr.md) - [Previous Maintenance Releases](https://cortex-docs.paloaltonetworks.com/cortex-xdr-3.x-rn/cortex-xdr-release-information/previous-maintenance-releases.md) - [Broker VM](https://cortex-docs.paloaltonetworks.com/cortex-xdr-3.x-rn/cortex-xdr-release-information/previous-maintenance-releases/broker-vm.md) - [Broker VM 31.0.58 (Major)](https://cortex-docs.paloaltonetworks.com/cortex-xdr-3.x-rn/cortex-xdr-release-information/previous-maintenance-releases/broker-vm/broker-vm-31058-major.md) - [Broker VM 31.0.57 (Major)](https://cortex-docs.paloaltonetworks.com/cortex-xdr-3.x-rn/cortex-xdr-release-information/previous-maintenance-releases/broker-vm/broker-vm-31057-major.md) - [Broker VM 30.0.63 (Major)](https://cortex-docs.paloaltonetworks.com/cortex-xdr-3.x-rn/cortex-xdr-release-information/previous-maintenance-releases/broker-vm/broker-vm-30063-major.md) - [Broker VM 30.0.61 (Major)](https://cortex-docs.paloaltonetworks.com/cortex-xdr-3.x-rn/cortex-xdr-release-information/previous-maintenance-releases/broker-vm/broker-vm-30061-major.md) - [Broker VM 30.0.52 (Major)](https://cortex-docs.paloaltonetworks.com/cortex-xdr-3.x-rn/cortex-xdr-release-information/previous-maintenance-releases/broker-vm/broker-vm-30052-major.md) - [Broker VM 29.0.77 (Major)](https://cortex-docs.paloaltonetworks.com/cortex-xdr-3.x-rn/cortex-xdr-release-information/previous-maintenance-releases/broker-vm/broker-vm-29077-major.md) - [Broker VM 29.0.71 (Major)](https://cortex-docs.paloaltonetworks.com/cortex-xdr-3.x-rn/cortex-xdr-release-information/previous-maintenance-releases/broker-vm/broker-vm-29071-major.md) - [Broker VM 28.0.99 (Major)](https://cortex-docs.paloaltonetworks.com/cortex-xdr-3.x-rn/cortex-xdr-release-information/previous-maintenance-releases/broker-vm/broker-vm-28099-major.md) - [Broker VM 28.0.96 (Major)](https://cortex-docs.paloaltonetworks.com/cortex-xdr-3.x-rn/cortex-xdr-release-information/previous-maintenance-releases/broker-vm/broker-vm-28096-major.md) - [Broker VM 27.100.18](https://cortex-docs.paloaltonetworks.com/cortex-xdr-3.x-rn/cortex-xdr-release-information/previous-maintenance-releases/broker-vm/broker-vm-2710018.md) - [Broker VM 27.100.17](https://cortex-docs.paloaltonetworks.com/cortex-xdr-3.x-rn/cortex-xdr-release-information/previous-maintenance-releases/broker-vm/broker-vm-2710017.md) - [Broker VM 27.0.47 (Major)](https://cortex-docs.paloaltonetworks.com/cortex-xdr-3.x-rn/cortex-xdr-release-information/previous-maintenance-releases/broker-vm/broker-vm-27047-major.md) - [Broker VM 26.100.10](https://cortex-docs.paloaltonetworks.com/cortex-xdr-3.x-rn/cortex-xdr-release-information/previous-maintenance-releases/broker-vm/broker-vm-2610010.md) - [Broker VM 26.100.3](https://cortex-docs.paloaltonetworks.com/cortex-xdr-3.x-rn/cortex-xdr-release-information/previous-maintenance-releases/broker-vm/broker-vm-261003.md) - [Broker VM 26.0.119](https://cortex-docs.paloaltonetworks.com/cortex-xdr-3.x-rn/cortex-xdr-release-information/previous-maintenance-releases/broker-vm/broker-vm-260119.md) - [Broker VM 26.0.116 (Major)](https://cortex-docs.paloaltonetworks.com/cortex-xdr-3.x-rn/cortex-xdr-release-information/previous-maintenance-releases/broker-vm/broker-vm-260116-major.md) - [Broker VM 25.100.4](https://cortex-docs.paloaltonetworks.com/cortex-xdr-3.x-rn/cortex-xdr-release-information/previous-maintenance-releases/broker-vm/broker-vm-251004.md) - [XDR Collectors](https://cortex-docs.paloaltonetworks.com/cortex-xdr-3.x-rn/cortex-xdr-release-information/previous-maintenance-releases/xdr-collectors.md) - [XDR Collectors 1.5.2 (Major)](https://cortex-docs.paloaltonetworks.com/cortex-xdr-3.x-rn/cortex-xdr-release-information/previous-maintenance-releases/xdr-collectors/xdr-collectors-152-major-318.md) - [XDR Collectors 1.4.3 (Major)](https://cortex-docs.paloaltonetworks.com/cortex-xdr-3.x-rn/cortex-xdr-release-information/previous-maintenance-releases/xdr-collectors/xdr-collectors-143-major-318.md) - [XDR Collectors 1.5.2 (Major)](https://cortex-docs.paloaltonetworks.com/cortex-xdr-3.x-rn/cortex-xdr-release-information/previous-maintenance-releases/xdr-collectors/xdr-collectors-152-major-317.md) - [XDR Collectors 1.5.1 (Major)](https://cortex-docs.paloaltonetworks.com/cortex-xdr-3.x-rn/cortex-xdr-release-information/previous-maintenance-releases/xdr-collectors/xdr-collectors-151-major-317.md) - [XDR Collectors 1.4.3 (Major)](https://cortex-docs.paloaltonetworks.com/cortex-xdr-3.x-rn/cortex-xdr-release-information/previous-maintenance-releases/xdr-collectors/xdr-collectors-143-major-317.md) - [XDR Collectors 1.5.1 (Major)](https://cortex-docs.paloaltonetworks.com/cortex-xdr-3.x-rn/cortex-xdr-release-information/previous-maintenance-releases/xdr-collectors/xdr-collectors-151-major-316.md) - [XDR Collectors 1.4.3 (Major)](https://cortex-docs.paloaltonetworks.com/cortex-xdr-3.x-rn/cortex-xdr-release-information/previous-maintenance-releases/xdr-collectors/xdr-collectors-143-major-316.md) - [XDR Collectors 1.5.1 (Major)](https://cortex-docs.paloaltonetworks.com/cortex-xdr-3.x-rn/cortex-xdr-release-information/previous-maintenance-releases/xdr-collectors/xdr-collectors-151-major.md) - [XDR Collectors 1.4.3 (Major)](https://cortex-docs.paloaltonetworks.com/cortex-xdr-3.x-rn/cortex-xdr-release-information/previous-maintenance-releases/xdr-collectors/xdr-collectors-143-major.md) - [XDR Collectors 1.5.0 (Major)](https://cortex-docs.paloaltonetworks.com/cortex-xdr-3.x-rn/cortex-xdr-release-information/previous-maintenance-releases/xdr-collectors/xdr-collectors-150-major.md) - [XDR Collectors 1.4.2 (Major)](https://cortex-docs.paloaltonetworks.com/cortex-xdr-3.x-rn/cortex-xdr-release-information/previous-maintenance-releases/xdr-collectors/xdr-collectors-142-major.md) - [XDR Collectors 1.4.1 (Major)](https://cortex-docs.paloaltonetworks.com/cortex-xdr-3.x-rn/cortex-xdr-release-information/previous-maintenance-releases/xdr-collectors/xdr-collectors-141.md) ## Cortex XDR Agent Release Notes - [Cortex XDR Agent Releases](https://cortex-docs.paloaltonetworks.com/agent-release-notes/cortex-xdr-agent-releases/readme.md) - [Cortex XDR Hotfix Releases](https://cortex-docs.paloaltonetworks.com/agent-release-notes/cortex-xdr-agent-releases/cortex-xdr-hotfix-releases.md) - [Cortex XDR Mobile Patch Releases](https://cortex-docs.paloaltonetworks.com/agent-release-notes/cortex-xdr-agent-releases/cortex-xdr-mobile-patch-releases.md): View the list of Cortex XDR agent releases for iOS and Android devices. - [Cortex XDR Agent Past Releases Archive](https://cortex-docs.paloaltonetworks.com/agent-release-notes/cortex-xdr-agent-releases/cortex-xdr-agent-past-releases-archive.md) ## Cortex XDR Agent 9.x - [Cortex XDR Agent 9.3 Release Information](https://cortex-docs.paloaltonetworks.com/xdr-agent-release-notes/release-information.md) - [Feature Enhancements](https://cortex-docs.paloaltonetworks.com/xdr-agent-release-notes/release-information/feature-enhancements.md) - [Addressed Issues](https://cortex-docs.paloaltonetworks.com/xdr-agent-release-notes/release-information/addressed-issues.md) - [Known Limitations](https://cortex-docs.paloaltonetworks.com/xdr-agent-release-notes/release-information/known-issues.md) * [Cortex XDR Agent 9.2 Release Information](https://cortex-docs.paloaltonetworks.com/xdr-agent-release-notes/9.2/release-information.md) * [Feature Enhancements](https://cortex-docs.paloaltonetworks.com/xdr-agent-release-notes/9.2/release-information/feature-enhancements.md) * [Addressed Issues](https://cortex-docs.paloaltonetworks.com/xdr-agent-release-notes/9.2/release-information/addressed-issues.md) * [Addressed issues in Cortex XDR agent 9.2.1](https://cortex-docs.paloaltonetworks.com/xdr-agent-release-notes/9.2/release-information/addressed-issues/addressed-issues-in-cortex-xdr-agent-9.2.1.md) * [Cortex XDR agent 9.2 HF (9.2.0.134)](https://cortex-docs.paloaltonetworks.com/xdr-agent-release-notes/9.2/release-information/addressed-issues/cortex-xdr-agent-9.2-hf-9.2.0.134.md) * [Addressed issues in Cortex XDR agent 9.2](https://cortex-docs.paloaltonetworks.com/xdr-agent-release-notes/9.2/release-information/addressed-issues/addressed-issues-in-cortex-xdr-agent-9.2.md) * [Cortex XDR agent known limitations](https://cortex-docs.paloaltonetworks.com/xdr-agent-release-notes/9.2/release-information/known-issues.md) - [Cortex XDR Agent 9.1-CE Release Information](https://cortex-docs.paloaltonetworks.com/xdr-agent-release-notes/9.1-ce/cortex-xdr-agent-release-information.md) - [Feature Enhancements](https://cortex-docs.paloaltonetworks.com/xdr-agent-release-notes/9.1-ce/cortex-xdr-agent-release-information/feature-enhancements.md) - [Addressed issues in Cortex XDR agent 9.1-CE](https://cortex-docs.paloaltonetworks.com/xdr-agent-release-notes/9.1-ce/cortex-xdr-agent-release-information/addressed-issues-title-in-cortex-xdr-agent.md) - [Cortex XDR agent known limitations](https://cortex-docs.paloaltonetworks.com/xdr-agent-release-notes/9.1-ce/cortex-xdr-agent-release-information/cortex-xdr-agent-known-issues-91.md) * [Cortex XDR Agent 9.1 Release Information](https://cortex-docs.paloaltonetworks.com/xdr-agent-release-notes/9.1/cortex-xdr-agent-release-information.md) * [Feature Enhancements](https://cortex-docs.paloaltonetworks.com/xdr-agent-release-notes/9.1/cortex-xdr-agent-release-information/feature-enhancements.md) * [Addressed Issues](https://cortex-docs.paloaltonetworks.com/xdr-agent-release-notes/9.1/cortex-xdr-agent-release-information/addressed-issues.md) * [Addressed issues in Cortex XDR agent 9.1.1](https://cortex-docs.paloaltonetworks.com/xdr-agent-release-notes/9.1/cortex-xdr-agent-release-information/addressed-issues/addressed-issues-911.md) * [Addressed issues in Cortex XDR agent 9.1](https://cortex-docs.paloaltonetworks.com/xdr-agent-release-notes/9.1/cortex-xdr-agent-release-information/addressed-issues/addressed-issues-91.md) * [Cortex XDR agent known limitations](https://cortex-docs.paloaltonetworks.com/xdr-agent-release-notes/9.1/cortex-xdr-agent-release-information/cortex-xdr-agent-known-issues-91.md) - [Agent 9.0 Release Information](https://cortex-docs.paloaltonetworks.com/xdr-agent-release-notes/9.0/agent-9.0-release-information.md): New features, default behavior changes, and known issues in agent 9.0 release - [Feature Enhancements](https://cortex-docs.paloaltonetworks.com/xdr-agent-release-notes/9.0/agent-9.0-release-information/feature-enhancements.md) - [Addressed issues in agent 9.0](https://cortex-docs.paloaltonetworks.com/xdr-agent-release-notes/9.0/agent-9.0-release-information/addressed-issues-in-agent-9.0.md): Addressed issues in agent 9.0 release for Windows, macOS, and Linux. - [Addressed issues in Cortex XDR agent 9.0.1](https://cortex-docs.paloaltonetworks.com/xdr-agent-release-notes/9.0/agent-9.0-release-information/addressed-issues-in-agent-9.0/addressed-issues-in-cortex-xdr-agent-9.0.1.md) - [Addressed issues in Cortex XDR agent 9.0](https://cortex-docs.paloaltonetworks.com/xdr-agent-release-notes/9.0/agent-9.0-release-information/addressed-issues-in-agent-9.0/addressed-issues-in-cortex-xdr-agent-9.0.1-1.md) - [Cortex XDR agent known limitations](https://cortex-docs.paloaltonetworks.com/xdr-agent-release-notes/9.0/agent-9.0-release-information/cortex-xdr-agent-known-limitations.md): See the list of the known limitations in Cortex XDR agent 9.0 ## Cortex XDR Agent 8.x - [Cortex XDR Agent 8.9 Release Information](https://cortex-docs.paloaltonetworks.com/8.x/cortex-xdr-agent-8.9-release-information.md): New features, default behavior changes, and known issues in Cortex XDR agent 8.9 release - [Features introduced in Cortex XDR agent 8.9](https://cortex-docs.paloaltonetworks.com/8.x/cortex-xdr-agent-8.9-release-information/features-introduced-in-cortex-xdr-agent-8.9.md): Describes the new features introduced in Cortex XDR agent 8.9 releases - [Addressed issues in Cortex XDR agent 8.9](https://cortex-docs.paloaltonetworks.com/8.x/cortex-xdr-agent-8.9-release-information/addressed-issues-in-cortex-xdr-agent-8.9.md): Addressed issues in Cortex XDR agent 8.9 release for Windows, macOS, and Linux. - [Addressed issues in Cortex XDR agent 8.9.1](https://cortex-docs.paloaltonetworks.com/8.x/cortex-xdr-agent-8.9-release-information/addressed-issues-in-cortex-xdr-agent-8.9/addressed-issues-in-cortex-xdr-agent-8.9.1.md) - [Addressed issues in Cortex XDR agent 8.9.0](https://cortex-docs.paloaltonetworks.com/8.x/cortex-xdr-agent-8.9-release-information/addressed-issues-in-cortex-xdr-agent-8.9/addressed-issues-in-cortex-xdr-agent-8.9.0.md): Addressed issues in Cortex XDR agent 8.9.0 - [Cortex XDR agent known limitations](https://cortex-docs.paloaltonetworks.com/8.x/cortex-xdr-agent-8.9-release-information/cortex-xdr-agent-known-limitations.md): See the list of the known limitations in Cortex XDR agent 8.9. - [Cortex XDR agent 8.7-CE release information](https://cortex-docs.paloaltonetworks.com/8.x/8.7ce/cortex-xdr-agent-8.7-ce-release-information.md): New features, default behavior changes, and known issues in Cortex XDR agent 8.7-CE release - [Features introduced in Cortex XDR agent 8.7](https://cortex-docs.paloaltonetworks.com/8.x/8.7ce/cortex-xdr-agent-8.7-ce-release-information/features-introduced-in-cortex-xdr-agent-8.7.md): Describes the new features introduced in Cortex XDR agent 8.7 release. - [Windows Features](https://cortex-docs.paloaltonetworks.com/8.x/8.7ce/cortex-xdr-agent-8.7-ce-release-information/features-introduced-in-cortex-xdr-agent-8.7/windows-features.md): Describes the new features introduced in Cortex XDR agent 8.7 release. - [Addressed issues in Cortex XDR agent 8.7-CE](https://cortex-docs.paloaltonetworks.com/8.x/8.7ce/cortex-xdr-agent-8.7-ce-release-information/addressed-issues-in-cortex-xdr-agent-8.7-ce.md): Addressed issues in Cortex XDR agent 8.7-CE release for Windows, macOS, and Linux. - [Addressed issues in Cortex XDR agent 8.7.101-CE](https://cortex-docs.paloaltonetworks.com/8.x/8.7ce/cortex-xdr-agent-8.7-ce-release-information/addressed-issues-in-cortex-xdr-agent-8.7-ce/addressed-issues-in-cortex-xdr-agent-8.7.101-ce.md) - [Addressed issues in Cortex XDR agent 8.7.100-CE](https://cortex-docs.paloaltonetworks.com/8.x/8.7ce/cortex-xdr-agent-8.7-ce-release-information/addressed-issues-in-cortex-xdr-agent-8.7-ce/addressed-issues-in-cortex-xdr-agent-8.7.100-ce.md) - [Cortex XDR agent known issues](https://cortex-docs.paloaltonetworks.com/8.x/8.7ce/cortex-xdr-agent-8.7-ce-release-information/cortex-xdr-agent-known-issues.md): See the list of the known issues in Cortex XDR agent 8.7-CE. ## Cortex XDR Agent 7.x - [Cortex XDR Agent 7.9-CE Release Information](https://cortex-docs.paloaltonetworks.com/7.x/cortex-xdr-agent-7.9-ce-release-information.md): New features, default behavior changes, and known issues in Cortex XDR Agent 7.9-CE release. - [Features Introduced in Cortex XDR Agent 7.9](https://cortex-docs.paloaltonetworks.com/7.x/cortex-xdr-agent-7.9-ce-release-information/features-introduced-in-cortex-xdr-agent-7.9.md) - [Addressed Issues in Cortex XDR Agent 7.9-CE](https://cortex-docs.paloaltonetworks.com/7.x/cortex-xdr-agent-7.9-ce-release-information/addressed-issues-in-cortex-xdr-agent-7.9-ce.md): Addressed issues in Cortex XDR agent 7.9-CE release for Windows, macOS, iOS, and Linux. - [Changes to Default Behavior in Cortex XDR Agent 7.9-CE](https://cortex-docs.paloaltonetworks.com/7.x/cortex-xdr-agent-7.9-ce-release-information/changes-to-default-behavior-in-cortex-xdr-agent-7.9-ce.md): Changes to default behavior in Cortex XDR agent 7.9-CE for Windows, macOS, and Linux endpoints. - [Changes to Default Behavior in Cortex XDR Agent 7.9-CE](https://cortex-docs.paloaltonetworks.com/7.x/cortex-xdr-agent-7.9-ce-release-information/changes-to-default-behavior-in-cortex-xdr-agent-7.9-ce/changes-to-default-behavior-in-cortex-xdr-agent-7.9-ce.md): Changes to default behavior in Cortex XDR agent 7.9-CE for Windows, macOS, and Linux endpoints. - [Known Issues in Cortex XDR Agent 7.9-CE](https://cortex-docs.paloaltonetworks.com/7.x/cortex-xdr-agent-7.9-ce-release-information/known-issues-in-cortex-xdr-agent-7.9-ce.md) * [Cortex XDR Agent 7.5 CE Release Information](https://cortex-docs.paloaltonetworks.com/7.x/7.5ce-eol/cortex-xdr-agent-7.5-ce-release-information.md): New features, default behavior changes, and known issues in Cortex XDR agent 7.5 CE release * [Features Introduced in Cortex XDR Agent 7.5 CE](https://cortex-docs.paloaltonetworks.com/7.x/7.5ce-eol/cortex-xdr-agent-7.5-ce-release-information/features-introduced-in-cortex-xdr-agent-7.5-ce.md): Describes the new features introduced in Cortex XDR agent 7.5 CE releases. * [Features Introduced in Cortex XDR Agent 7.5.102](https://cortex-docs.paloaltonetworks.com/7.x/7.5ce-eol/cortex-xdr-agent-7.5-ce-release-information/features-introduced-in-cortex-xdr-agent-7.5-ce/features-introduced-in-cortex-xdr-agent-7.5.102.md): Describes the new features introduced in Cortex XDR agent 7.5 CE releases. * [Changes to Default Behavior in Cortex XDR Agent 7.5 CE](https://cortex-docs.paloaltonetworks.com/7.x/7.5ce-eol/cortex-xdr-agent-7.5-ce-release-information/changes-to-default-behavior-in-cortex-xdr-agent-7.5-ce.md): Changes to default behavior in Cortex XDR agent 7.5 CE for Windows, macOS, and Linux endpoints. * [Changes to Default Behavior in Cortex XDR Agent 7.5.100](https://cortex-docs.paloaltonetworks.com/7.x/7.5ce-eol/cortex-xdr-agent-7.5-ce-release-information/changes-to-default-behavior-in-cortex-xdr-agent-7.5-ce/changes-to-default-behavior-in-cortex-xdr-agent-7.5.100.md): Changes to default behavior in Cortex XDR agent 7.5 CE for Windows, macOS, and Linux endpoints. * [Cortex XDR Agent Known Issues](https://cortex-docs.paloaltonetworks.com/7.x/7.5ce-eol/cortex-xdr-agent-7.5-ce-release-information/cortex-xdr-agent-known-issues.md): See the list of the known issues in Cortex XDR agent 7.5 CE. * [Addressed Issues in Cortex XDR Agent 7.5 CE](https://cortex-docs.paloaltonetworks.com/7.x/7.5ce-eol/cortex-xdr-agent-7.5-ce-release-information/addressed-issues-in-cortex-xdr-agent-7.5-ce.md): Addressed issues in Cortex XDR agent 7.5 CE release for Windows, macOS, and Linux. ## Cortex XDR Agent 6.x - [Traps™ Agent Release Information](https://cortex-docs.paloaltonetworks.com/6.1-eol/traps-tm-agent-release-notes-6.1.9-eol-windows-only/readme.md) - [Features Introduced in Traps Agent 6.1.0](https://cortex-docs.paloaltonetworks.com/6.1-eol/traps-tm-agent-release-notes-6.1.9-eol-windows-only/features-introduced-in-traps-agent-6.1.0.md) - [Changes to Default Behavior](https://cortex-docs.paloaltonetworks.com/6.1-eol/traps-tm-agent-release-notes-6.1.9-eol-windows-only/changes-to-default-behavior.md) - [Associated Software and Content Versions](https://cortex-docs.paloaltonetworks.com/6.1-eol/traps-tm-agent-release-notes-6.1.9-eol-windows-only/associated-software-and-content-versions.md) - [Limitations](https://cortex-docs.paloaltonetworks.com/6.1-eol/traps-tm-agent-release-notes-6.1.9-eol-windows-only/limitations.md) - [Known Issues in Traps Agent 6.1](https://cortex-docs.paloaltonetworks.com/6.1-eol/traps-tm-agent-release-notes-6.1.9-eol-windows-only/known-issues-in-traps-agent-6.1.md) - [Addressed Issues in Traps Agent 6.1.9-hotfix (Windows)](https://cortex-docs.paloaltonetworks.com/6.1-eol/traps-tm-agent-release-notes-6.1.9-eol-windows-only/addressed-issues-in-traps-agent-6.1.9-hotfix-windows.md) - [Addressed Issues in Traps Agent 6.1.9](https://cortex-docs.paloaltonetworks.com/6.1-eol/traps-tm-agent-release-notes-6.1.9-eol-windows-only/addressed-issues-in-traps-agent-6.1.9.md) - [Addressed Issues in Traps Agent 6.1.7/8-hotfix](https://cortex-docs.paloaltonetworks.com/6.1-eol/traps-tm-agent-release-notes-6.1.9-eol-windows-only/addressed-issues-in-traps-agent-6.1.7-8-hotfix.md) - [Addressed Issues in Traps Agent 6.1.8](https://cortex-docs.paloaltonetworks.com/6.1-eol/traps-tm-agent-release-notes-6.1.9-eol-windows-only/addressed-issues-in-traps-agent-6.1.8.md) - [Addressed Issues for Traps Agent 6.1.7-hotfix (Mac & Linux)](https://cortex-docs.paloaltonetworks.com/6.1-eol/traps-tm-agent-release-notes-6.1.9-eol-windows-only/addressed-issues-for-traps-agent-6.1.7-hotfix-mac-and-linux.md) - [Addressed Issues in Traps Agent 6.1.7](https://cortex-docs.paloaltonetworks.com/6.1-eol/traps-tm-agent-release-notes-6.1.9-eol-windows-only/addressed-issues-in-traps-agent-6.1.7.md) - [Addressed Issues in Traps Agent 6.1.6](https://cortex-docs.paloaltonetworks.com/6.1-eol/traps-tm-agent-release-notes-6.1.9-eol-windows-only/addressed-issues-in-traps-agent-6.1.6.md) - [Addressed Issues in Traps Agent 6.1.5-h1](https://cortex-docs.paloaltonetworks.com/6.1-eol/traps-tm-agent-release-notes-6.1.9-eol-windows-only/addressed-issues-in-traps-agent-6.1.5-h1.md) - [Addressed Issues in Traps Agent 6.1.5](https://cortex-docs.paloaltonetworks.com/6.1-eol/traps-tm-agent-release-notes-6.1.9-eol-windows-only/addressed-issues-in-traps-agent-6.1.5.md) - [Addressed Issues in Traps Agent 6.1.4-h1](https://cortex-docs.paloaltonetworks.com/6.1-eol/traps-tm-agent-release-notes-6.1.9-eol-windows-only/addressed-issues-in-traps-agent-6.1.4-h1.md) - [Addressed Issues in Traps Agent 6.1.3](https://cortex-docs.paloaltonetworks.com/6.1-eol/traps-tm-agent-release-notes-6.1.9-eol-windows-only/addressed-issues-in-traps-agent-6.1.3.md) - [Addressed Issues in Traps Agent 6.1.2](https://cortex-docs.paloaltonetworks.com/6.1-eol/traps-tm-agent-release-notes-6.1.9-eol-windows-only/addressed-issues-in-traps-agent-6.1.2.md) - [Addressed Issues in Traps Agent 6.1.1](https://cortex-docs.paloaltonetworks.com/6.1-eol/traps-tm-agent-release-notes-6.1.9-eol-windows-only/addressed-issues-in-traps-agent-6.1.1.md) - [Addressed Issues in Traps Agent 6.1.0](https://cortex-docs.paloaltonetworks.com/6.1-eol/traps-tm-agent-release-notes-6.1.9-eol-windows-only/addressed-issues-in-traps-agent-6.1.0.md) ## Cortex XDR Agent 5.x - [Features Introduced in Traps Agent 5.0 (EoL)](https://cortex-docs.paloaltonetworks.com/5.0/traps-agent-release/readme.md): The following topics describe the new features introduced in Traps agent 5.0 releases. - [Changes to Default Behavior](https://cortex-docs.paloaltonetworks.com/5.0/traps-agent-release/changes-to-default-behavior.md): Changes to Default Behavior in Traps agent 5.0 releases. - [Associated Software and Content Versions](https://cortex-docs.paloaltonetworks.com/5.0/traps-agent-release/associated-software-and-content-versions.md) - [Compatibility](https://cortex-docs.paloaltonetworks.com/5.0/traps-agent-release/compatibility.md): Trap agent 5.0 releases are compatible only with specific platforms. - [Known Issues in Traps Agent 5.0](https://cortex-docs.paloaltonetworks.com/5.0/traps-agent-release/known-issues-in-traps-agent-5.0.md): Known issues in Traps agent 5.0 releases. - [Addressed Issues in Traps Agent 5.0](https://cortex-docs.paloaltonetworks.com/5.0/traps-agent-release/addressed-issues-in-traps-agent-5.0.md): List of addressed issues in Traps agent 5.0 releases. ## Cortex Cloud Runtime Security - [Cortex Cloud Runtime Security Release Information](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security-rn/cortex-cloud-runtime-security-release-information.md) - [Features introduced in 2026](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security-rn/cortex-cloud-runtime-security-release-information/features-introduced-in-2026-cloud.md) - [September 6, 2026](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security-rn/cortex-cloud-runtime-security-release-information/features-introduced-in-2026-cloud/september-6-2026.md) - [July 2026](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security-rn/cortex-cloud-runtime-security-release-information/features-introduced-in-2026-cloud/july-2026.md) - [Release Highlights](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security-rn/cortex-cloud-runtime-security-release-information/features-introduced-in-2026-cloud/july-2026/release-highlights.md) - [Feature Enhancements](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security-rn/cortex-cloud-runtime-security-release-information/features-introduced-in-2026-cloud/july-2026/feature-enhancements.md) - [Changed Features](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security-rn/cortex-cloud-runtime-security-release-information/features-introduced-in-2026-cloud/july-2026/changed-features.md) - [July 20, 2026](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security-rn/cortex-cloud-runtime-security-release-information/features-introduced-in-2026-cloud/july-20-2026.md) - [May 17, 2026](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security-rn/cortex-cloud-runtime-security-release-information/features-introduced-in-2026-cloud/may-17-2026.md) - [May 2026](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security-rn/cortex-cloud-runtime-security-release-information/features-introduced-in-2026-cloud/may-2026.md) - [Release Highlights](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security-rn/cortex-cloud-runtime-security-release-information/features-introduced-in-2026-cloud/may-2026/release-highlights.md) - [Feature Enhancements](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security-rn/cortex-cloud-runtime-security-release-information/features-introduced-in-2026-cloud/may-2026/feature-enhancements.md) - [Changed Features](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security-rn/cortex-cloud-runtime-security-release-information/features-introduced-in-2026-cloud/may-2026/changed-features.md) - [February 22, 2026](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security-rn/cortex-cloud-runtime-security-release-information/features-introduced-in-2026-cloud/february-22-2026.md) - [February 8, 2026](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security-rn/cortex-cloud-runtime-security-release-information/features-introduced-in-2026-cloud/february-08-2026.md) - [February 2026](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security-rn/cortex-cloud-runtime-security-release-information/features-introduced-in-2026-cloud/february-2026.md) - [Release Highlights](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security-rn/cortex-cloud-runtime-security-release-information/features-introduced-in-2026-cloud/february-2026/release-highlights.md) - [Feature Enhancements](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security-rn/cortex-cloud-runtime-security-release-information/features-introduced-in-2026-cloud/february-2026/feature-enhancements.md) - [AI Security](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security-rn/cortex-cloud-runtime-security-release-information/features-introduced-in-2026-cloud/february-2026/feature-enhancements/ai-security.md) - [Application Security](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security-rn/cortex-cloud-runtime-security-release-information/features-introduced-in-2026-cloud/february-2026/feature-enhancements/application-security.md) - [ASPM](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security-rn/cortex-cloud-runtime-security-release-information/features-introduced-in-2026-cloud/february-2026/feature-enhancements/aspm.md) - [Broker VM](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security-rn/cortex-cloud-runtime-security-release-information/features-introduced-in-2026-cloud/february-2026/feature-enhancements/broker-vm.md) - [Cloud ASM](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security-rn/cortex-cloud-runtime-security-release-information/features-introduced-in-2026-cloud/february-2026/feature-enhancements/cloud-asm.md) - [Cloud Workload Rules](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security-rn/cortex-cloud-runtime-security-release-information/features-introduced-in-2026-cloud/february-2026/feature-enhancements/cloud-workload-rules.md): CWP - [Compliance](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security-rn/cortex-cloud-runtime-security-release-information/features-introduced-in-2026-cloud/february-2026/feature-enhancements/compliance.md) - [Cortex Agentix Assistant](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security-rn/cortex-cloud-runtime-security-release-information/features-introduced-in-2026-cloud/february-2026/feature-enhancements/cortex-agentix-assistant.md) - [Cortex Query Language (XQL)](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security-rn/cortex-cloud-runtime-security-release-information/features-introduced-in-2026-cloud/february-2026/feature-enhancements/cortex-query-language-xql.md) - [CSPM](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security-rn/cortex-cloud-runtime-security-release-information/features-introduced-in-2026-cloud/february-2026/feature-enhancements/cspm.md) - [Data Security](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security-rn/cortex-cloud-runtime-security-release-information/features-introduced-in-2026-cloud/february-2026/feature-enhancements/data-security.md) - [Endpoint](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security-rn/cortex-cloud-runtime-security-release-information/features-introduced-in-2026-cloud/february-2026/feature-enhancements/endpoint.md) - [External Data Management](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security-rn/cortex-cloud-runtime-security-release-information/features-introduced-in-2026-cloud/february-2026/feature-enhancements/external-data-management.md) - [KSPM](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security-rn/cortex-cloud-runtime-security-release-information/features-introduced-in-2026-cloud/february-2026/feature-enhancements/kspm.md) - [Licensing](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security-rn/cortex-cloud-runtime-security-release-information/features-introduced-in-2026-cloud/february-2026/feature-enhancements/licensing.md) - [Playbooks](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security-rn/cortex-cloud-runtime-security-release-information/features-introduced-in-2026-cloud/february-2026/feature-enhancements/playbooks.md) - [Playbooks and Scripts](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security-rn/cortex-cloud-runtime-security-release-information/features-introduced-in-2026-cloud/february-2026/feature-enhancements/playbooks-and-scripts.md) - [RBAC and SBAC permissions](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security-rn/cortex-cloud-runtime-security-release-information/features-introduced-in-2026-cloud/february-2026/feature-enhancements/rbac-and-sbac-permissions.md) - [Vulnerablity Management](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security-rn/cortex-cloud-runtime-security-release-information/features-introduced-in-2026-cloud/february-2026/feature-enhancements/vulnerablity-management.md) - [XDR Collectors](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security-rn/cortex-cloud-runtime-security-release-information/features-introduced-in-2026-cloud/february-2026/feature-enhancements/xdr-collectors.md) - [Changed Features](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security-rn/cortex-cloud-runtime-security-release-information/features-introduced-in-2026-cloud/february-2026/changed-features.md) - [Features introduced in 2025](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security-rn/cortex-cloud-runtime-security-release-information/features-introduced-in-2025-cloud.md) - [December 22, 2025](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security-rn/cortex-cloud-runtime-security-release-information/features-introduced-in-2025-cloud/december-22-2025.md) - [November 23, 2025](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security-rn/cortex-cloud-runtime-security-release-information/features-introduced-in-2025-cloud/november-23-2025.md) - [November 2025](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security-rn/cortex-cloud-runtime-security-release-information/features-introduced-in-2025-cloud/november-2025.md) - [Release Highlights](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security-rn/cortex-cloud-runtime-security-release-information/features-introduced-in-2025-cloud/november-2025/release-highlights.md) - [Feature Enhancements](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security-rn/cortex-cloud-runtime-security-release-information/features-introduced-in-2025-cloud/november-2025/feature-enhancements.md) - [Changed Features](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security-rn/cortex-cloud-runtime-security-release-information/features-introduced-in-2025-cloud/november-2025/changed-features.md) - [July 2025](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security-rn/cortex-cloud-runtime-security-release-information/features-introduced-in-2025-cloud/july-2025.md) - [Release Highlights](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security-rn/cortex-cloud-runtime-security-release-information/features-introduced-in-2025-cloud/july-2025/release-highlights.md) - [Feature Enhancements](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security-rn/cortex-cloud-runtime-security-release-information/features-introduced-in-2025-cloud/july-2025/feature-enhancements.md) - [Changed Features](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security-rn/cortex-cloud-runtime-security-release-information/features-introduced-in-2025-cloud/july-2025/changed-features.md) - [April 2025](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security-rn/cortex-cloud-runtime-security-release-information/features-introduced-in-2025-cloud/april-2025.md) - [Release Highlights](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security-rn/cortex-cloud-runtime-security-release-information/features-introduced-in-2025-cloud/april-2025/release-highlights.md) - [Feature Enhancements](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security-rn/cortex-cloud-runtime-security-release-information/features-introduced-in-2025-cloud/april-2025/feature-enhancements.md) - [Maintenance releases](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security-rn/cortex-cloud-runtime-security-release-information/maintenance-releases.md) - [Broker VM 32.0.52 (Major)](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security-rn/cortex-cloud-runtime-security-release-information/maintenance-releases/broker-vm-32052-major.md) - [Broker VM 31.100.2](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security-rn/cortex-cloud-runtime-security-release-information/maintenance-releases/broker-vm-311002.md) - [Broker VM 32.0.51 (Major)](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security-rn/cortex-cloud-runtime-security-release-information/maintenance-releases/broker-vm-32051-major.md) - [XDR Collectors 1.5.3 (Major)](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security-rn/cortex-cloud-runtime-security-release-information/maintenance-releases/xdr-collectors-153-major.md) - [XDR Collectors 1.4.3 (Major)](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security-rn/cortex-cloud-runtime-security-release-information/maintenance-releases/xdr-collectors-143-major.md) - [Previous maintenance releases](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security-rn/cortex-cloud-runtime-security-release-information/previous-maintenance-releases.md) - [Broker VM](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security-rn/cortex-cloud-runtime-security-release-information/previous-maintenance-releases/broker-vm.md) - [Broker VM 31.0.58 (Major)](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security-rn/cortex-cloud-runtime-security-release-information/previous-maintenance-releases/broker-vm/broker-vm-31058-major.md) - [Broker VM 31.0.57 (Major)](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security-rn/cortex-cloud-runtime-security-release-information/previous-maintenance-releases/broker-vm/broker-vm-31057-major.md) - [Broker VM 30.0.63 (Major)](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security-rn/cortex-cloud-runtime-security-release-information/previous-maintenance-releases/broker-vm/broker-vm-30063-major.md) - [Broker VM 30.0.61 (Major)](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security-rn/cortex-cloud-runtime-security-release-information/previous-maintenance-releases/broker-vm/broker-vm-30061-major.md) - [Broker VM 30.0.52 (Major)](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security-rn/cortex-cloud-runtime-security-release-information/previous-maintenance-releases/broker-vm/broker-vm-30052-major.md) - [Broker VM 29.0.77 (Major)](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security-rn/cortex-cloud-runtime-security-release-information/previous-maintenance-releases/broker-vm/broker-vm-29077-major.md) - [Broker VM 29.0.71 (Major)](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security-rn/cortex-cloud-runtime-security-release-information/previous-maintenance-releases/broker-vm/broker-vm-29071-major.md) - [Broker VM 28.0.99 (Major)](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security-rn/cortex-cloud-runtime-security-release-information/previous-maintenance-releases/broker-vm/broker-vm-28099-major.md) - [Broker VM 28.0.96](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security-rn/cortex-cloud-runtime-security-release-information/previous-maintenance-releases/broker-vm/broker-vm-28096-major.md) - [Broker VM 27.100.18](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security-rn/cortex-cloud-runtime-security-release-information/previous-maintenance-releases/broker-vm/broker-vm-2710018.md) - [Broker VM 27.100.17](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security-rn/cortex-cloud-runtime-security-release-information/previous-maintenance-releases/broker-vm/broker-vm-2710017.md) - [Broker VM 27.0.47](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security-rn/cortex-cloud-runtime-security-release-information/previous-maintenance-releases/broker-vm/broker-vm-27047-major.md) - [Broker VM 26.100.10](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security-rn/cortex-cloud-runtime-security-release-information/previous-maintenance-releases/broker-vm/broker-vm-2610010.md) - [Broker VM 26.100.3](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security-rn/cortex-cloud-runtime-security-release-information/previous-maintenance-releases/broker-vm/broker-vm-261003.md) - [Broker VM 26.0.119](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security-rn/cortex-cloud-runtime-security-release-information/previous-maintenance-releases/broker-vm/broker-vm-260119-major.md) - [XDR Collectors](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security-rn/cortex-cloud-runtime-security-release-information/previous-maintenance-releases/xdr-collectors.md) - [XDR Collectors 1.5.2 (Major)](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security-rn/cortex-cloud-runtime-security-release-information/previous-maintenance-releases/xdr-collectors/xdr-collectors-152-major-21.md) - [XDR Collectors 1.4.3 (Major)](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security-rn/cortex-cloud-runtime-security-release-information/previous-maintenance-releases/xdr-collectors/xdr-collectors-143-major-21.md) - [XDR Collectors 1.5.2 (Major)](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security-rn/cortex-cloud-runtime-security-release-information/previous-maintenance-releases/xdr-collectors/xdr-collectors-152-major-20.md) - [XDR Collectors 1.5.1 (Major)](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security-rn/cortex-cloud-runtime-security-release-information/previous-maintenance-releases/xdr-collectors/xdr-collectors-151-major-20.md) - [XDR Collectors 1.4.3 (Major)](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security-rn/cortex-cloud-runtime-security-release-information/previous-maintenance-releases/xdr-collectors/xdr-collectors-143-major-20.md) - [XDR Collectors 1.5.1 (Major)](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security-rn/cortex-cloud-runtime-security-release-information/previous-maintenance-releases/xdr-collectors/xdr-collectors-151-major-13.md) - [XDR Collectors 1.4.3 (Major)](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security-rn/cortex-cloud-runtime-security-release-information/previous-maintenance-releases/xdr-collectors/xdr-collectors-143-major-13.md) - [XDR Collectors 1.5.1 (Major)](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security-rn/cortex-cloud-runtime-security-release-information/previous-maintenance-releases/xdr-collectors/xdr-collectors-151-major.md) - [XDR Collectors 1.4.3 (Major)](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security-rn/cortex-cloud-runtime-security-release-information/previous-maintenance-releases/xdr-collectors/xdr-collectors-143-major.md) - [XDR Collectors 1.5.0 (Major)](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security-rn/cortex-cloud-runtime-security-release-information/previous-maintenance-releases/xdr-collectors/xdr-collectors-150-major.md) - [Compliance standards updates](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security-rn/cortex-cloud-runtime-security-release-information/compliance-standards-updates.md) - [October 2026](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security-rn/cortex-cloud-runtime-security-release-information/compliance-standards-updates/october-2026.md) - [July 2026](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security-rn/cortex-cloud-runtime-security-release-information/compliance-standards-updates/july-2026.md) - [June 2026](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security-rn/cortex-cloud-runtime-security-release-information/compliance-standards-updates/june-2026.md) - [April 2026](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security-rn/cortex-cloud-runtime-security-release-information/compliance-standards-updates/april-2026.md) - [February 2026](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security-rn/cortex-cloud-runtime-security-release-information/compliance-standards-updates/february-2026.md) - [API Ingestions](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security-rn/cortex-cloud-runtime-security-release-information/api-ingestions.md) - [September 2026](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security-rn/cortex-cloud-runtime-security-release-information/api-ingestions/september-2026.md) - [August 2026](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security-rn/cortex-cloud-runtime-security-release-information/api-ingestions/august-2026.md) - [July 2026](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security-rn/cortex-cloud-runtime-security-release-information/api-ingestions/july-2026.md) - [May 2026](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security-rn/cortex-cloud-runtime-security-release-information/api-ingestions/may-2026.md) ## Cortex Cloud Posture Management - [Cortex Cloud Posture Management Release Information](https://cortex-docs.paloaltonetworks.com/cloud-posture-management-rn/cortex-cloud-posture-management-release-information.md) - [Features introduced in 2026](https://cortex-docs.paloaltonetworks.com/cloud-posture-management-rn/cortex-cloud-posture-management-release-information/features-introduced-in-2026-cloud.md) - [September 6, 2026](https://cortex-docs.paloaltonetworks.com/cloud-posture-management-rn/cortex-cloud-posture-management-release-information/features-introduced-in-2026-cloud/september-6-2026.md) - [July 2026](https://cortex-docs.paloaltonetworks.com/cloud-posture-management-rn/cortex-cloud-posture-management-release-information/features-introduced-in-2026-cloud/july-2026.md) - [Release Highlights](https://cortex-docs.paloaltonetworks.com/cloud-posture-management-rn/cortex-cloud-posture-management-release-information/features-introduced-in-2026-cloud/july-2026/release-highlights.md) - [Feature Enhancements](https://cortex-docs.paloaltonetworks.com/cloud-posture-management-rn/cortex-cloud-posture-management-release-information/features-introduced-in-2026-cloud/july-2026/feature-enhancements.md) - [Changed Features](https://cortex-docs.paloaltonetworks.com/cloud-posture-management-rn/cortex-cloud-posture-management-release-information/features-introduced-in-2026-cloud/july-2026/changed-features.md) - [May 17, 2026](https://cortex-docs.paloaltonetworks.com/cloud-posture-management-rn/cortex-cloud-posture-management-release-information/features-introduced-in-2026-cloud/may-17-2026.md) - [May 2026](https://cortex-docs.paloaltonetworks.com/cloud-posture-management-rn/cortex-cloud-posture-management-release-information/features-introduced-in-2026-cloud/may-2026.md) - [Release Highlights](https://cortex-docs.paloaltonetworks.com/cloud-posture-management-rn/cortex-cloud-posture-management-release-information/features-introduced-in-2026-cloud/may-2026/release-highlights.md) - [Feature Enhancements](https://cortex-docs.paloaltonetworks.com/cloud-posture-management-rn/cortex-cloud-posture-management-release-information/features-introduced-in-2026-cloud/may-2026/feature-enhancements.md) - [Changed Features](https://cortex-docs.paloaltonetworks.com/cloud-posture-management-rn/cortex-cloud-posture-management-release-information/features-introduced-in-2026-cloud/may-2026/changed-features.md) - [February 22, 2026](https://cortex-docs.paloaltonetworks.com/cloud-posture-management-rn/cortex-cloud-posture-management-release-information/features-introduced-in-2026-cloud/february-22-2026.md) - [February 8, 2026](https://cortex-docs.paloaltonetworks.com/cloud-posture-management-rn/cortex-cloud-posture-management-release-information/features-introduced-in-2026-cloud/february-08-2026.md) - [February 2026](https://cortex-docs.paloaltonetworks.com/cloud-posture-management-rn/cortex-cloud-posture-management-release-information/features-introduced-in-2026-cloud/february-2026.md) - [Release Highlights](https://cortex-docs.paloaltonetworks.com/cloud-posture-management-rn/cortex-cloud-posture-management-release-information/features-introduced-in-2026-cloud/february-2026/release-highlights.md) - [Feature Enhancements](https://cortex-docs.paloaltonetworks.com/cloud-posture-management-rn/cortex-cloud-posture-management-release-information/features-introduced-in-2026-cloud/february-2026/feature-enhancements.md) - [AI Security](https://cortex-docs.paloaltonetworks.com/cloud-posture-management-rn/cortex-cloud-posture-management-release-information/features-introduced-in-2026-cloud/february-2026/feature-enhancements/ai-security.md) - [Application Security](https://cortex-docs.paloaltonetworks.com/cloud-posture-management-rn/cortex-cloud-posture-management-release-information/features-introduced-in-2026-cloud/february-2026/feature-enhancements/application-security.md) - [ASPM](https://cortex-docs.paloaltonetworks.com/cloud-posture-management-rn/cortex-cloud-posture-management-release-information/features-introduced-in-2026-cloud/february-2026/feature-enhancements/aspm.md) - [Broker VM](https://cortex-docs.paloaltonetworks.com/cloud-posture-management-rn/cortex-cloud-posture-management-release-information/features-introduced-in-2026-cloud/february-2026/feature-enhancements/broker-vm.md) - [Cloud ASM](https://cortex-docs.paloaltonetworks.com/cloud-posture-management-rn/cortex-cloud-posture-management-release-information/features-introduced-in-2026-cloud/february-2026/feature-enhancements/cloud-asm.md) - [Cloud Workspace Rules (CWP)](https://cortex-docs.paloaltonetworks.com/cloud-posture-management-rn/cortex-cloud-posture-management-release-information/features-introduced-in-2026-cloud/february-2026/feature-enhancements/cloud-workspace-rules-cwp.md) - [Compliance](https://cortex-docs.paloaltonetworks.com/cloud-posture-management-rn/cortex-cloud-posture-management-release-information/features-introduced-in-2026-cloud/february-2026/feature-enhancements/compliance.md) - [Cortex Agentic Assistant](https://cortex-docs.paloaltonetworks.com/cloud-posture-management-rn/cortex-cloud-posture-management-release-information/features-introduced-in-2026-cloud/february-2026/feature-enhancements/cortex-agentic-assistant.md) - [Cortex Query Language (XQL)](https://cortex-docs.paloaltonetworks.com/cloud-posture-management-rn/cortex-cloud-posture-management-release-information/features-introduced-in-2026-cloud/february-2026/feature-enhancements/cortex-query-language-xql.md) - [CSPM](https://cortex-docs.paloaltonetworks.com/cloud-posture-management-rn/cortex-cloud-posture-management-release-information/features-introduced-in-2026-cloud/february-2026/feature-enhancements/cspm.md) - [Data Security](https://cortex-docs.paloaltonetworks.com/cloud-posture-management-rn/cortex-cloud-posture-management-release-information/features-introduced-in-2026-cloud/february-2026/feature-enhancements/data-security.md) - [External Data Ingestion and Management](https://cortex-docs.paloaltonetworks.com/cloud-posture-management-rn/cortex-cloud-posture-management-release-information/features-introduced-in-2026-cloud/february-2026/feature-enhancements/external-data-ingestion-and-management.md) - [KSPM](https://cortex-docs.paloaltonetworks.com/cloud-posture-management-rn/cortex-cloud-posture-management-release-information/features-introduced-in-2026-cloud/february-2026/feature-enhancements/kspm.md) - [Licensing](https://cortex-docs.paloaltonetworks.com/cloud-posture-management-rn/cortex-cloud-posture-management-release-information/features-introduced-in-2026-cloud/february-2026/feature-enhancements/licensing.md) - [Playbooks](https://cortex-docs.paloaltonetworks.com/cloud-posture-management-rn/cortex-cloud-posture-management-release-information/features-introduced-in-2026-cloud/february-2026/feature-enhancements/playbooks.md) - [Playbooks and Scripts](https://cortex-docs.paloaltonetworks.com/cloud-posture-management-rn/cortex-cloud-posture-management-release-information/features-introduced-in-2026-cloud/february-2026/feature-enhancements/playbooks-and-scripts.md) - [RBAC and SBAC permissions](https://cortex-docs.paloaltonetworks.com/cloud-posture-management-rn/cortex-cloud-posture-management-release-information/features-introduced-in-2026-cloud/february-2026/feature-enhancements/rbac-and-sbac-permissions.md) - [Vulnerability Management](https://cortex-docs.paloaltonetworks.com/cloud-posture-management-rn/cortex-cloud-posture-management-release-information/features-introduced-in-2026-cloud/february-2026/feature-enhancements/vulnerability-management.md) - [Changed Features](https://cortex-docs.paloaltonetworks.com/cloud-posture-management-rn/cortex-cloud-posture-management-release-information/features-introduced-in-2026-cloud/february-2026/changed-features.md) - [Features introduced in 2025](https://cortex-docs.paloaltonetworks.com/cloud-posture-management-rn/cortex-cloud-posture-management-release-information/features-introduced-in-2025-cloud.md) - [November 23, 2025](https://cortex-docs.paloaltonetworks.com/cloud-posture-management-rn/cortex-cloud-posture-management-release-information/features-introduced-in-2025-cloud/november-23-2025.md) - [November 2025](https://cortex-docs.paloaltonetworks.com/cloud-posture-management-rn/cortex-cloud-posture-management-release-information/features-introduced-in-2025-cloud/november-2025.md) - [Release Highlights](https://cortex-docs.paloaltonetworks.com/cloud-posture-management-rn/cortex-cloud-posture-management-release-information/features-introduced-in-2025-cloud/november-2025/release-highlights.md) - [Feature Enhancements](https://cortex-docs.paloaltonetworks.com/cloud-posture-management-rn/cortex-cloud-posture-management-release-information/features-introduced-in-2025-cloud/november-2025/feature-enhancements.md) - [Changed Features](https://cortex-docs.paloaltonetworks.com/cloud-posture-management-rn/cortex-cloud-posture-management-release-information/features-introduced-in-2025-cloud/november-2025/changed-features.md) - [July 2025](https://cortex-docs.paloaltonetworks.com/cloud-posture-management-rn/cortex-cloud-posture-management-release-information/features-introduced-in-2025-cloud/july-2025.md) - [Release Highlights](https://cortex-docs.paloaltonetworks.com/cloud-posture-management-rn/cortex-cloud-posture-management-release-information/features-introduced-in-2025-cloud/july-2025/release-highlights.md) - [Feature Enhancements](https://cortex-docs.paloaltonetworks.com/cloud-posture-management-rn/cortex-cloud-posture-management-release-information/features-introduced-in-2025-cloud/july-2025/feature-enhancements.md) - [April 2025](https://cortex-docs.paloaltonetworks.com/cloud-posture-management-rn/cortex-cloud-posture-management-release-information/features-introduced-in-2025-cloud/april-2025.md) - [Release Highlights](https://cortex-docs.paloaltonetworks.com/cloud-posture-management-rn/cortex-cloud-posture-management-release-information/features-introduced-in-2025-cloud/april-2025/release-highlights.md) - [Feature Enhancements](https://cortex-docs.paloaltonetworks.com/cloud-posture-management-rn/cortex-cloud-posture-management-release-information/features-introduced-in-2025-cloud/april-2025/feature-enhancements.md) - [Known Issues](https://cortex-docs.paloaltonetworks.com/cloud-posture-management-rn/cortex-cloud-posture-management-release-information/known-issues.md) - [Maintenance releases](https://cortex-docs.paloaltonetworks.com/cloud-posture-management-rn/cortex-cloud-posture-management-release-information/maintenance-releases.md) - [Broker VM 32.0.52 (Major)](https://cortex-docs.paloaltonetworks.com/cloud-posture-management-rn/cortex-cloud-posture-management-release-information/maintenance-releases/broker-vm-32052-major.md) - [Broker VM 31.100.2](https://cortex-docs.paloaltonetworks.com/cloud-posture-management-rn/cortex-cloud-posture-management-release-information/maintenance-releases/broker-vm-311002.md) - [Broker VM 32.0.51 (Major)](https://cortex-docs.paloaltonetworks.com/cloud-posture-management-rn/cortex-cloud-posture-management-release-information/maintenance-releases/broker-vm-32051-major.md) - [Previous maintenance releases](https://cortex-docs.paloaltonetworks.com/cloud-posture-management-rn/cortex-cloud-posture-management-release-information/previous-maintenance-releases.md) - [Broker VM](https://cortex-docs.paloaltonetworks.com/cloud-posture-management-rn/cortex-cloud-posture-management-release-information/previous-maintenance-releases/broker-vm.md) - [Broker VM 31.0.58 (Major)](https://cortex-docs.paloaltonetworks.com/cloud-posture-management-rn/cortex-cloud-posture-management-release-information/previous-maintenance-releases/broker-vm/broker-vm-31058-major.md) - [Broker VM 31.0.57 (Major)](https://cortex-docs.paloaltonetworks.com/cloud-posture-management-rn/cortex-cloud-posture-management-release-information/previous-maintenance-releases/broker-vm/broker-vm-31057-major.md) - [Broker VM 30.0.63 (Major)](https://cortex-docs.paloaltonetworks.com/cloud-posture-management-rn/cortex-cloud-posture-management-release-information/previous-maintenance-releases/broker-vm/broker-vm-30063-major.md) - [Broker VM 30.0.61 (Major)](https://cortex-docs.paloaltonetworks.com/cloud-posture-management-rn/cortex-cloud-posture-management-release-information/previous-maintenance-releases/broker-vm/broker-vm-30061-major.md) - [Broker VM 30.0.52 (Major)](https://cortex-docs.paloaltonetworks.com/cloud-posture-management-rn/cortex-cloud-posture-management-release-information/previous-maintenance-releases/broker-vm/broker-vm-30052-major.md) - [Broker VM 29.0.77 (Major)](https://cortex-docs.paloaltonetworks.com/cloud-posture-management-rn/cortex-cloud-posture-management-release-information/previous-maintenance-releases/broker-vm/broker-vm-29077-major.md) - [Broker VM 29.0.71 (Major)](https://cortex-docs.paloaltonetworks.com/cloud-posture-management-rn/cortex-cloud-posture-management-release-information/previous-maintenance-releases/broker-vm/broker-vm-29071-major.md) - [Broker VM 28.0.99 (Major)](https://cortex-docs.paloaltonetworks.com/cloud-posture-management-rn/cortex-cloud-posture-management-release-information/previous-maintenance-releases/broker-vm/broker-vm-28099-major.md) - [Broker VM 28.0.96](https://cortex-docs.paloaltonetworks.com/cloud-posture-management-rn/cortex-cloud-posture-management-release-information/previous-maintenance-releases/broker-vm/broker-vm-28096-major.md) - [Compliance standards updates](https://cortex-docs.paloaltonetworks.com/cloud-posture-management-rn/cortex-cloud-posture-management-release-information/compliance-standards-updates.md) - [October 2026](https://cortex-docs.paloaltonetworks.com/cloud-posture-management-rn/cortex-cloud-posture-management-release-information/compliance-standards-updates/october-2026.md) - [July 2026](https://cortex-docs.paloaltonetworks.com/cloud-posture-management-rn/cortex-cloud-posture-management-release-information/compliance-standards-updates/july-2026.md) - [June 2026](https://cortex-docs.paloaltonetworks.com/cloud-posture-management-rn/cortex-cloud-posture-management-release-information/compliance-standards-updates/june-2026.md) - [April 2026](https://cortex-docs.paloaltonetworks.com/cloud-posture-management-rn/cortex-cloud-posture-management-release-information/compliance-standards-updates/april-2026.md) - [February 2026](https://cortex-docs.paloaltonetworks.com/cloud-posture-management-rn/cortex-cloud-posture-management-release-information/compliance-standards-updates/february-2026.md) - [API Ingestions](https://cortex-docs.paloaltonetworks.com/cloud-posture-management-rn/cortex-cloud-posture-management-release-information/api-ingestions.md) - [September 2026](https://cortex-docs.paloaltonetworks.com/cloud-posture-management-rn/cortex-cloud-posture-management-release-information/api-ingestions/september-2026.md) - [August 2026](https://cortex-docs.paloaltonetworks.com/cloud-posture-management-rn/cortex-cloud-posture-management-release-information/api-ingestions/august-2026.md) - [July 2026](https://cortex-docs.paloaltonetworks.com/cloud-posture-management-rn/cortex-cloud-posture-management-release-information/api-ingestions/july-2026.md) - [May 2026](https://cortex-docs.paloaltonetworks.com/cloud-posture-management-rn/cortex-cloud-posture-management-release-information/api-ingestions/may-2026.md) ## Cortex AgentiX - [Cortex AgentiX Release Information](https://cortex-docs.paloaltonetworks.com/cortex-agentix-rn/cortex-agentix-release-information.md) - [Features Introduced in This Release](https://cortex-docs.paloaltonetworks.com/cortex-agentix-rn/features-introduced-in-this-release.md) - [September 6, 2026](https://cortex-docs.paloaltonetworks.com/cortex-agentix-rn/features-introduced-in-this-release/september-6-2026.md) - [July 2026](https://cortex-docs.paloaltonetworks.com/cortex-agentix-rn/features-introduced-in-this-release/july-2026.md) - [Release Highlights](https://cortex-docs.paloaltonetworks.com/cortex-agentix-rn/features-introduced-in-this-release/july-2026/release-highlights.md) - [Feature Enhancements](https://cortex-docs.paloaltonetworks.com/cortex-agentix-rn/features-introduced-in-this-release/july-2026/feature-enhancements.md) - [Changed Features](https://cortex-docs.paloaltonetworks.com/cortex-agentix-rn/features-introduced-in-this-release/july-2026/changed-features.md) - [May 2026](https://cortex-docs.paloaltonetworks.com/cortex-agentix-rn/features-introduced-in-this-release/may-2026.md) - [Release Highlights](https://cortex-docs.paloaltonetworks.com/cortex-agentix-rn/features-introduced-in-this-release/may-2026/release-highlights.md) - [Feature Enhancements](https://cortex-docs.paloaltonetworks.com/cortex-agentix-rn/features-introduced-in-this-release/may-2026/feature-enhancements.md) - [Changed Features](https://cortex-docs.paloaltonetworks.com/cortex-agentix-rn/features-introduced-in-this-release/may-2026/changed-features.md) - [February 2026](https://cortex-docs.paloaltonetworks.com/cortex-agentix-rn/features-introduced-in-this-release/february-2026.md) - [Release Highlights](https://cortex-docs.paloaltonetworks.com/cortex-agentix-rn/features-introduced-in-this-release/february-2026/release-highlights.md) - [November 2025](https://cortex-docs.paloaltonetworks.com/cortex-agentix-rn/features-introduced-in-this-release/november-2025.md) - [Feature Enhancements](https://cortex-docs.paloaltonetworks.com/cortex-agentix-rn/features-introduced-in-this-release/november-2025/feature-enhancements.md) - [Marketplace content changes](https://cortex-docs.paloaltonetworks.com/cortex-agentix-rn/features-introduced-in-this-release/november-2025/marketplace-content-changes.md) ## Cortex XSOAR 8 SaaS Release Notes - [Cortex XSOAR Release Information](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-saas-release-notes/cortex-xsoar-release-information.md) - [Features Introduced in This Release](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-saas-release-notes/features-introduced-in-this-release.md) - [July 2026](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-saas-release-notes/features-introduced-in-this-release/july-2026.md) - [Features introduced in previous releases](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-saas-release-notes/features-introduced-in-previous-releases.md) - [Features Introduced in 2026](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-saas-release-notes/features-introduced-in-previous-releases/features-introduced-in-2026.md) - [May 2026](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-saas-release-notes/features-introduced-in-previous-releases/features-introduced-in-2026/may-2026.md) - [February 2026](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-saas-release-notes/features-introduced-in-previous-releases/features-introduced-in-2026/february-2026.md) - [Features Introduced in 2025](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-saas-release-notes/features-introduced-in-previous-releases/features-introduced-in-2025.md) - [November 2025](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-saas-release-notes/features-introduced-in-previous-releases/features-introduced-in-2025/november-2025.md) - [July 2025](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-saas-release-notes/features-introduced-in-previous-releases/features-introduced-in-2025/july-2025.md) - [April 2025](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-saas-release-notes/features-introduced-in-previous-releases/features-introduced-in-2025/april-2025.md) - [February 2025](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-saas-release-notes/features-introduced-in-previous-releases/features-introduced-in-2025/february-2025.md) - [Features Introduced in 2024](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-saas-release-notes/features-introduced-in-previous-releases/features-introduced-in-2024.md) - [September 2024](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-saas-release-notes/features-introduced-in-previous-releases/features-introduced-in-2024/september-2024.md) - [June 2024](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-saas-release-notes/features-introduced-in-previous-releases/features-introduced-in-2024/june-2024.md) - [April 2024](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-saas-release-notes/features-introduced-in-previous-releases/features-introduced-in-2024/april-2024.md) - [February 2024](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-saas-release-notes/features-introduced-in-previous-releases/features-introduced-in-2024/february-2024.md) - [Features Introduced in 2023](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-saas-release-notes/features-introduced-in-previous-releases/features-introduced-in-2023.md) - [October 2023](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-saas-release-notes/features-introduced-in-previous-releases/features-introduced-in-2023/october-2023.md) - [July 2023](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-saas-release-notes/features-introduced-in-previous-releases/features-introduced-in-2023/july-2023.md) - [April 2023](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-saas-release-notes/features-introduced-in-previous-releases/features-introduced-in-2023/april-2023.md) - [January 2023](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-saas-release-notes/features-introduced-in-previous-releases/features-introduced-in-2023/january-2023.md) - [Known Issues](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-saas-release-notes/known-issues.md) ## Cortex XSOAR 8 On-prem Release Notes - [Cortex XSOAR 8 On-prem Releases](https://cortex-docs.paloaltonetworks.com/xsoar-8-opp-release-notes/cortex-xsoar-8-on-prem-releases.md): Major general availability and maintenance releases for Cortex XSOAR 8 On-prem * [Cortex XSOAR Release Information](https://cortex-docs.paloaltonetworks.com/xsoar-8-opp-release-notes/xsoar-opp-release-notes-8.14/cortex-xsoar-release-information.md): New features, addressed issues, and breaking changes in Cortex XSOAR 8.14 On-prem. * [Features Introduced in this Release](https://cortex-docs.paloaltonetworks.com/xsoar-8-opp-release-notes/xsoar-opp-release-notes-8.14/features-introduced-in-this-release.md): New features are available in Cortex XSOAR 8.14 On-prem, including release highlights and feature enhancements. * [Release Highlights](https://cortex-docs.paloaltonetworks.com/xsoar-8-opp-release-notes/xsoar-opp-release-notes-8.14/features-introduced-in-this-release/release-highlights.md) * [Feature Enhancements](https://cortex-docs.paloaltonetworks.com/xsoar-8-opp-release-notes/xsoar-opp-release-notes-8.14/features-introduced-in-this-release/feature-enhancements.md) * [Marketplace Changes](https://cortex-docs.paloaltonetworks.com/xsoar-8-opp-release-notes/xsoar-opp-release-notes-8.14/features-introduced-in-this-release/marketplace-changes.md) * [Maintenance releases in Cortex XSOAR 8.14](https://cortex-docs.paloaltonetworks.com/xsoar-8-opp-release-notes/xsoar-opp-release-notes-8.14/maintenance-releases-in-cortex-xsoar-8.14.md): Maintenance releases for Cortex XSOAR On-prem 8.14. * [Known Issues](https://cortex-docs.paloaltonetworks.com/xsoar-8-opp-release-notes/xsoar-opp-release-notes-8.14/known-issues.md) - [Cortex XSOAR Release Information](https://cortex-docs.paloaltonetworks.com/xsoar-8-opp-release-notes/8.13/cortex-xsoar-release-information.md): New features, addressed issues, and breaking changes in Cortex XSOAR 8.13 On-prem. - [Features introduced in this release](https://cortex-docs.paloaltonetworks.com/xsoar-8-opp-release-notes/8.13/features-introduced-in-this-release.md): New features are available in Cortex XSOAR 8.13. - [Release Highlights](https://cortex-docs.paloaltonetworks.com/xsoar-8-opp-release-notes/8.13/features-introduced-in-this-release/release-highlights.md) - [Feature enhancements](https://cortex-docs.paloaltonetworks.com/xsoar-8-opp-release-notes/8.13/features-introduced-in-this-release/feature-enhancements.md) - [Marketplace Changes](https://cortex-docs.paloaltonetworks.com/xsoar-8-opp-release-notes/8.13/features-introduced-in-this-release/marketplace-changes.md) - [Changed features](https://cortex-docs.paloaltonetworks.com/xsoar-8-opp-release-notes/8.13/features-introduced-in-this-release/changed-features.md) - [Maintenance releases in Cortex XSOAR 8.13](https://cortex-docs.paloaltonetworks.com/xsoar-8-opp-release-notes/8.13/maintenance-releases-in-cortex-xsoar-8.13.md) - [Known Issues](https://cortex-docs.paloaltonetworks.com/xsoar-8-opp-release-notes/8.13/known-issues.md): Cortex XSOAR 8 known issues. * [Cortex XSOAR Release Information](https://cortex-docs.paloaltonetworks.com/xsoar-8-opp-release-notes/8.12/cortex-xsoar-release-information.md): New features, addressed issues, and breaking changes in Cortex XSOAR On-prem. * [Features introduced in this release](https://cortex-docs.paloaltonetworks.com/xsoar-8-opp-release-notes/8.12/features-introduced-in-this-release.md): New features are available in Cortex XSOAR 8.12. * [Release Highlights](https://cortex-docs.paloaltonetworks.com/xsoar-8-opp-release-notes/8.12/features-introduced-in-this-release/release-highlights.md) * [Feature enhancements](https://cortex-docs.paloaltonetworks.com/xsoar-8-opp-release-notes/8.12/features-introduced-in-this-release/feature-enhancements.md) * [Changed features](https://cortex-docs.paloaltonetworks.com/xsoar-8-opp-release-notes/8.12/features-introduced-in-this-release/changed-features.md) * [Marketplace Changes](https://cortex-docs.paloaltonetworks.com/xsoar-8-opp-release-notes/8.12/features-introduced-in-this-release/marketplace-changes.md) * [Maintenance Releases in Cortex XSOAR 8.12](https://cortex-docs.paloaltonetworks.com/xsoar-8-opp-release-notes/8.12/maintenance-releases-in-cortex-xsoar-8.12.md): Maintenance Releases for Cortex XSOAR 8.12 On-prem. * [Known Issues](https://cortex-docs.paloaltonetworks.com/xsoar-8-opp-release-notes/8.12/known-issues.md): Cortex XSOAR 8 known issues. - [Cortex XSOAR Release Information](https://cortex-docs.paloaltonetworks.com/xsoar-8-opp-release-notes/8.11/cortex-xsoar-release-information.md): New features, addressed issues, and breaking changes in Cortex XSOAR On-prem. - [Features introduced in this release](https://cortex-docs.paloaltonetworks.com/xsoar-8-opp-release-notes/8.11/features-introduced-in-this-release.md): New features are available in Cortex XSOAR On-prem 8.11. - [Release Highlights](https://cortex-docs.paloaltonetworks.com/xsoar-8-opp-release-notes/8.11/features-introduced-in-this-release/release-highlights.md) - [Feature enhancements](https://cortex-docs.paloaltonetworks.com/xsoar-8-opp-release-notes/8.11/features-introduced-in-this-release/feature-enhancements.md) - [Changed features](https://cortex-docs.paloaltonetworks.com/xsoar-8-opp-release-notes/8.11/features-introduced-in-this-release/changed-features.md) - [Marketplace Changes](https://cortex-docs.paloaltonetworks.com/xsoar-8-opp-release-notes/8.11/features-introduced-in-this-release/marketplace-changes.md) - [Maintenance Releases in Cortex XSOAR 8.11](https://cortex-docs.paloaltonetworks.com/xsoar-8-opp-release-notes/8.11/maintenance-releases-in-cortex-xsoar-8.11.md): Maintenance Releases for Cortex XSOAR 8.11 On-prem. - [Known Issues](https://cortex-docs.paloaltonetworks.com/xsoar-8-opp-release-notes/8.11/known-issues.md): Cortex XSOAR 8 known issues. * [Cortex XSOAR Release Information](https://cortex-docs.paloaltonetworks.com/xsoar-8-opp-release-notes/8.10/cortex-xsoar-release-information.md): New features, addressed issues, and breaking changes in Cortex XSOAR On-prem. * [Features introduced in this release](https://cortex-docs.paloaltonetworks.com/xsoar-8-opp-release-notes/8.10/features-introduced-in-this-release.md): New features are available in Cortex XSOAR 8.10. * [Release Highlights](https://cortex-docs.paloaltonetworks.com/xsoar-8-opp-release-notes/8.10/features-introduced-in-this-release/release-highlights.md) * [Marketplace Changes](https://cortex-docs.paloaltonetworks.com/xsoar-8-opp-release-notes/8.10/features-introduced-in-this-release/marketplace-changes.md) * [Addressed Issues](https://cortex-docs.paloaltonetworks.com/xsoar-8-opp-release-notes/8.10/features-introduced-in-this-release/addressed-issues.md) * [Maintenance Releases in Cortex XSOAR 8.10](https://cortex-docs.paloaltonetworks.com/xsoar-8-opp-release-notes/8.10/maintenance-releases-in-cortex-xsoar-8.10.md): Maintenance Releases for Cortex XSOAR 8x On-prem. * [Known Issues](https://cortex-docs.paloaltonetworks.com/xsoar-8-opp-release-notes/8.10/known-issues.md): Cortex XSOAR 8 known issues. - [Cortex XSOAR Release Information](https://cortex-docs.paloaltonetworks.com/xsoar-8-opp-release-notes/8.9/cortex-xsoar-release-information.md): New features, addressed issues, and breaking changes in Cortex XSOAR On-prem. - [Features introduced in this release](https://cortex-docs.paloaltonetworks.com/xsoar-8-opp-release-notes/8.9/features-introduced-in-this-release.md): New features are available in Cortex XSOAR 8. - [Release Highlights](https://cortex-docs.paloaltonetworks.com/xsoar-8-opp-release-notes/8.9/features-introduced-in-this-release/release-highlights.md) - [Feature Enhancements](https://cortex-docs.paloaltonetworks.com/xsoar-8-opp-release-notes/8.9/features-introduced-in-this-release/feature-enhancements.md) - [Marketplace Content Changes](https://cortex-docs.paloaltonetworks.com/xsoar-8-opp-release-notes/8.9/features-introduced-in-this-release/marketplace-content-changes.md) - [Maintenance Releases in Cortex XSOAR 8.9](https://cortex-docs.paloaltonetworks.com/xsoar-8-opp-release-notes/8.9/maintenance-releases-in-cortex-xsoar-8.9.md): Maintenance Releases for Cortex XSOAR 8x On-prem. - [Known Issues](https://cortex-docs.paloaltonetworks.com/xsoar-8-opp-release-notes/8.9/known-issues.md): Cortex XSOAR 8 known issues. * [Cortex XSOAR Release Information](https://cortex-docs.paloaltonetworks.com/xsoar-8-opp-release-notes/8.8/cortex-xsoar-release-information.md): New features, addressed issues, and breaking changes in Cortex XSOAR On-prem. * [Features introduced in this release](https://cortex-docs.paloaltonetworks.com/xsoar-8-opp-release-notes/8.8/features-introduced-in-this-release.md): New features are available in Cortex XSOAR 8.8 * [Release Highlights](https://cortex-docs.paloaltonetworks.com/xsoar-8-opp-release-notes/8.8/features-introduced-in-this-release/release-highlights.md) * [Feature Enhancements](https://cortex-docs.paloaltonetworks.com/xsoar-8-opp-release-notes/8.8/features-introduced-in-this-release/feature-enhancements.md) * [Marketplace Content Changes](https://cortex-docs.paloaltonetworks.com/xsoar-8-opp-release-notes/8.8/features-introduced-in-this-release/marketplace-content-changes.md) * [Known Issues](https://cortex-docs.paloaltonetworks.com/xsoar-8-opp-release-notes/8.8/known-issues.md): Cortex XSOAR 8 known issues. - [Cortex XSOAR Release Information](https://cortex-docs.paloaltonetworks.com/xsoar-8-opp-release-notes/8.7/cortex-xsoar-release-information.md): New features, addressed issues, and breaking changes in Cortex XSOAR On-prem. - [Features introduced in this release](https://cortex-docs.paloaltonetworks.com/xsoar-8-opp-release-notes/8.7/features-introduced-in-this-release.md): New features are available in Cortex XSOAR 8. - [Release Highlights](https://cortex-docs.paloaltonetworks.com/xsoar-8-opp-release-notes/8.7/features-introduced-in-this-release/release-highlights.md) - [Feature Enhancements](https://cortex-docs.paloaltonetworks.com/xsoar-8-opp-release-notes/8.7/features-introduced-in-this-release/feature-enhancements.md) - [Marketplace content changes](https://cortex-docs.paloaltonetworks.com/xsoar-8-opp-release-notes/8.7/features-introduced-in-this-release/marketplace-content-changes.md) - [Known Issues](https://cortex-docs.paloaltonetworks.com/xsoar-8-opp-release-notes/8.7/known-issues.md): Cortex XSOAR 8 known issues. * [Cortex XSOAR Release Information](https://cortex-docs.paloaltonetworks.com/xsoar-8-opp-release-notes/8.6/cortex-xsoar-release-information.md): New features, addressed issues, and breaking changes in Cortex XSOAR On-prem. * [Features introduced in this release](https://cortex-docs.paloaltonetworks.com/xsoar-8-opp-release-notes/8.6/features-introduced-in-this-release.md): New features are available in Cortex XSOAR 8. * [Release Highlights](https://cortex-docs.paloaltonetworks.com/xsoar-8-opp-release-notes/8.6/features-introduced-in-this-release/release-highlights.md) * [Feature Enhancements](https://cortex-docs.paloaltonetworks.com/xsoar-8-opp-release-notes/8.6/features-introduced-in-this-release/feature-enhancements.md) * [Marketplace Content Changes](https://cortex-docs.paloaltonetworks.com/xsoar-8-opp-release-notes/8.6/features-introduced-in-this-release/marketplace-content-changes.md) * [Known Issues](https://cortex-docs.paloaltonetworks.com/xsoar-8-opp-release-notes/8.6/known-issues.md): Cortex XSOAR 8 known issues. - [Cortex XSOAR Release Information](https://cortex-docs.paloaltonetworks.com/xsoar-8-opp-release-notes/8.5/cortex-xsoar-release-information.md): New features, addressed issues, and breaking changes in Cortex XSOAR On-prem. - [Features Introduced in This Release](https://cortex-docs.paloaltonetworks.com/xsoar-8-opp-release-notes/8.5/features-introduced-in-this-release.md): New features introduced in Cortex XSOAR 8 SaaS per year. - [Cortex XSOAR 8 On-prem](https://cortex-docs.paloaltonetworks.com/xsoar-8-opp-release-notes/8.5/features-introduced-in-this-release/cortex-xsoar-8-on-prem.md) - [Cortex XSOAR On-prem features](https://cortex-docs.paloaltonetworks.com/xsoar-8-opp-release-notes/8.5/features-introduced-in-this-release/cortex-xsoar-on-prem-features.md) - [Cortex XSOAR 8.5 features](https://cortex-docs.paloaltonetworks.com/xsoar-8-opp-release-notes/8.5/features-introduced-in-this-release/cortex-xsoar-8.5-features.md) - [Known Issues](https://cortex-docs.paloaltonetworks.com/xsoar-8-opp-release-notes/8.5/known-issues.md): Cortex XSOAR 8 known issues. ## Cortex XSOAR 6 Release Notes - [Cortex XSOAR 6 Release Notes](https://cortex-docs.paloaltonetworks.com/xsoar-6-release-notes/cortex-xsoar-6-release-notes.md) * [Release Information](https://cortex-docs.paloaltonetworks.com/xsoar-6-release-notes/6.15/release-information.md): Cortex XSOAR 6.15 release information. * [New Features](https://cortex-docs.paloaltonetworks.com/xsoar-6-release-notes/6.15/new-features.md): Learn about new features in the Cortex XSOAR 6.15 release. * [Addressed Issues](https://cortex-docs.paloaltonetworks.com/xsoar-6-release-notes/6.15/addressed-issues.md): Cortex XSOAR 6.15 addressed issues. * [Known Issues](https://cortex-docs.paloaltonetworks.com/xsoar-6-release-notes/6.15/known-issues.md): Cortex XSOAR known issues. - [Release Information](https://cortex-docs.paloaltonetworks.com/xsoar-6-release-notes/6.14/release-information.md): Cortex XSOAR 6.14 release information. - [New Features](https://cortex-docs.paloaltonetworks.com/xsoar-6-release-notes/6.14/new-features.md): New features are available in Cortex XSOAR 6.14. - [Known Issues](https://cortex-docs.paloaltonetworks.com/xsoar-6-release-notes/6.14/known-issues.md): Cortex XSOAR known issues. - [Minor Releases](https://cortex-docs.paloaltonetworks.com/xsoar-6-release-notes/6.14/minor-releases.md): Cortex XSOAR 6.14 minor release, maintenance release. * [Release Information](https://cortex-docs.paloaltonetworks.com/xsoar-6-release-notes/6.13/release-information.md): Cortex XSOAR 6.13 release information. * [New Features](https://cortex-docs.paloaltonetworks.com/xsoar-6-release-notes/6.13/new-features.md): New features are available in Cortex XSOAR 6.13. * [Addressed Issues](https://cortex-docs.paloaltonetworks.com/xsoar-6-release-notes/6.13/addressed-issues.md): Cortex XSOAR 6.13 addressed issues. * [Known Issues](https://cortex-docs.paloaltonetworks.com/xsoar-6-release-notes/6.13/known-issues.md): Cortex XSOAR known issues. - [Release Information](https://cortex-docs.paloaltonetworks.com/xsoar-6-release-notes/6.12/release-information.md): Cortex XSOAR v6.12 release information. - [New Features](https://cortex-docs.paloaltonetworks.com/xsoar-6-release-notes/6.12/release-information/new-features.md): New features are available in Cortex XSOAR 6.12. - [Addressed Issues](https://cortex-docs.paloaltonetworks.com/xsoar-6-release-notes/6.12/release-information/addressed-issues.md): Cortex XSOAR 6.12 addressed issues. - [Known Issues](https://cortex-docs.paloaltonetworks.com/xsoar-6-release-notes/6.12/release-information/known-issues.md): Cortex XSOAR known issues. - [Minor Releases](https://cortex-docs.paloaltonetworks.com/xsoar-6-release-notes/6.12/release-information/minor-releases.md): Cortex XSOAR 6.12 minor release, maintenance release. ## Cortex Xpanse Expander - [Cortex Xpanse Expander Release Information](https://cortex-docs.paloaltonetworks.com/cortex-xpanse-expander-rn/expander-release-information.md) - [Features introduced in 2026](https://cortex-docs.paloaltonetworks.com/cortex-xpanse-expander-rn/2026-releases.md) - [Release 2.14 (July 2026)](https://cortex-docs.paloaltonetworks.com/cortex-xpanse-expander-rn/2026-releases/july-2026.md) - [Release 2.13 (May 2026)](https://cortex-docs.paloaltonetworks.com/cortex-xpanse-expander-rn/2026-releases/may-2026.md) - [Release 2.12 (February 2026)](https://cortex-docs.paloaltonetworks.com/cortex-xpanse-expander-rn/2026-releases/february-2026.md) - [Features introduced before 2026](https://cortex-docs.paloaltonetworks.com/cortex-xpanse-expander-rn/features-introduced-before-2026.md) - [Features introduced in 2025](https://cortex-docs.paloaltonetworks.com/cortex-xpanse-expander-rn/features-introduced-before-2026/2025-releases.md) - [Release 2.11 (November 2025)](https://cortex-docs.paloaltonetworks.com/cortex-xpanse-expander-rn/features-introduced-before-2026/2025-releases/release-211-november-2025.md) - [Release 2.10 (July 2025)](https://cortex-docs.paloaltonetworks.com/cortex-xpanse-expander-rn/features-introduced-before-2026/2025-releases/release-210-july-2025.md) - [Release 2.9 (April 2025)](https://cortex-docs.paloaltonetworks.com/cortex-xpanse-expander-rn/features-introduced-before-2026/2025-releases/release-29-april-2025.md) - [Release 2.8 (February 2025)](https://cortex-docs.paloaltonetworks.com/cortex-xpanse-expander-rn/features-introduced-before-2026/2025-releases/release-28-february-2025.md) - [Features introduced in 2024](https://cortex-docs.paloaltonetworks.com/cortex-xpanse-expander-rn/features-introduced-before-2026/2024-releases.md) - [Expander Release 2.7 (Minor Releases)](https://cortex-docs.paloaltonetworks.com/cortex-xpanse-expander-rn/features-introduced-before-2026/2024-releases/expander-release-27-minor-releases.md) - [Expander Release 2.7 (September 2024)](https://cortex-docs.paloaltonetworks.com/cortex-xpanse-expander-rn/features-introduced-before-2026/2024-releases/expander-release-27-september-2024.md) - [Expander Release 2.6 (June 2024)](https://cortex-docs.paloaltonetworks.com/cortex-xpanse-expander-rn/features-introduced-before-2026/2024-releases/expander-release-26-june-2024.md) - [Expander Release 2.5 (Minor Releases)](https://cortex-docs.paloaltonetworks.com/cortex-xpanse-expander-rn/features-introduced-before-2026/2024-releases/expander-release-25-minor-releases.md) - [Expander Release 2.5 (April 2024)](https://cortex-docs.paloaltonetworks.com/cortex-xpanse-expander-rn/features-introduced-before-2026/2024-releases/expander-release-25-april-2024.md) - [Expander Release 2.4 (Minor Releases)](https://cortex-docs.paloaltonetworks.com/cortex-xpanse-expander-rn/features-introduced-before-2026/2024-releases/expander-release-24-minor-releases.md) - [Expander Release 2.4 (February 2024)](https://cortex-docs.paloaltonetworks.com/cortex-xpanse-expander-rn/features-introduced-before-2026/2024-releases/expander-release-24-february-2024.md) - [Features introduced in 2023](https://cortex-docs.paloaltonetworks.com/cortex-xpanse-expander-rn/features-introduced-before-2026/2023-releases.md) - [Expander Release 2.3 (Minor Releases)](https://cortex-docs.paloaltonetworks.com/cortex-xpanse-expander-rn/features-introduced-before-2026/2023-releases/expander-release-23-minor-releases.md) - [Expander Release 2.3 (October 2023)](https://cortex-docs.paloaltonetworks.com/cortex-xpanse-expander-rn/features-introduced-before-2026/2023-releases/expander-release-23-october.md) - [Expander Release 2.2 (Minor Releases)](https://cortex-docs.paloaltonetworks.com/cortex-xpanse-expander-rn/features-introduced-before-2026/2023-releases/expander-release-22-minor-releases.md) - [Expander Release 2.2 (June 2023)](https://cortex-docs.paloaltonetworks.com/cortex-xpanse-expander-rn/features-introduced-before-2026/2023-releases/expander-release-22-june.md) - [Expander Release 2.1 (March 2023)](https://cortex-docs.paloaltonetworks.com/cortex-xpanse-expander-rn/features-introduced-before-2026/2023-releases/expander-release-21-march.md) - [Features introduced in 2022](https://cortex-docs.paloaltonetworks.com/cortex-xpanse-expander-rn/features-introduced-before-2026/2022-releases.md) - [Expander Release 2.0 (December 2022)](https://cortex-docs.paloaltonetworks.com/cortex-xpanse-expander-rn/features-introduced-before-2026/2022-releases/expander-release-20-december-2022.md) - [Hotfix Releases](https://cortex-docs.paloaltonetworks.com/cortex-xpanse-expander-rn/hotfix-releases.md) - [January 2025](https://cortex-docs.paloaltonetworks.com/cortex-xpanse-expander-rn/hotfix-releases/january-2025.md) - [November 2024](https://cortex-docs.paloaltonetworks.com/cortex-xpanse-expander-rn/hotfix-releases/november-2024.md) - [October 2024](https://cortex-docs.paloaltonetworks.com/cortex-xpanse-expander-rn/hotfix-releases/october-2024.md) - [August 2024](https://cortex-docs.paloaltonetworks.com/cortex-xpanse-expander-rn/hotfix-releases/august-2024.md) - [July 2024](https://cortex-docs.paloaltonetworks.com/cortex-xpanse-expander-rn/hotfix-releases/july-2024.md) - [June 2024](https://cortex-docs.paloaltonetworks.com/cortex-xpanse-expander-rn/hotfix-releases/june-2024.md) - [May 2024](https://cortex-docs.paloaltonetworks.com/cortex-xpanse-expander-rn/hotfix-releases/may-2024.md) ## Cortex Analytics Content Releases - [Cortex Analytics Content Release Notes](https://cortex-docs.paloaltonetworks.com/cortex-analytics-content-releases/cortex-analytics-content-release-notes.md) - [2026.09.23](https://cortex-docs.paloaltonetworks.com/cortex-analytics-content-releases/cortex-analytics-content-release-notes/2026-09-23.md) - [2026.08.26](https://cortex-docs.paloaltonetworks.com/cortex-analytics-content-releases/cortex-analytics-content-release-notes/2026-08-26.md) - [2026.08.12](https://cortex-docs.paloaltonetworks.com/cortex-analytics-content-releases/cortex-analytics-content-release-notes/2026-08-12.md) - [2026.08.05](https://cortex-docs.paloaltonetworks.com/cortex-analytics-content-releases/cortex-analytics-content-release-notes/2026-08-05.md) - [2026.07.29](https://cortex-docs.paloaltonetworks.com/cortex-analytics-content-releases/cortex-analytics-content-release-notes/2026-07-29.md) - [2026.07.22](https://cortex-docs.paloaltonetworks.com/cortex-analytics-content-releases/cortex-analytics-content-release-notes/2026-07-22.md) - [2026.07.15](https://cortex-docs.paloaltonetworks.com/cortex-analytics-content-releases/cortex-analytics-content-release-notes/2026-07-15.md) - [2026.07.08](https://cortex-docs.paloaltonetworks.com/cortex-analytics-content-releases/cortex-analytics-content-release-notes/2026-07-08.md) - [2026.07.01](https://cortex-docs.paloaltonetworks.com/cortex-analytics-content-releases/cortex-analytics-content-release-notes/2026-07-01.md) - [2026.06.10](https://cortex-docs.paloaltonetworks.com/cortex-analytics-content-releases/cortex-analytics-content-release-notes/2026-06-10.md) - [2026.05.28](https://cortex-docs.paloaltonetworks.com/cortex-analytics-content-releases/cortex-analytics-content-release-notes/2026-05-28.md) - [2026.05.06](https://cortex-docs.paloaltonetworks.com/cortex-analytics-content-releases/cortex-analytics-content-release-notes/2026-05-06.md) - [2026.04.29](https://cortex-docs.paloaltonetworks.com/cortex-analytics-content-releases/cortex-analytics-content-release-notes/2026-04-29.md) - [2026.04.22](https://cortex-docs.paloaltonetworks.com/cortex-analytics-content-releases/cortex-analytics-content-release-notes/2026-04-22.md) - [2026.04.15](https://cortex-docs.paloaltonetworks.com/cortex-analytics-content-releases/cortex-analytics-content-release-notes/2026-04-15.md) - [2026.03.18](https://cortex-docs.paloaltonetworks.com/cortex-analytics-content-releases/cortex-analytics-content-release-notes/2026-03-18.md) - [2026.03.04](https://cortex-docs.paloaltonetworks.com/cortex-analytics-content-releases/cortex-analytics-content-release-notes/2026-03-04.md) - [2026.02.25](https://cortex-docs.paloaltonetworks.com/cortex-analytics-content-releases/cortex-analytics-content-release-notes/2026-02-25.md) - [2026.02.18](https://cortex-docs.paloaltonetworks.com/cortex-analytics-content-releases/cortex-analytics-content-release-notes/2026-02-18.md) - [2026.02.11](https://cortex-docs.paloaltonetworks.com/cortex-analytics-content-releases/cortex-analytics-content-release-notes/2026-02-11.md) - [2026.02.04](https://cortex-docs.paloaltonetworks.com/cortex-analytics-content-releases/cortex-analytics-content-release-notes/2026-02-04.md) - [2026.01.28](https://cortex-docs.paloaltonetworks.com/cortex-analytics-content-releases/cortex-analytics-content-release-notes/2026-01-28.md) - [2026.01.21](https://cortex-docs.paloaltonetworks.com/cortex-analytics-content-releases/cortex-analytics-content-release-notes/2026-01-21.md) - [2026.01.07](https://cortex-docs.paloaltonetworks.com/cortex-analytics-content-releases/cortex-analytics-content-release-notes/2026-01-07.md) - [2025.12.31](https://cortex-docs.paloaltonetworks.com/cortex-analytics-content-releases/cortex-analytics-content-release-notes/2025-12-31.md) - [2025.12.03](https://cortex-docs.paloaltonetworks.com/cortex-analytics-content-releases/cortex-analytics-content-release-notes/2025-12-03.md) - [2025.11.26](https://cortex-docs.paloaltonetworks.com/cortex-analytics-content-releases/cortex-analytics-content-release-notes/2025-11-26.md) - [2025.11.19](https://cortex-docs.paloaltonetworks.com/cortex-analytics-content-releases/cortex-analytics-content-release-notes/2025-11-19.md) - [2025.11.12](https://cortex-docs.paloaltonetworks.com/cortex-analytics-content-releases/cortex-analytics-content-release-notes/2025-11-12.md) - [2025.11.05](https://cortex-docs.paloaltonetworks.com/cortex-analytics-content-releases/cortex-analytics-content-release-notes/2025-11-05.md) - [2025.10.22](https://cortex-docs.paloaltonetworks.com/cortex-analytics-content-releases/cortex-analytics-content-release-notes/2025-10-22.md) - [2025.10.08](https://cortex-docs.paloaltonetworks.com/cortex-analytics-content-releases/cortex-analytics-content-release-notes/2025-10-08.md) - [2025.09.03](https://cortex-docs.paloaltonetworks.com/cortex-analytics-content-releases/cortex-analytics-content-release-notes/2025-09-03.md) - [2025.08.20](https://cortex-docs.paloaltonetworks.com/cortex-analytics-content-releases/cortex-analytics-content-release-notes/2025-08-20.md) - [2025.08.13](https://cortex-docs.paloaltonetworks.com/cortex-analytics-content-releases/cortex-analytics-content-release-notes/2025-08-13.md) - [2025.07.23](https://cortex-docs.paloaltonetworks.com/cortex-analytics-content-releases/cortex-analytics-content-release-notes/2025-07-23.md) - [2025.07.16](https://cortex-docs.paloaltonetworks.com/cortex-analytics-content-releases/cortex-analytics-content-release-notes/2025-07-16.md) - [2025.07.09](https://cortex-docs.paloaltonetworks.com/cortex-analytics-content-releases/cortex-analytics-content-release-notes/2025-07-09.md) - [2025.06.11](https://cortex-docs.paloaltonetworks.com/cortex-analytics-content-releases/cortex-analytics-content-release-notes/2025-06-11.md) - [2025.06.04](https://cortex-docs.paloaltonetworks.com/cortex-analytics-content-releases/cortex-analytics-content-release-notes/2025-06-04.md) - [2025.05.28](https://cortex-docs.paloaltonetworks.com/cortex-analytics-content-releases/cortex-analytics-content-release-notes/2025-05-28.md) - [2025.05.21](https://cortex-docs.paloaltonetworks.com/cortex-analytics-content-releases/cortex-analytics-content-release-notes/2025-05-21.md) - [2025.04.23](https://cortex-docs.paloaltonetworks.com/cortex-analytics-content-releases/cortex-analytics-content-release-notes/2025-04-23.md) - [2025.04.16](https://cortex-docs.paloaltonetworks.com/cortex-analytics-content-releases/cortex-analytics-content-release-notes/2025-04-16.md) - [2025.03.26](https://cortex-docs.paloaltonetworks.com/cortex-analytics-content-releases/cortex-analytics-content-release-notes/2025-03-26.md) - [2025.03.12](https://cortex-docs.paloaltonetworks.com/cortex-analytics-content-releases/cortex-analytics-content-release-notes/2025-03-12.md) - [2025.03.05](https://cortex-docs.paloaltonetworks.com/cortex-analytics-content-releases/cortex-analytics-content-release-notes/2025-03-05.md) - [2025.02.26](https://cortex-docs.paloaltonetworks.com/cortex-analytics-content-releases/cortex-analytics-content-release-notes/2025-02-26.md) - [2025.02.19](https://cortex-docs.paloaltonetworks.com/cortex-analytics-content-releases/cortex-analytics-content-release-notes/2025-02-19.md) - [2025.02.05](https://cortex-docs.paloaltonetworks.com/cortex-analytics-content-releases/cortex-analytics-content-release-notes/2025-02-05.md) - [2025.01.29](https://cortex-docs.paloaltonetworks.com/cortex-analytics-content-releases/cortex-analytics-content-release-notes/2025-01-29.md) - [2025.01.15](https://cortex-docs.paloaltonetworks.com/cortex-analytics-content-releases/cortex-analytics-content-release-notes/2025-01-15.md) - [2024.12.25](https://cortex-docs.paloaltonetworks.com/cortex-analytics-content-releases/cortex-analytics-content-release-notes/2024-12-25.md) - [2024.11.20](https://cortex-docs.paloaltonetworks.com/cortex-analytics-content-releases/cortex-analytics-content-release-notes/2024-11-20.md) - [2024.11.06](https://cortex-docs.paloaltonetworks.com/cortex-analytics-content-releases/cortex-analytics-content-release-notes/2024-11-06.md) - [2024.10.09](https://cortex-docs.paloaltonetworks.com/cortex-analytics-content-releases/cortex-analytics-content-release-notes/2024-10-09.md) - [2024.09.25](https://cortex-docs.paloaltonetworks.com/cortex-analytics-content-releases/cortex-analytics-content-release-notes/2024-09-25.md) - [2024.09.18](https://cortex-docs.paloaltonetworks.com/cortex-analytics-content-releases/cortex-analytics-content-release-notes/2024-09-18.md) - [2024.09.04](https://cortex-docs.paloaltonetworks.com/cortex-analytics-content-releases/cortex-analytics-content-release-notes/2024-09-04.md) - [2024.08.28](https://cortex-docs.paloaltonetworks.com/cortex-analytics-content-releases/cortex-analytics-content-release-notes/2024-08-28.md) - [2024.08.14](https://cortex-docs.paloaltonetworks.com/cortex-analytics-content-releases/cortex-analytics-content-release-notes/2024-08-14.md) - [2024.07.31](https://cortex-docs.paloaltonetworks.com/cortex-analytics-content-releases/cortex-analytics-content-release-notes/2024-07-31.md) - [2024.07.24](https://cortex-docs.paloaltonetworks.com/cortex-analytics-content-releases/cortex-analytics-content-release-notes/2024-07-24.md) - [2024.07.17](https://cortex-docs.paloaltonetworks.com/cortex-analytics-content-releases/cortex-analytics-content-release-notes/2024-07-17.md) - [2024.07.10](https://cortex-docs.paloaltonetworks.com/cortex-analytics-content-releases/cortex-analytics-content-release-notes/2024-07-10.md) - [2024.06.05](https://cortex-docs.paloaltonetworks.com/cortex-analytics-content-releases/cortex-analytics-content-release-notes/2024-06-05.md) - [2024.05.22](https://cortex-docs.paloaltonetworks.com/cortex-analytics-content-releases/cortex-analytics-content-release-notes/2024-05-22.md) - [2024.05.15](https://cortex-docs.paloaltonetworks.com/cortex-analytics-content-releases/cortex-analytics-content-release-notes/2024-05-15.md) - [2024.05.08](https://cortex-docs.paloaltonetworks.com/cortex-analytics-content-releases/cortex-analytics-content-release-notes/2024-05-08.md) - [2024.05.01](https://cortex-docs.paloaltonetworks.com/cortex-analytics-content-releases/cortex-analytics-content-release-notes/2024-05-01.md) - [2024.04.03](https://cortex-docs.paloaltonetworks.com/cortex-analytics-content-releases/cortex-analytics-content-release-notes/2024-04-03.md) - [2024.03.27](https://cortex-docs.paloaltonetworks.com/cortex-analytics-content-releases/cortex-analytics-content-release-notes/2024-03-27.md) - [2024.03.20](https://cortex-docs.paloaltonetworks.com/cortex-analytics-content-releases/cortex-analytics-content-release-notes/2024-03-20.md) - [2024.03.06](https://cortex-docs.paloaltonetworks.com/cortex-analytics-content-releases/cortex-analytics-content-release-notes/2024-03-06.md) - [2024.02.28](https://cortex-docs.paloaltonetworks.com/cortex-analytics-content-releases/cortex-analytics-content-release-notes/2024-02-28.md) ## Cortex XDR Content Update Releases - [Cortex XDR Content Releases](https://cortex-docs.paloaltonetworks.com/cortex-xdr-content-update-releases/cortex-xdr-content-releases.md) - [2460](https://cortex-docs.paloaltonetworks.com/cortex-xdr-content-update-releases/cortex-xdr-content-releases/2460.md) - [2450](https://cortex-docs.paloaltonetworks.com/cortex-xdr-content-update-releases/cortex-xdr-content-releases/2450.md) - [2440](https://cortex-docs.paloaltonetworks.com/cortex-xdr-content-update-releases/cortex-xdr-content-releases/2440.md) - [2430](https://cortex-docs.paloaltonetworks.com/cortex-xdr-content-update-releases/cortex-xdr-content-releases/2430.md) - [2420](https://cortex-docs.paloaltonetworks.com/cortex-xdr-content-update-releases/cortex-xdr-content-releases/2420.md) - [2410](https://cortex-docs.paloaltonetworks.com/cortex-xdr-content-update-releases/cortex-xdr-content-releases/2410.md) - [2400](https://cortex-docs.paloaltonetworks.com/cortex-xdr-content-update-releases/cortex-xdr-content-releases/2400.md) - [2390](https://cortex-docs.paloaltonetworks.com/cortex-xdr-content-update-releases/cortex-xdr-content-releases/2390.md) - [2380](https://cortex-docs.paloaltonetworks.com/cortex-xdr-content-update-releases/cortex-xdr-content-releases/2380.md) - [2370](https://cortex-docs.paloaltonetworks.com/cortex-xdr-content-update-releases/cortex-xdr-content-releases/2370.md) - [2360](https://cortex-docs.paloaltonetworks.com/cortex-xdr-content-update-releases/cortex-xdr-content-releases/2360.md) - [2350](https://cortex-docs.paloaltonetworks.com/cortex-xdr-content-update-releases/cortex-xdr-content-releases/2350.md) - [2340](https://cortex-docs.paloaltonetworks.com/cortex-xdr-content-update-releases/cortex-xdr-content-releases/2340.md) - [2330](https://cortex-docs.paloaltonetworks.com/cortex-xdr-content-update-releases/cortex-xdr-content-releases/2330.md) - [2320](https://cortex-docs.paloaltonetworks.com/cortex-xdr-content-update-releases/cortex-xdr-content-releases/2320.md) - [2310](https://cortex-docs.paloaltonetworks.com/cortex-xdr-content-update-releases/cortex-xdr-content-releases/2310.md) - [2300](https://cortex-docs.paloaltonetworks.com/cortex-xdr-content-update-releases/cortex-xdr-content-releases/2300.md) - [2290](https://cortex-docs.paloaltonetworks.com/cortex-xdr-content-update-releases/cortex-xdr-content-releases/2290.md) - [2280](https://cortex-docs.paloaltonetworks.com/cortex-xdr-content-update-releases/cortex-xdr-content-releases/2280.md) - [2270](https://cortex-docs.paloaltonetworks.com/cortex-xdr-content-update-releases/cortex-xdr-content-releases/2270.md) - [2260](https://cortex-docs.paloaltonetworks.com/cortex-xdr-content-update-releases/cortex-xdr-content-releases/2260.md) - [2250](https://cortex-docs.paloaltonetworks.com/cortex-xdr-content-update-releases/cortex-xdr-content-releases/2250.md) - [2240](https://cortex-docs.paloaltonetworks.com/cortex-xdr-content-update-releases/cortex-xdr-content-releases/2240.md) - [2230](https://cortex-docs.paloaltonetworks.com/cortex-xdr-content-update-releases/cortex-xdr-content-releases/2230.md) - [2220](https://cortex-docs.paloaltonetworks.com/cortex-xdr-content-update-releases/cortex-xdr-content-releases/2220.md) - [2210](https://cortex-docs.paloaltonetworks.com/cortex-xdr-content-update-releases/cortex-xdr-content-releases/2210.md) - [2200](https://cortex-docs.paloaltonetworks.com/cortex-xdr-content-update-releases/cortex-xdr-content-releases/2200.md) - [2190](https://cortex-docs.paloaltonetworks.com/cortex-xdr-content-update-releases/cortex-xdr-content-releases/2190.md) - [2180](https://cortex-docs.paloaltonetworks.com/cortex-xdr-content-update-releases/cortex-xdr-content-releases/2180.md) - [2170](https://cortex-docs.paloaltonetworks.com/cortex-xdr-content-update-releases/cortex-xdr-content-releases/2170.md) - [2160](https://cortex-docs.paloaltonetworks.com/cortex-xdr-content-update-releases/cortex-xdr-content-releases/2160.md) - [2150](https://cortex-docs.paloaltonetworks.com/cortex-xdr-content-update-releases/cortex-xdr-content-releases/2150.md) - [2140](https://cortex-docs.paloaltonetworks.com/cortex-xdr-content-update-releases/cortex-xdr-content-releases/2140.md) - [2130](https://cortex-docs.paloaltonetworks.com/cortex-xdr-content-update-releases/cortex-xdr-content-releases/2130.md) - [2120](https://cortex-docs.paloaltonetworks.com/cortex-xdr-content-update-releases/cortex-xdr-content-releases/2120.md) - [2110](https://cortex-docs.paloaltonetworks.com/cortex-xdr-content-update-releases/cortex-xdr-content-releases/2110.md) - [2100](https://cortex-docs.paloaltonetworks.com/cortex-xdr-content-update-releases/cortex-xdr-content-releases/2100.md) - [2090](https://cortex-docs.paloaltonetworks.com/cortex-xdr-content-update-releases/cortex-xdr-content-releases/2090.md) - [2080](https://cortex-docs.paloaltonetworks.com/cortex-xdr-content-update-releases/cortex-xdr-content-releases/2080.md) - [2070](https://cortex-docs.paloaltonetworks.com/cortex-xdr-content-update-releases/cortex-xdr-content-releases/2070.md) - [2060](https://cortex-docs.paloaltonetworks.com/cortex-xdr-content-update-releases/cortex-xdr-content-releases/2060.md) - [2050](https://cortex-docs.paloaltonetworks.com/cortex-xdr-content-update-releases/cortex-xdr-content-releases/2050.md) - [2040](https://cortex-docs.paloaltonetworks.com/cortex-xdr-content-update-releases/cortex-xdr-content-releases/2040.md) - [2030](https://cortex-docs.paloaltonetworks.com/cortex-xdr-content-update-releases/cortex-xdr-content-releases/2030.md) - [2020](https://cortex-docs.paloaltonetworks.com/cortex-xdr-content-update-releases/cortex-xdr-content-releases/2020.md) - [2010](https://cortex-docs.paloaltonetworks.com/cortex-xdr-content-update-releases/cortex-xdr-content-releases/2010.md) - [2000](https://cortex-docs.paloaltonetworks.com/cortex-xdr-content-update-releases/cortex-xdr-content-releases/2000.md) - [1990](https://cortex-docs.paloaltonetworks.com/cortex-xdr-content-update-releases/cortex-xdr-content-releases/1990.md) - [1980](https://cortex-docs.paloaltonetworks.com/cortex-xdr-content-update-releases/cortex-xdr-content-releases/1980.md) - [1970](https://cortex-docs.paloaltonetworks.com/cortex-xdr-content-update-releases/cortex-xdr-content-releases/1970.md) - [1960](https://cortex-docs.paloaltonetworks.com/cortex-xdr-content-update-releases/cortex-xdr-content-releases/1960.md) - [1950](https://cortex-docs.paloaltonetworks.com/cortex-xdr-content-update-releases/cortex-xdr-content-releases/1950.md) - [1940](https://cortex-docs.paloaltonetworks.com/cortex-xdr-content-update-releases/cortex-xdr-content-releases/1940.md) - [1930](https://cortex-docs.paloaltonetworks.com/cortex-xdr-content-update-releases/cortex-xdr-content-releases/1930.md) - [1920](https://cortex-docs.paloaltonetworks.com/cortex-xdr-content-update-releases/cortex-xdr-content-releases/1920.md) - [1910](https://cortex-docs.paloaltonetworks.com/cortex-xdr-content-update-releases/cortex-xdr-content-releases/1910.md) - [1900](https://cortex-docs.paloaltonetworks.com/cortex-xdr-content-update-releases/cortex-xdr-content-releases/1900.md) - [1890](https://cortex-docs.paloaltonetworks.com/cortex-xdr-content-update-releases/cortex-xdr-content-releases/1890.md) - [1880](https://cortex-docs.paloaltonetworks.com/cortex-xdr-content-update-releases/cortex-xdr-content-releases/1880.md) - [1870](https://cortex-docs.paloaltonetworks.com/cortex-xdr-content-update-releases/cortex-xdr-content-releases/1870.md) - [1860](https://cortex-docs.paloaltonetworks.com/cortex-xdr-content-update-releases/cortex-xdr-content-releases/1860.md) - [1850](https://cortex-docs.paloaltonetworks.com/cortex-xdr-content-update-releases/cortex-xdr-content-releases/1850.md) - [1840](https://cortex-docs.paloaltonetworks.com/cortex-xdr-content-update-releases/cortex-xdr-content-releases/1840.md) - [1830](https://cortex-docs.paloaltonetworks.com/cortex-xdr-content-update-releases/cortex-xdr-content-releases/1830.md) - [1820](https://cortex-docs.paloaltonetworks.com/cortex-xdr-content-update-releases/cortex-xdr-content-releases/1820.md) - [1810](https://cortex-docs.paloaltonetworks.com/cortex-xdr-content-update-releases/cortex-xdr-content-releases/1810.md) - [1800](https://cortex-docs.paloaltonetworks.com/cortex-xdr-content-update-releases/cortex-xdr-content-releases/1800.md) - [1790](https://cortex-docs.paloaltonetworks.com/cortex-xdr-content-update-releases/cortex-xdr-content-releases/1790.md) - [1780](https://cortex-docs.paloaltonetworks.com/cortex-xdr-content-update-releases/cortex-xdr-content-releases/1780.md) - [1770](https://cortex-docs.paloaltonetworks.com/cortex-xdr-content-update-releases/cortex-xdr-content-releases/1770.md) - [1760](https://cortex-docs.paloaltonetworks.com/cortex-xdr-content-update-releases/cortex-xdr-content-releases/1760.md) - [1750](https://cortex-docs.paloaltonetworks.com/cortex-xdr-content-update-releases/cortex-xdr-content-releases/1750.md) - [1740](https://cortex-docs.paloaltonetworks.com/cortex-xdr-content-update-releases/cortex-xdr-content-releases/1740.md) - [1730](https://cortex-docs.paloaltonetworks.com/cortex-xdr-content-update-releases/cortex-xdr-content-releases/1730.md) - [1720](https://cortex-docs.paloaltonetworks.com/cortex-xdr-content-update-releases/cortex-xdr-content-releases/1720.md) - [1710](https://cortex-docs.paloaltonetworks.com/cortex-xdr-content-update-releases/cortex-xdr-content-releases/1710.md) - [1700](https://cortex-docs.paloaltonetworks.com/cortex-xdr-content-update-releases/cortex-xdr-content-releases/1700.md) - [1690](https://cortex-docs.paloaltonetworks.com/cortex-xdr-content-update-releases/cortex-xdr-content-releases/1690.md) - [1680](https://cortex-docs.paloaltonetworks.com/cortex-xdr-content-update-releases/cortex-xdr-content-releases/1680.md) - [1670](https://cortex-docs.paloaltonetworks.com/cortex-xdr-content-update-releases/cortex-xdr-content-releases/1670.md) - [1660](https://cortex-docs.paloaltonetworks.com/cortex-xdr-content-update-releases/cortex-xdr-content-releases/1660.md) - [1650](https://cortex-docs.paloaltonetworks.com/cortex-xdr-content-update-releases/cortex-xdr-content-releases/1650.md) - [1640](https://cortex-docs.paloaltonetworks.com/cortex-xdr-content-update-releases/cortex-xdr-content-releases/1640.md) - [1630](https://cortex-docs.paloaltonetworks.com/cortex-xdr-content-update-releases/cortex-xdr-content-releases/1630.md) - [1620](https://cortex-docs.paloaltonetworks.com/cortex-xdr-content-update-releases/cortex-xdr-content-releases/1620.md) - [1610](https://cortex-docs.paloaltonetworks.com/cortex-xdr-content-update-releases/cortex-xdr-content-releases/1610.md) ## Cortex XSPM Content Releases ## Cortex Attack Path Content Releases ## Cortex Data Security - [Release Information](https://cortex-docs.paloaltonetworks.com/cortex-data-security/release-information.md) - [Features introduced in 2026](https://cortex-docs.paloaltonetworks.com/cortex-data-security/release-information/features-2026.md) - [July 2026](https://cortex-docs.paloaltonetworks.com/cortex-data-security/release-information/features-2026/july-2026.md) - [Release Highlights](https://cortex-docs.paloaltonetworks.com/cortex-data-security/release-information/features-2026/july-2026/release-highlights.md) ## Overview - [Cortex API Documentation](https://cortex-docs.paloaltonetworks.com/cortex-api-overview/readme.md): Explore and integrate with the Cortex platform APIs. ## Cortex Cloud APIs - [Get started with Cortex Cloud APIs](https://cortex-docs.paloaltonetworks.com/cortex-cloud-api/get-started-with-cortex-apis.md) - [What's new in this release](https://cortex-docs.paloaltonetworks.com/cortex-cloud-api/api-release-notes.md) - [Create a new API key](https://cortex-docs.paloaltonetworks.com/cortex-cloud-api/create-a-new-api-key.md) - [Get your Cortex Cloud API key ID](https://cortex-docs.paloaltonetworks.com/cortex-cloud-api/get-your-cortex-api-key-id.md) - [Get your FQDN](https://cortex-docs.paloaltonetworks.com/cortex-cloud-api/get-your-fqdn.md) - [Make your first API call](https://cortex-docs.paloaltonetworks.com/cortex-cloud-api/make-your-first-api-call.md) - [Understand Cortex Cloud licenses](https://cortex-docs.paloaltonetworks.com/cortex-cloud-api/understand-cortex-cloud-licenses.md) - [Cortex Cloud Platform Overview](https://cortex-docs.paloaltonetworks.com/cortex-cloud-api/cortex-platform/cortex-cloud-platform-overview.md) - [API Keys](https://cortex-docs.paloaltonetworks.com/cortex-cloud-api/cortex-platform/api-keys.md) - [Asset Groups](https://cortex-docs.paloaltonetworks.com/cortex-cloud-api/cortex-platform/asset-groups.md) - [Asset Inventory](https://cortex-docs.paloaltonetworks.com/cortex-cloud-api/cortex-platform/asset-inventory.md) - [Attack Surface Management](https://cortex-docs.paloaltonetworks.com/cortex-cloud-api/cortex-platform/attack-surface-management.md) - [Audit Log](https://cortex-docs.paloaltonetworks.com/cortex-cloud-api/cortex-platform/audit-log.md) - [Authentication Settings](https://cortex-docs.paloaltonetworks.com/cortex-cloud-api/cortex-platform/authentication-settings.md) - [BIOCs](https://cortex-docs.paloaltonetworks.com/cortex-cloud-api/cortex-platform/biocs.md) - [Correlation Rules](https://cortex-docs.paloaltonetworks.com/cortex-cloud-api/cortex-platform/correlation-rules.md) - [Cortex CLI](https://cortex-docs.paloaltonetworks.com/cortex-cloud-api/cortex-platform/cortex-cli.md) - [Dashboards](https://cortex-docs.paloaltonetworks.com/cortex-cloud-api/cortex-platform/dashboards.md) - [Dataset Management](https://cortex-docs.paloaltonetworks.com/cortex-cloud-api/cortex-platform/dataset-management.md) - [Endpoint Management](https://cortex-docs.paloaltonetworks.com/cortex-cloud-api/cortex-platform/endpoint-management.md) - [IOCs](https://cortex-docs.paloaltonetworks.com/cortex-cloud-api/cortex-platform/iocs.md) - [Lookup Datasets](https://cortex-docs.paloaltonetworks.com/cortex-cloud-api/cortex-platform/lookup-datasets.md) - [Playbooks](https://cortex-docs.paloaltonetworks.com/cortex-cloud-api/cortex-platform/playbooks.md) - [Query Library](https://cortex-docs.paloaltonetworks.com/cortex-cloud-api/cortex-platform/query-library.md) - [Response Action](https://cortex-docs.paloaltonetworks.com/cortex-cloud-api/cortex-platform/response-action.md) - [Scheduled Queries](https://cortex-docs.paloaltonetworks.com/cortex-cloud-api/cortex-platform/scheduled-queries.md) - [Script Execution](https://cortex-docs.paloaltonetworks.com/cortex-cloud-api/cortex-platform/script-execution.md) - [Scripts](https://cortex-docs.paloaltonetworks.com/cortex-cloud-api/cortex-platform/scripts.md) - [Syslog Servers](https://cortex-docs.paloaltonetworks.com/cortex-cloud-api/cortex-platform/syslog-servers.md) - [System Management](https://cortex-docs.paloaltonetworks.com/cortex-cloud-api/cortex-platform/system-management.md) - [Widgets](https://cortex-docs.paloaltonetworks.com/cortex-cloud-api/cortex-platform/widgets.md) - [XQL Query](https://cortex-docs.paloaltonetworks.com/cortex-cloud-api/cortex-platform/xql-query.md) - [XQL User Datasets](https://cortex-docs.paloaltonetworks.com/cortex-cloud-api/cortex-platform/xql-user-datasets.md) - [Models](https://cortex-docs.paloaltonetworks.com/cortex-cloud-api/cortex-platform/models.md) - [Run XQL query APIs](https://cortex-docs.paloaltonetworks.com/cortex-cloud-api/cortex-platform/run-xql-query-apis.md) - [Additional References](https://cortex-docs.paloaltonetworks.com/cortex-cloud-api/cortex-platform/cortex-cloud-platform-papi-tables.md) - [Agent Configuration Settings overview](https://cortex-docs.paloaltonetworks.com/cortex-cloud-api/agent-configuration-settings/agent-configuration-settings-overview.md) - [Agent Configurations](https://cortex-docs.paloaltonetworks.com/cortex-cloud-api/agent-configuration-settings/agent-configurations.md) - [Models](https://cortex-docs.paloaltonetworks.com/cortex-cloud-api/agent-configuration-settings/models.md) - [ASPM, CI/CD, and Application Security Overview](https://cortex-docs.paloaltonetworks.com/cortex-cloud-api/aspm-cicd-and-application-security/application-security-overview.md) - [Billing](https://cortex-docs.paloaltonetworks.com/cortex-cloud-api/aspm-cicd-and-application-security/billing.md) - [Applications](https://cortex-docs.paloaltonetworks.com/cortex-cloud-api/aspm-cicd-and-application-security/applications.md) - [Criteria](https://cortex-docs.paloaltonetworks.com/cortex-cloud-api/aspm-cicd-and-application-security/criteria.md) - [Data Sources](https://cortex-docs.paloaltonetworks.com/cortex-cloud-api/aspm-cicd-and-application-security/data-sources.md) - [Policies](https://cortex-docs.paloaltonetworks.com/cortex-cloud-api/aspm-cicd-and-application-security/policies.md) - [Package Explorer](https://cortex-docs.paloaltonetworks.com/cortex-cloud-api/aspm-cicd-and-application-security/package-explorer.md) - [Repositories](https://cortex-docs.paloaltonetworks.com/cortex-cloud-api/aspm-cicd-and-application-security/repositories.md) - [Remediations](https://cortex-docs.paloaltonetworks.com/cortex-cloud-api/aspm-cicd-and-application-security/remediations.md) - [Rules](https://cortex-docs.paloaltonetworks.com/cortex-cloud-api/aspm-cicd-and-application-security/rules.md) - [SBOM Management](https://cortex-docs.paloaltonetworks.com/cortex-cloud-api/aspm-cicd-and-application-security/sbom-management.md) - [Scan Management](https://cortex-docs.paloaltonetworks.com/cortex-cloud-api/aspm-cicd-and-application-security/scan-management.md) - [Cloud Coverage](https://cortex-docs.paloaltonetworks.com/cortex-cloud-api/aspm-cicd-and-application-security/cloud-coverage.md) - [Models](https://cortex-docs.paloaltonetworks.com/cortex-cloud-api/aspm-cicd-and-application-security/models.md) - [Additional References](https://cortex-docs.paloaltonetworks.com/cortex-cloud-api/aspm-cicd-and-application-security/appsec-papi-tables.md) - [Asset Compliance overview](https://cortex-docs.paloaltonetworks.com/cortex-cloud-api/asset-compliance/asset-compliance-overview.md) - [Control Findings](https://cortex-docs.paloaltonetworks.com/cortex-cloud-api/asset-compliance/control-findings.md) - [Models](https://cortex-docs.paloaltonetworks.com/cortex-cloud-api/asset-compliance/models.md) - [Additional References](https://cortex-docs.paloaltonetworks.com/cortex-cloud-api/asset-compliance/asset-compliance-papi-tables.md) - [Broker VM (On-Appliance) overview](https://cortex-docs.paloaltonetworks.com/cortex-cloud-api/broker-vm-on-appliance/broker-vm-appliance-overview.md) - [Auth (bootstrap)](https://cortex-docs.paloaltonetworks.com/cortex-cloud-api/broker-vm-on-appliance/auth-bootstrap.md) - [Registration](https://cortex-docs.paloaltonetworks.com/cortex-cloud-api/broker-vm-on-appliance/registration.md) - [Network configuration](https://cortex-docs.paloaltonetworks.com/cortex-cloud-api/broker-vm-on-appliance/network-configuration.md) - [Local log bundle](https://cortex-docs.paloaltonetworks.com/cortex-cloud-api/broker-vm-on-appliance/local-log-bundle.md) - [Models](https://cortex-docs.paloaltonetworks.com/cortex-cloud-api/broker-vm-on-appliance/models.md) - [Broker VM (Tenant-Side) overview](https://cortex-docs.paloaltonetworks.com/cortex-cloud-api/broker-vm-tenant-side/broker-vm-tenant-overview.md) - [Brokers](https://cortex-docs.paloaltonetworks.com/cortex-cloud-api/broker-vm-tenant-side/brokers.md) - [Actions](https://cortex-docs.paloaltonetworks.com/cortex-cloud-api/broker-vm-tenant-side/actions.md) - [Install images](https://cortex-docs.paloaltonetworks.com/cortex-cloud-api/broker-vm-tenant-side/install-images.md) - [Applets](https://cortex-docs.paloaltonetworks.com/cortex-cloud-api/broker-vm-tenant-side/applets.md) - [Remote log bundle](https://cortex-docs.paloaltonetworks.com/cortex-cloud-api/broker-vm-tenant-side/remote-log-bundle.md) - [Models](https://cortex-docs.paloaltonetworks.com/cortex-cloud-api/broker-vm-tenant-side/models.md) - [Additional References](https://cortex-docs.paloaltonetworks.com/cortex-cloud-api/broker-vm-tenant-side/broker-papi-tables.md) - [Cases APIs overview](https://cortex-docs.paloaltonetworks.com/cortex-cloud-api/cases-apis/cases-apis-overview.md) - [Cases](https://cortex-docs.paloaltonetworks.com/cortex-cloud-api/cases-apis/cases.md) - [Models](https://cortex-docs.paloaltonetworks.com/cortex-cloud-api/cases-apis/models.md) - [Additional References](https://cortex-docs.paloaltonetworks.com/cortex-cloud-api/cases-apis/cases-papi-tables.md) - [Cloud Infrastructure Entitlement Management (CIEM) overview](https://cortex-docs.paloaltonetworks.com/cortex-cloud-api/cloud-infrastructure-entitlement-management-ciem/cloud-infrastructure-entitlement-management-ciem-overview.md) - [CIEM](https://cortex-docs.paloaltonetworks.com/cortex-cloud-api/cloud-infrastructure-entitlement-management-ciem/ciem.md) - [Models](https://cortex-docs.paloaltonetworks.com/cortex-cloud-api/cloud-infrastructure-entitlement-management-ciem/models.md) - [Cloud Onboarding API overview](https://cortex-docs.paloaltonetworks.com/cortex-cloud-api/cloud-onboarding/cloud-onboarding-overview.md) - [Cloud Instance Management](https://cortex-docs.paloaltonetworks.com/cortex-cloud-api/cloud-onboarding/cloud-instance-management.md) - [Manual Onboarding](https://cortex-docs.paloaltonetworks.com/cortex-cloud-api/cloud-onboarding/manual-onboarding.md) - [Cloud Account Management](https://cortex-docs.paloaltonetworks.com/cortex-cloud-api/cloud-onboarding/cloud-account-management.md) - [Outpost Management](https://cortex-docs.paloaltonetworks.com/cortex-cloud-api/cloud-onboarding/outpost-management.md) - [General](https://cortex-docs.paloaltonetworks.com/cortex-cloud-api/cloud-onboarding/general.md) - [Models](https://cortex-docs.paloaltonetworks.com/cortex-cloud-api/cloud-onboarding/models.md) - [Cloud Workload Protection Overview](https://cortex-docs.paloaltonetworks.com/cortex-cloud-api/cloud-workload-protection/cloud-workload-protection-overview.md) - [Policies](https://cortex-docs.paloaltonetworks.com/cortex-cloud-api/cloud-workload-protection/policies.md) - [SBOM](https://cortex-docs.paloaltonetworks.com/cortex-cloud-api/cloud-workload-protection/sbom.md) - [Registry Onboarding](https://cortex-docs.paloaltonetworks.com/cortex-cloud-api/cloud-workload-protection/registry-onboarding.md) - [Models](https://cortex-docs.paloaltonetworks.com/cortex-cloud-api/cloud-workload-protection/models.md) - [Compliance Controls Overview](https://cortex-docs.paloaltonetworks.com/cortex-cloud-api/compliance-controls/compliance-controls-overview.md) - [Pagination](https://cortex-docs.paloaltonetworks.com/cortex-cloud-api/compliance-controls/pagination.md) - [Rule Association](https://cortex-docs.paloaltonetworks.com/cortex-cloud-api/compliance-controls/rule-association.md) - [Assessment Profiles](https://cortex-docs.paloaltonetworks.com/cortex-cloud-api/compliance-controls/assessment-profiles.md) - [Assessment Results](https://cortex-docs.paloaltonetworks.com/cortex-cloud-api/compliance-controls/assessment-results.md) - [Categories](https://cortex-docs.paloaltonetworks.com/cortex-cloud-api/compliance-controls/categories.md) - [Compliance Assets](https://cortex-docs.paloaltonetworks.com/cortex-cloud-api/compliance-controls/compliance-assets.md) - [Controls](https://cortex-docs.paloaltonetworks.com/cortex-cloud-api/compliance-controls/controls.md) - [Reports](https://cortex-docs.paloaltonetworks.com/cortex-cloud-api/compliance-controls/reports.md) - [Results](https://cortex-docs.paloaltonetworks.com/cortex-cloud-api/compliance-controls/results.md) - [Rules](https://cortex-docs.paloaltonetworks.com/cortex-cloud-api/compliance-controls/rules.md) - [Standards](https://cortex-docs.paloaltonetworks.com/cortex-cloud-api/compliance-controls/standards.md) - [Models](https://cortex-docs.paloaltonetworks.com/cortex-cloud-api/compliance-controls/models.md) - [Cortex Cloud Alert Notification Rules overview](https://cortex-docs.paloaltonetworks.com/cortex-cloud-api/cortex-cloud-alert-notification-rules/cortex-cloud-alert-notification-rules-overview.md) - [Alert Notification Rules](https://cortex-docs.paloaltonetworks.com/cortex-cloud-api/cortex-cloud-alert-notification-rules/alert-notification-rules.md) - [Models](https://cortex-docs.paloaltonetworks.com/cortex-cloud-api/cortex-cloud-alert-notification-rules/models.md) - [Cortex Cloud External Application Management overview](https://cortex-docs.paloaltonetworks.com/cortex-cloud-api/cortex-cloud-external-application-management/cortex-cloud-external-application-management-overview.md) - [External Applications](https://cortex-docs.paloaltonetworks.com/cortex-cloud-api/cortex-cloud-external-application-management/external-applications.md) - [Models](https://cortex-docs.paloaltonetworks.com/cortex-cloud-api/cortex-cloud-external-application-management/models.md) - [Cortex Cloud Logging and Collection Service Management overview](https://cortex-docs.paloaltonetworks.com/cortex-cloud-api/cortex-cloud-logging-and-collection-service-management/cortex-cloud-logging-and-collection-service-management-overview.md) - [CLCS Management](https://cortex-docs.paloaltonetworks.com/cortex-cloud-api/cortex-cloud-logging-and-collection-service-management/clcs-management.md) - [Models](https://cortex-docs.paloaltonetworks.com/cortex-cloud-api/cortex-cloud-logging-and-collection-service-management/models.md) - [Cortex Platform IAM Overview](https://cortex-docs.paloaltonetworks.com/cortex-cloud-api/cortex-platform-identity-and-access-management-iam/iam-overview.md) - [API Keys](https://cortex-docs.paloaltonetworks.com/cortex-cloud-api/cortex-platform-identity-and-access-management-iam/api-keys.md) - [Roles](https://cortex-docs.paloaltonetworks.com/cortex-cloud-api/cortex-platform-identity-and-access-management-iam/roles.md) - [Scopes](https://cortex-docs.paloaltonetworks.com/cortex-cloud-api/cortex-platform-identity-and-access-management-iam/scopes.md) - [User](https://cortex-docs.paloaltonetworks.com/cortex-cloud-api/cortex-platform-identity-and-access-management-iam/user.md) - [User Groups](https://cortex-docs.paloaltonetworks.com/cortex-cloud-api/cortex-platform-identity-and-access-management-iam/user-groups.md) - [Models](https://cortex-docs.paloaltonetworks.com/cortex-cloud-api/cortex-platform-identity-and-access-management-iam/models.md) - [Restore Distributions overview](https://cortex-docs.paloaltonetworks.com/cortex-cloud-api/restore-distributions/restore-distributions-overview.md) - [Restore Distributions](https://cortex-docs.paloaltonetworks.com/cortex-cloud-api/restore-distributions/restore-distributions.md) - [Models](https://cortex-docs.paloaltonetworks.com/cortex-cloud-api/restore-distributions/models.md) - [Data Security Posture Management overview](https://cortex-docs.paloaltonetworks.com/cortex-cloud-api/data-security-posture-management/data-security-posture-management-overview.md) - [Inventory](https://cortex-docs.paloaltonetworks.com/cortex-cloud-api/data-security-posture-management/inventory.md) - [Models](https://cortex-docs.paloaltonetworks.com/cortex-cloud-api/data-security-posture-management/models.md) - [Detection Rules Management overview](https://cortex-docs.paloaltonetworks.com/cortex-cloud-api/detection-rules-management/detection-rules-management-overview.md) - [Detection Rules](https://cortex-docs.paloaltonetworks.com/cortex-cloud-api/detection-rules-management/detection-rules.md) - [Models](https://cortex-docs.paloaltonetworks.com/cortex-cloud-api/detection-rules-management/models.md) - [Disable Injection and Prevention Rules overview](https://cortex-docs.paloaltonetworks.com/cortex-cloud-api/disable-injection-and-prevention-rules/disable-injection-and-prevention-rules-overview.md) - [Disable Injection and Prevention Rules Public API](https://cortex-docs.paloaltonetworks.com/cortex-cloud-api/disable-injection-and-prevention-rules/disable-injection-and-prevention-rules-public-api.md) - [Models](https://cortex-docs.paloaltonetworks.com/cortex-cloud-api/disable-injection-and-prevention-rules/models.md) - [Disable Prevention Rule overview](https://cortex-docs.paloaltonetworks.com/cortex-cloud-api/disable-prevention-rule/disable-prevention-rule-overview.md) - [Disable Prevention Rule Public APIs](https://cortex-docs.paloaltonetworks.com/cortex-cloud-api/disable-prevention-rule/disable-prevention-rule-public-apis.md) - [Models](https://cortex-docs.paloaltonetworks.com/cortex-cloud-api/disable-prevention-rule/models.md) - [Forensics overview](https://cortex-docs.paloaltonetworks.com/cortex-cloud-api/forensics/forensics-overview.md) - [Forensics](https://cortex-docs.paloaltonetworks.com/cortex-cloud-api/forensics/forensics.md) - [Models](https://cortex-docs.paloaltonetworks.com/cortex-cloud-api/forensics/models.md) - [Issues APIs overview](https://cortex-docs.paloaltonetworks.com/cortex-cloud-api/issues-apis/issues-apis-overview.md) - [Issues](https://cortex-docs.paloaltonetworks.com/cortex-cloud-api/issues-apis/issues.md) - [Models](https://cortex-docs.paloaltonetworks.com/cortex-cloud-api/issues-apis/models.md) - [Additional References](https://cortex-docs.paloaltonetworks.com/cortex-cloud-api/issues-apis/issues-papi-tables.md) - [Managed Services Overview](https://cortex-docs.paloaltonetworks.com/cortex-cloud-api/managed-services/managed-services-overview.md) - [Assignment](https://cortex-docs.paloaltonetworks.com/cortex-cloud-api/managed-services/assignment.md) - [Comments](https://cortex-docs.paloaltonetworks.com/cortex-cloud-api/managed-services/comments.md) - [Reports](https://cortex-docs.paloaltonetworks.com/cortex-cloud-api/managed-services/reports.md) - [Status](https://cortex-docs.paloaltonetworks.com/cortex-cloud-api/managed-services/status.md) - [Models](https://cortex-docs.paloaltonetworks.com/cortex-cloud-api/managed-services/models.md) - [Netscan overview](https://cortex-docs.paloaltonetworks.com/cortex-cloud-api/netscan/netscan-overview.md) - [Vulnerability Network Scan Management](https://cortex-docs.paloaltonetworks.com/cortex-cloud-api/netscan/vulnerability-network-scan-management.md) - [Models](https://cortex-docs.paloaltonetworks.com/cortex-cloud-api/netscan/models.md) - [Policies overview](https://cortex-docs.paloaltonetworks.com/cortex-cloud-api/policies/policies-overview.md) - [Cloud Security Policies](https://cortex-docs.paloaltonetworks.com/cortex-cloud-api/policies/cloud-security-policies.md) - [Models](https://cortex-docs.paloaltonetworks.com/cortex-cloud-api/policies/models.md) - [Unified Rules overview](https://cortex-docs.paloaltonetworks.com/cortex-cloud-api/unified-rules/unified-rules-overview.md) - [Unified Rules](https://cortex-docs.paloaltonetworks.com/cortex-cloud-api/unified-rules/unified-rules.md) - [Models](https://cortex-docs.paloaltonetworks.com/cortex-cloud-api/unified-rules/models.md) - [Vulnerability Intelligence Overview](https://cortex-docs.paloaltonetworks.com/cortex-cloud-api/vulnerability-intelligence/vulnerability-intelligence-overview.md) - [Affected Software](https://cortex-docs.paloaltonetworks.com/cortex-cloud-api/vulnerability-intelligence/affected-software.md) - [Vulnerabilities](https://cortex-docs.paloaltonetworks.com/cortex-cloud-api/vulnerability-intelligence/vulnerabilities.md) - [Models](https://cortex-docs.paloaltonetworks.com/cortex-cloud-api/vulnerability-intelligence/models.md) - [Additional References](https://cortex-docs.paloaltonetworks.com/cortex-cloud-api/vulnerability-intelligence/vulnerability-intelligence-papi-tables.md) - [Vulnerability Management Overview](https://cortex-docs.paloaltonetworks.com/cortex-cloud-api/vulnerability-management/vulnerability-management-overview.md) - [Vulnerability Management](https://cortex-docs.paloaltonetworks.com/cortex-cloud-api/vulnerability-management/vulnerability-management.md) - [Vulnerability Findings](https://cortex-docs.paloaltonetworks.com/cortex-cloud-api/vulnerability-management/vulnerability-findings.md) - [Vulnerability Findings Snapshot](https://cortex-docs.paloaltonetworks.com/cortex-cloud-api/vulnerability-management/vulnerability-findings-snapshot.md) - [Bring Your Own Scanner](https://cortex-docs.paloaltonetworks.com/cortex-cloud-api/vulnerability-management/bring-your-own-scanner.md) - [Models](https://cortex-docs.paloaltonetworks.com/cortex-cloud-api/vulnerability-management/models.md) - [Forensics](https://cortex-docs.paloaltonetworks.com/cortex-cloud-api/forensics-1/forensics.md) - [Models](https://cortex-docs.paloaltonetworks.com/cortex-cloud-api/forensics-1/models.md) - [Cloud Consumption Dashboard API overview](https://cortex-docs.paloaltonetworks.com/cortex-cloud-api/cloud-consumption-dashboard/cloud-consumption-overview.md) - [Cloud Consumption Dashboard](https://cortex-docs.paloaltonetworks.com/cortex-cloud-api/cloud-consumption-dashboard/cloud-consumption-dashboard.md): Retrieve workload consumption data per asset type, over time, and in a paginated details grid. - [Licensing](https://cortex-docs.paloaltonetworks.com/cortex-cloud-api/cloud-consumption-dashboard/licensing.md): Retrieve tenant license entitlements and add-on information. - [Models](https://cortex-docs.paloaltonetworks.com/cortex-cloud-api/cloud-consumption-dashboard/models.md) ## XDR 5.x APIs - [Get started with Cortex XDR 5.x APIs](https://cortex-docs.paloaltonetworks.com/xdr-5-api/readme.md) - [What's new in this release](https://cortex-docs.paloaltonetworks.com/xdr-5-api/api-release-notes.md) - [Create a new API key](https://cortex-docs.paloaltonetworks.com/xdr-5-api/create-a-new-api-key.md) - [Get your Cortex XDR API key ID](https://cortex-docs.paloaltonetworks.com/xdr-5-api/get-your-cortex-api-key-id.md) - [Get your FQDN](https://cortex-docs.paloaltonetworks.com/xdr-5-api/get-your-fqdn.md) - [Make your first API call](https://cortex-docs.paloaltonetworks.com/xdr-5-api/make-your-first-api-call.md) - [Understand Cortex XDR licenses](https://cortex-docs.paloaltonetworks.com/xdr-5-api/understand-cortex-xdr-licenses.md) - [Cortex XDR Platform Overview](https://cortex-docs.paloaltonetworks.com/xdr-5-api/cortex-platform/cortex-xdr-platform-overview.md) - [API Keys](https://cortex-docs.paloaltonetworks.com/xdr-5-api/cortex-platform/api-keys.md) - [Asset Groups](https://cortex-docs.paloaltonetworks.com/xdr-5-api/cortex-platform/asset-groups.md) - [Asset Inventory](https://cortex-docs.paloaltonetworks.com/xdr-5-api/cortex-platform/asset-inventory.md) - [Attack Surface Management](https://cortex-docs.paloaltonetworks.com/xdr-5-api/cortex-platform/attack-surface-management.md) - [Audit Log](https://cortex-docs.paloaltonetworks.com/xdr-5-api/cortex-platform/audit-log.md) - [Authentication Settings](https://cortex-docs.paloaltonetworks.com/xdr-5-api/cortex-platform/authentication-settings.md) - [BIOCs](https://cortex-docs.paloaltonetworks.com/xdr-5-api/cortex-platform/biocs.md) - [Correlation Rules](https://cortex-docs.paloaltonetworks.com/xdr-5-api/cortex-platform/correlation-rules.md) - [Cortex CLI](https://cortex-docs.paloaltonetworks.com/xdr-5-api/cortex-platform/cortex-cli.md) - [Dashboards](https://cortex-docs.paloaltonetworks.com/xdr-5-api/cortex-platform/dashboards.md) - [Dataset Management](https://cortex-docs.paloaltonetworks.com/xdr-5-api/cortex-platform/dataset-management.md) - [Endpoint Management](https://cortex-docs.paloaltonetworks.com/xdr-5-api/cortex-platform/endpoint-management.md) - [Indicator Rules](https://cortex-docs.paloaltonetworks.com/xdr-5-api/cortex-platform/indicator-rules.md) - [IOCs](https://cortex-docs.paloaltonetworks.com/xdr-5-api/cortex-platform/iocs.md) - [Lookup Datasets](https://cortex-docs.paloaltonetworks.com/xdr-5-api/cortex-platform/lookup-datasets.md) - [Playbooks](https://cortex-docs.paloaltonetworks.com/xdr-5-api/cortex-platform/playbooks.md) - [Query Library](https://cortex-docs.paloaltonetworks.com/xdr-5-api/cortex-platform/query-library.md) - [Response Action](https://cortex-docs.paloaltonetworks.com/xdr-5-api/cortex-platform/response-action.md) - [Scheduled Queries](https://cortex-docs.paloaltonetworks.com/xdr-5-api/cortex-platform/scheduled-queries.md) - [Script Execution](https://cortex-docs.paloaltonetworks.com/xdr-5-api/cortex-platform/script-execution.md) - [Scripts](https://cortex-docs.paloaltonetworks.com/xdr-5-api/cortex-platform/scripts.md) - [Syslog Servers](https://cortex-docs.paloaltonetworks.com/xdr-5-api/cortex-platform/syslog-servers.md) - [System Management](https://cortex-docs.paloaltonetworks.com/xdr-5-api/cortex-platform/system-management.md) - [Widgets](https://cortex-docs.paloaltonetworks.com/xdr-5-api/cortex-platform/widgets.md) - [XQL Query](https://cortex-docs.paloaltonetworks.com/xdr-5-api/cortex-platform/xql-query.md) - [Models](https://cortex-docs.paloaltonetworks.com/xdr-5-api/cortex-platform/models.md) - [Run XQL query APIs](https://cortex-docs.paloaltonetworks.com/xdr-5-api/cortex-platform/run-xql-query-apis.md) - [Additional References](https://cortex-docs.paloaltonetworks.com/xdr-5-api/cortex-platform/cortex-platform-papi-tables.md) - [Agent Configuration Settings overview](https://cortex-docs.paloaltonetworks.com/xdr-5-api/agent-configuration-settings/agent-configuration-settings-overview.md) - [Agent Configurations](https://cortex-docs.paloaltonetworks.com/xdr-5-api/agent-configuration-settings/agent-configurations.md) - [Models](https://cortex-docs.paloaltonetworks.com/xdr-5-api/agent-configuration-settings/models.md) - [Alert Notification Rules overview](https://cortex-docs.paloaltonetworks.com/xdr-5-api/alert-notification-rules/alert-notification-rules-overview.md) - [Alert Notification Rules](https://cortex-docs.paloaltonetworks.com/xdr-5-api/alert-notification-rules/alert-notification-rules.md) - [Models](https://cortex-docs.paloaltonetworks.com/xdr-5-api/alert-notification-rules/models.md) - [ASPM, CI/CD, and Application Security Overview](https://cortex-docs.paloaltonetworks.com/xdr-5-api/aspm-cicd-and-application-security/aspm-cicd-and-application-security-overview.md) - [Additional References](https://cortex-docs.paloaltonetworks.com/xdr-5-api/aspm-cicd-and-application-security/appsec-papi-tables.md) - [Billing](https://cortex-docs.paloaltonetworks.com/xdr-5-api/aspm-cicd-and-application-security/billing.md) - [Applications](https://cortex-docs.paloaltonetworks.com/xdr-5-api/aspm-cicd-and-application-security/applications.md) - [Criteria](https://cortex-docs.paloaltonetworks.com/xdr-5-api/aspm-cicd-and-application-security/criteria.md) - [Data Sources](https://cortex-docs.paloaltonetworks.com/xdr-5-api/aspm-cicd-and-application-security/data-sources.md) - [Policies](https://cortex-docs.paloaltonetworks.com/xdr-5-api/aspm-cicd-and-application-security/policies.md) - [Package Explorer](https://cortex-docs.paloaltonetworks.com/xdr-5-api/aspm-cicd-and-application-security/package-explorer.md) - [Repositories](https://cortex-docs.paloaltonetworks.com/xdr-5-api/aspm-cicd-and-application-security/repositories.md) - [Remediations](https://cortex-docs.paloaltonetworks.com/xdr-5-api/aspm-cicd-and-application-security/remediations.md) - [Rules](https://cortex-docs.paloaltonetworks.com/xdr-5-api/aspm-cicd-and-application-security/rules.md) - [SBOM Management](https://cortex-docs.paloaltonetworks.com/xdr-5-api/aspm-cicd-and-application-security/sbom-management.md) - [Scan Management](https://cortex-docs.paloaltonetworks.com/xdr-5-api/aspm-cicd-and-application-security/scan-management.md) - [Cloud Coverage](https://cortex-docs.paloaltonetworks.com/xdr-5-api/aspm-cicd-and-application-security/cloud-coverage.md) - [Models](https://cortex-docs.paloaltonetworks.com/xdr-5-api/aspm-cicd-and-application-security/models.md) - [Asset Compliance overview](https://cortex-docs.paloaltonetworks.com/xdr-5-api/asset-compliance/asset-compliance-overview.md) - [Control Findings](https://cortex-docs.paloaltonetworks.com/xdr-5-api/asset-compliance/control-findings.md) - [Models](https://cortex-docs.paloaltonetworks.com/xdr-5-api/asset-compliance/models.md) - [Additional References](https://cortex-docs.paloaltonetworks.com/xdr-5-api/asset-compliance/asset-compliance-papi-tables.md) - [Broker VM (On-Appliance) overview](https://cortex-docs.paloaltonetworks.com/xdr-5-api/broker-vm-on-appliance/broker-vm-appliance-overview.md) - [Auth (bootstrap)](https://cortex-docs.paloaltonetworks.com/xdr-5-api/broker-vm-on-appliance/auth-bootstrap.md) - [Registration](https://cortex-docs.paloaltonetworks.com/xdr-5-api/broker-vm-on-appliance/registration.md) - [Network configuration](https://cortex-docs.paloaltonetworks.com/xdr-5-api/broker-vm-on-appliance/network-configuration.md) - [Local log bundle](https://cortex-docs.paloaltonetworks.com/xdr-5-api/broker-vm-on-appliance/local-log-bundle.md) - [Models](https://cortex-docs.paloaltonetworks.com/xdr-5-api/broker-vm-on-appliance/models.md) - [Broker VM (Tenant-Side) overview](https://cortex-docs.paloaltonetworks.com/xdr-5-api/broker-vm-tenant-side/broker-vm-tenant-overview.md) - [Brokers](https://cortex-docs.paloaltonetworks.com/xdr-5-api/broker-vm-tenant-side/brokers.md) - [Actions](https://cortex-docs.paloaltonetworks.com/xdr-5-api/broker-vm-tenant-side/actions.md) - [Install images](https://cortex-docs.paloaltonetworks.com/xdr-5-api/broker-vm-tenant-side/install-images.md) - [Applets](https://cortex-docs.paloaltonetworks.com/xdr-5-api/broker-vm-tenant-side/applets.md) - [Remote log bundle](https://cortex-docs.paloaltonetworks.com/xdr-5-api/broker-vm-tenant-side/remote-log-bundle.md) - [Models](https://cortex-docs.paloaltonetworks.com/xdr-5-api/broker-vm-tenant-side/models.md) - [Additional References](https://cortex-docs.paloaltonetworks.com/xdr-5-api/broker-vm-tenant-side/broker-papi-tables.md) - [Cases APIs overview](https://cortex-docs.paloaltonetworks.com/xdr-5-api/cases-apis/cases-apis-overview.md) - [Cases](https://cortex-docs.paloaltonetworks.com/xdr-5-api/cases-apis/cases.md) - [Models](https://cortex-docs.paloaltonetworks.com/xdr-5-api/cases-apis/models.md) - [Additional References](https://cortex-docs.paloaltonetworks.com/xdr-5-api/cases-apis/cases-papi-tables.md) - [Cloud Infrastructure Entitlement Management (CIEM) overview](https://cortex-docs.paloaltonetworks.com/xdr-5-api/cloud-infrastructure-entitlement-management-ciem/cloud-infrastructure-entitlement-management-ciem-overview.md) - [CIEM](https://cortex-docs.paloaltonetworks.com/xdr-5-api/cloud-infrastructure-entitlement-management-ciem/ciem.md) - [Models](https://cortex-docs.paloaltonetworks.com/xdr-5-api/cloud-infrastructure-entitlement-management-ciem/models.md) - [Cloud Onboarding API overview](https://cortex-docs.paloaltonetworks.com/xdr-5-api/cloud-onboarding/cloud-onboarding-overview.md) - [Cloud Instance Management](https://cortex-docs.paloaltonetworks.com/xdr-5-api/cloud-onboarding/cloud-instance-management.md) - [Manual Onboarding](https://cortex-docs.paloaltonetworks.com/xdr-5-api/cloud-onboarding/manual-onboarding.md) - [Cloud Account Management](https://cortex-docs.paloaltonetworks.com/xdr-5-api/cloud-onboarding/cloud-account-management.md) - [Outpost Management](https://cortex-docs.paloaltonetworks.com/xdr-5-api/cloud-onboarding/outpost-management.md) - [General](https://cortex-docs.paloaltonetworks.com/xdr-5-api/cloud-onboarding/general.md) - [Models](https://cortex-docs.paloaltonetworks.com/xdr-5-api/cloud-onboarding/models.md) - [Cloud Workload Protection Overview](https://cortex-docs.paloaltonetworks.com/xdr-5-api/cloud-workload-protection/cloud-workload-protection-overview.md) - [Policies](https://cortex-docs.paloaltonetworks.com/xdr-5-api/cloud-workload-protection/policies.md) - [SBOM](https://cortex-docs.paloaltonetworks.com/xdr-5-api/cloud-workload-protection/sbom.md) - [Registry Onboarding](https://cortex-docs.paloaltonetworks.com/xdr-5-api/cloud-workload-protection/registry-onboarding.md) - [Models](https://cortex-docs.paloaltonetworks.com/xdr-5-api/cloud-workload-protection/models.md) - [Compliance Controls Overview](https://cortex-docs.paloaltonetworks.com/xdr-5-api/compliance-controls/compliance-controls-overview.md) - [Assessment Profiles](https://cortex-docs.paloaltonetworks.com/xdr-5-api/compliance-controls/assessment-profiles.md) - [Assessment Results](https://cortex-docs.paloaltonetworks.com/xdr-5-api/compliance-controls/assessment-results.md) - [Categories](https://cortex-docs.paloaltonetworks.com/xdr-5-api/compliance-controls/categories.md) - [Compliance Assets](https://cortex-docs.paloaltonetworks.com/xdr-5-api/compliance-controls/compliance-assets.md) - [Controls](https://cortex-docs.paloaltonetworks.com/xdr-5-api/compliance-controls/controls.md) - [Reports](https://cortex-docs.paloaltonetworks.com/xdr-5-api/compliance-controls/reports.md) - [Results](https://cortex-docs.paloaltonetworks.com/xdr-5-api/compliance-controls/results.md) - [Rules](https://cortex-docs.paloaltonetworks.com/xdr-5-api/compliance-controls/rules.md) - [Standards](https://cortex-docs.paloaltonetworks.com/xdr-5-api/compliance-controls/standards.md) - [Models](https://cortex-docs.paloaltonetworks.com/xdr-5-api/compliance-controls/models.md) - [Data Security Posture Management overview](https://cortex-docs.paloaltonetworks.com/xdr-5-api/data-security-posture-management/data-security-posture-management-overview.md) - [Inventory](https://cortex-docs.paloaltonetworks.com/xdr-5-api/data-security-posture-management/inventory.md) - [Models](https://cortex-docs.paloaltonetworks.com/xdr-5-api/data-security-posture-management/models.md) - [Detection Rules Management overview](https://cortex-docs.paloaltonetworks.com/xdr-5-api/detection-rules-management/detection-rules-management-overview.md) - [Detection Rules](https://cortex-docs.paloaltonetworks.com/xdr-5-api/detection-rules-management/detection-rules.md) - [Models](https://cortex-docs.paloaltonetworks.com/xdr-5-api/detection-rules-management/models.md) - [Disable Injection and Prevention Rules overview](https://cortex-docs.paloaltonetworks.com/xdr-5-api/disable-injection-and-prevention-rules/disable-injection-and-prevention-rules-overview.md) - [Disable Injection and Prevention Rules Public API](https://cortex-docs.paloaltonetworks.com/xdr-5-api/disable-injection-and-prevention-rules/disable-injection-and-prevention-rules-public-api.md) - [Models](https://cortex-docs.paloaltonetworks.com/xdr-5-api/disable-injection-and-prevention-rules/models.md) - [Disable Prevention Rule overview](https://cortex-docs.paloaltonetworks.com/xdr-5-api/disable-prevention-rule/disable-prevention-rule-overview.md) - [Disable Prevention Rule Public APIs](https://cortex-docs.paloaltonetworks.com/xdr-5-api/disable-prevention-rule/disable-prevention-rule-public-apis.md) - [Models](https://cortex-docs.paloaltonetworks.com/xdr-5-api/disable-prevention-rule/models.md) - [External Application Management overview](https://cortex-docs.paloaltonetworks.com/xdr-5-api/external-application-management/external-application-management-overview.md) - [External Applications](https://cortex-docs.paloaltonetworks.com/xdr-5-api/external-application-management/external-applications.md) - [Models](https://cortex-docs.paloaltonetworks.com/xdr-5-api/external-application-management/models.md) - [Forensics overview](https://cortex-docs.paloaltonetworks.com/xdr-5-api/forensics/forensics-overview.md) - [Forensics](https://cortex-docs.paloaltonetworks.com/xdr-5-api/forensics/forensics.md) - [Models](https://cortex-docs.paloaltonetworks.com/xdr-5-api/forensics/models.md) - [Cortex Platform IAM Overview](https://cortex-docs.paloaltonetworks.com/xdr-5-api/identity-and-access-management-iam/cortex-platform-iam-overview.md) - [API Keys](https://cortex-docs.paloaltonetworks.com/xdr-5-api/identity-and-access-management-iam/api-keys.md) - [Roles](https://cortex-docs.paloaltonetworks.com/xdr-5-api/identity-and-access-management-iam/roles.md) - [Scopes](https://cortex-docs.paloaltonetworks.com/xdr-5-api/identity-and-access-management-iam/scopes.md) - [User](https://cortex-docs.paloaltonetworks.com/xdr-5-api/identity-and-access-management-iam/user.md) - [User Groups](https://cortex-docs.paloaltonetworks.com/xdr-5-api/identity-and-access-management-iam/user-groups.md) - [Models](https://cortex-docs.paloaltonetworks.com/xdr-5-api/identity-and-access-management-iam/models.md) - [Issues APIs overview](https://cortex-docs.paloaltonetworks.com/xdr-5-api/issues-apis/issues-apis-overview.md) - [Issues](https://cortex-docs.paloaltonetworks.com/xdr-5-api/issues-apis/issues.md) - [Models](https://cortex-docs.paloaltonetworks.com/xdr-5-api/issues-apis/models.md) - [Additional References](https://cortex-docs.paloaltonetworks.com/xdr-5-api/issues-apis/issues-papi-tables.md) - [Logging and Collection Service Management overview](https://cortex-docs.paloaltonetworks.com/xdr-5-api/logging-and-collection-service-management/logging-and-collection-service-management-overview.md) - [CLCS Management](https://cortex-docs.paloaltonetworks.com/xdr-5-api/logging-and-collection-service-management/clcs-management.md) - [Models](https://cortex-docs.paloaltonetworks.com/xdr-5-api/logging-and-collection-service-management/models.md) - [Managed Services Overview](https://cortex-docs.paloaltonetworks.com/xdr-5-api/managed-services/managed-services-overview.md) - [Assignment](https://cortex-docs.paloaltonetworks.com/xdr-5-api/managed-services/assignment.md) - [Comments](https://cortex-docs.paloaltonetworks.com/xdr-5-api/managed-services/comments.md) - [Reports](https://cortex-docs.paloaltonetworks.com/xdr-5-api/managed-services/reports.md) - [Status](https://cortex-docs.paloaltonetworks.com/xdr-5-api/managed-services/status.md) - [Models](https://cortex-docs.paloaltonetworks.com/xdr-5-api/managed-services/models.md) - [Netscan overview](https://cortex-docs.paloaltonetworks.com/xdr-5-api/netscan/netscan-overview.md) - [Vulnerability Network Scan Management](https://cortex-docs.paloaltonetworks.com/xdr-5-api/netscan/vulnerability-network-scan-management.md) - [Models](https://cortex-docs.paloaltonetworks.com/xdr-5-api/netscan/models.md) - [Policies overview](https://cortex-docs.paloaltonetworks.com/xdr-5-api/policies/policies-overview.md) - [Cloud Security Policies](https://cortex-docs.paloaltonetworks.com/xdr-5-api/policies/cloud-security-policies.md) - [Models](https://cortex-docs.paloaltonetworks.com/xdr-5-api/policies/models.md) - [Restore Distributions overview](https://cortex-docs.paloaltonetworks.com/xdr-5-api/restore-distributions/restore-distributions-overview.md) - [Restore Distributions](https://cortex-docs.paloaltonetworks.com/xdr-5-api/restore-distributions/restore-distributions.md) - [Models](https://cortex-docs.paloaltonetworks.com/xdr-5-api/restore-distributions/models.md) - [Unified Rules overview](https://cortex-docs.paloaltonetworks.com/xdr-5-api/unified-rules/unified-rules-overview.md) - [Unified Rules](https://cortex-docs.paloaltonetworks.com/xdr-5-api/unified-rules/unified-rules.md) - [Models](https://cortex-docs.paloaltonetworks.com/xdr-5-api/unified-rules/models.md) - [Vulnerability Intelligence Overview](https://cortex-docs.paloaltonetworks.com/xdr-5-api/vulnerability-intelligence/vulnerability-intelligence-overview.md) - [Affected Software](https://cortex-docs.paloaltonetworks.com/xdr-5-api/vulnerability-intelligence/affected-software.md) - [Vulnerabilities](https://cortex-docs.paloaltonetworks.com/xdr-5-api/vulnerability-intelligence/vulnerabilities.md) - [Models](https://cortex-docs.paloaltonetworks.com/xdr-5-api/vulnerability-intelligence/models.md) - [Additional References](https://cortex-docs.paloaltonetworks.com/xdr-5-api/vulnerability-intelligence/vulnerability-intelligence-papi-tables.md) - [Vulnerability Management Overview](https://cortex-docs.paloaltonetworks.com/xdr-5-api/vulnerability-management/vulnerability-management-overview.md) - [Vulnerability Management](https://cortex-docs.paloaltonetworks.com/xdr-5-api/vulnerability-management/vulnerability-management.md) - [Vulnerability Findings](https://cortex-docs.paloaltonetworks.com/xdr-5-api/vulnerability-management/vulnerability-findings.md) - [Vulnerability Findings Snapshot](https://cortex-docs.paloaltonetworks.com/xdr-5-api/vulnerability-management/vulnerability-findings-snapshot.md) - [Bring Your Own Scanner](https://cortex-docs.paloaltonetworks.com/xdr-5-api/vulnerability-management/bring-your-own-scanner.md) - [Models](https://cortex-docs.paloaltonetworks.com/xdr-5-api/vulnerability-management/models.md) ## XDR 3.x APIs - [Get started with Cortex XDR 3.x APIs](https://cortex-docs.paloaltonetworks.com/xdr-3-api/get-started-with-cortex-xdr-apis.md) - [Run XQL Query APIs](https://cortex-docs.paloaltonetworks.com/xdr-3-api/run-xql-query-apis.md) - [Cortex XDR APIs Overview](https://cortex-docs.paloaltonetworks.com/xdr-3-api/cortex-xdr-3.x-apis/cortex-xdr-apis-overview.md) - [Authentication Settings](https://cortex-docs.paloaltonetworks.com/xdr-3-api/cortex-xdr-3.x-apis/authentication-settings.md) - [Audit Log](https://cortex-docs.paloaltonetworks.com/xdr-3-api/cortex-xdr-3.x-apis/audit-log.md) - [Dataset Management](https://cortex-docs.paloaltonetworks.com/xdr-3-api/cortex-xdr-3.x-apis/dataset-management.md) - [Endpoint Management](https://cortex-docs.paloaltonetworks.com/xdr-3-api/cortex-xdr-3.x-apis/endpoint-management.md) - [Incident Management](https://cortex-docs.paloaltonetworks.com/xdr-3-api/cortex-xdr-3.x-apis/incident-management.md) - [Lookup Datasets](https://cortex-docs.paloaltonetworks.com/xdr-3-api/cortex-xdr-3.x-apis/lookup-datasets.md) - [Response Action](https://cortex-docs.paloaltonetworks.com/xdr-3-api/cortex-xdr-3.x-apis/response-action.md) - [Rule Management](https://cortex-docs.paloaltonetworks.com/xdr-3-api/cortex-xdr-3.x-apis/rule-management.md) - [Script Execution](https://cortex-docs.paloaltonetworks.com/xdr-3-api/cortex-xdr-3.x-apis/script-execution.md) - [Syslog Servers](https://cortex-docs.paloaltonetworks.com/xdr-3-api/cortex-xdr-3.x-apis/syslog-servers.md) - [System Management](https://cortex-docs.paloaltonetworks.com/xdr-3-api/cortex-xdr-3.x-apis/system-management.md) - [XQL Query](https://cortex-docs.paloaltonetworks.com/xdr-3-api/cortex-xdr-3.x-apis/xql-query.md) - [Models](https://cortex-docs.paloaltonetworks.com/xdr-3-api/cortex-xdr-3.x-apis/models.md) - [Additional References](https://cortex-docs.paloaltonetworks.com/xdr-3-api/cortex-xdr-3.x-apis/cortex-xdr-tables.md) - [Broker VM (Tenant-Side) overview](https://cortex-docs.paloaltonetworks.com/xdr-3-api/broker-vm-tenant-side/broker-vm-tenant-overview.md) - [Brokers](https://cortex-docs.paloaltonetworks.com/xdr-3-api/broker-vm-tenant-side/brokers.md) - [Actions](https://cortex-docs.paloaltonetworks.com/xdr-3-api/broker-vm-tenant-side/actions.md) - [Install images](https://cortex-docs.paloaltonetworks.com/xdr-3-api/broker-vm-tenant-side/install-images.md) - [Applets](https://cortex-docs.paloaltonetworks.com/xdr-3-api/broker-vm-tenant-side/applets.md) - [Remote log bundle](https://cortex-docs.paloaltonetworks.com/xdr-3-api/broker-vm-tenant-side/remote-log-bundle.md) - [Models](https://cortex-docs.paloaltonetworks.com/xdr-3-api/broker-vm-tenant-side/models.md) - [Additional References](https://cortex-docs.paloaltonetworks.com/xdr-3-api/broker-vm-tenant-side/broker-papi-tables.md) ## XSIAM APIs - [Get started with Cortex XSIAM APIs](https://cortex-docs.paloaltonetworks.com/xsiam-api/get-started-with-cortex-apis.md) - [What's new in this release](https://cortex-docs.paloaltonetworks.com/xsiam-api/api-release-notes.md) - [Create a new API key](https://cortex-docs.paloaltonetworks.com/xsiam-api/create-a-new-api-key.md) - [Get your Cortex XSIAM API key ID](https://cortex-docs.paloaltonetworks.com/xsiam-api/get-your-cortex-api-key-id.md) - [Get your FQDN](https://cortex-docs.paloaltonetworks.com/xsiam-api/get-your-fqdn.md) - [Make your first API call](https://cortex-docs.paloaltonetworks.com/xsiam-api/make-your-first-api-call.md) - [Understand Cortex XSIAM licenses](https://cortex-docs.paloaltonetworks.com/xsiam-api/understand-cortex-xsiam-licenses.md) - [Cortex XSIAM Platform Overview](https://cortex-docs.paloaltonetworks.com/xsiam-api/cortex-platform/cortex-xsiam-platform-overview.md) - [API Keys](https://cortex-docs.paloaltonetworks.com/xsiam-api/cortex-platform/api-keys.md) - [Asset Groups](https://cortex-docs.paloaltonetworks.com/xsiam-api/cortex-platform/asset-groups.md) - [Asset Inventory](https://cortex-docs.paloaltonetworks.com/xsiam-api/cortex-platform/asset-inventory.md) - [Attack Surface Management](https://cortex-docs.paloaltonetworks.com/xsiam-api/cortex-platform/attack-surface-management.md) - [Audit Log](https://cortex-docs.paloaltonetworks.com/xsiam-api/cortex-platform/audit-log.md) - [Authentication Settings](https://cortex-docs.paloaltonetworks.com/xsiam-api/cortex-platform/authentication-settings.md) - [BIOCs](https://cortex-docs.paloaltonetworks.com/xsiam-api/cortex-platform/biocs.md) - [Correlation Rules](https://cortex-docs.paloaltonetworks.com/xsiam-api/cortex-platform/correlation-rules.md) - [Cortex CLI](https://cortex-docs.paloaltonetworks.com/xsiam-api/cortex-platform/cortex-cli.md) - [Dashboards](https://cortex-docs.paloaltonetworks.com/xsiam-api/cortex-platform/dashboards.md) - [Dataset Management](https://cortex-docs.paloaltonetworks.com/xsiam-api/cortex-platform/dataset-management.md) - [Endpoint Management](https://cortex-docs.paloaltonetworks.com/xsiam-api/cortex-platform/endpoint-management.md) - [IOCs](https://cortex-docs.paloaltonetworks.com/xsiam-api/cortex-platform/iocs.md) - [Lookup Datasets](https://cortex-docs.paloaltonetworks.com/xsiam-api/cortex-platform/lookup-datasets.md) - [Playbooks](https://cortex-docs.paloaltonetworks.com/xsiam-api/cortex-platform/playbooks.md) - [Query Library](https://cortex-docs.paloaltonetworks.com/xsiam-api/cortex-platform/query-library.md) - [Response Action](https://cortex-docs.paloaltonetworks.com/xsiam-api/cortex-platform/response-action.md) - [Scheduled Queries](https://cortex-docs.paloaltonetworks.com/xsiam-api/cortex-platform/scheduled-queries.md) - [Script Execution](https://cortex-docs.paloaltonetworks.com/xsiam-api/cortex-platform/script-execution.md) - [Scripts](https://cortex-docs.paloaltonetworks.com/xsiam-api/cortex-platform/scripts.md) - [Syslog Servers](https://cortex-docs.paloaltonetworks.com/xsiam-api/cortex-platform/syslog-servers.md) - [System Management](https://cortex-docs.paloaltonetworks.com/xsiam-api/cortex-platform/system-management.md) - [Widgets](https://cortex-docs.paloaltonetworks.com/xsiam-api/cortex-platform/widgets.md) - [XQL Query](https://cortex-docs.paloaltonetworks.com/xsiam-api/cortex-platform/xql-query.md) - [XQL User Datasets](https://cortex-docs.paloaltonetworks.com/xsiam-api/cortex-platform/xql-user-datasets.md) - [Models](https://cortex-docs.paloaltonetworks.com/xsiam-api/cortex-platform/models.md) - [Run XQL query APIs](https://cortex-docs.paloaltonetworks.com/xsiam-api/cortex-platform/run-xql-query-apis.md) - [Additional References](https://cortex-docs.paloaltonetworks.com/xsiam-api/cortex-platform/cortex-platform-papi-tables.md) - [Agent Configuration Settings overview](https://cortex-docs.paloaltonetworks.com/xsiam-api/agent-configuration-settings/agent-configuration-settings-overview.md) - [Agent Configurations](https://cortex-docs.paloaltonetworks.com/xsiam-api/agent-configuration-settings/agent-configurations.md) - [Models](https://cortex-docs.paloaltonetworks.com/xsiam-api/agent-configuration-settings/models.md) - [Alert Notification Rules overview](https://cortex-docs.paloaltonetworks.com/xsiam-api/alert-notification-rules/alert-notification-rules-overview.md) - [Alert Notification Rules](https://cortex-docs.paloaltonetworks.com/xsiam-api/alert-notification-rules/alert-notification-rules.md) - [Models](https://cortex-docs.paloaltonetworks.com/xsiam-api/alert-notification-rules/models.md) - [ASPM, CI/CD, and Application Security Overview](https://cortex-docs.paloaltonetworks.com/xsiam-api/aspm-cicd-and-application-security/aspm-cicd-and-application-security-overview.md) - [Additional References](https://cortex-docs.paloaltonetworks.com/xsiam-api/aspm-cicd-and-application-security/appsec-papi-tables.md) - [Billing](https://cortex-docs.paloaltonetworks.com/xsiam-api/aspm-cicd-and-application-security/billing.md) - [Applications](https://cortex-docs.paloaltonetworks.com/xsiam-api/aspm-cicd-and-application-security/applications.md) - [Criteria](https://cortex-docs.paloaltonetworks.com/xsiam-api/aspm-cicd-and-application-security/criteria.md) - [Data Sources](https://cortex-docs.paloaltonetworks.com/xsiam-api/aspm-cicd-and-application-security/data-sources.md) - [Policies](https://cortex-docs.paloaltonetworks.com/xsiam-api/aspm-cicd-and-application-security/policies.md) - [Package Explorer](https://cortex-docs.paloaltonetworks.com/xsiam-api/aspm-cicd-and-application-security/package-explorer.md) - [Repositories](https://cortex-docs.paloaltonetworks.com/xsiam-api/aspm-cicd-and-application-security/repositories.md) - [Remediations](https://cortex-docs.paloaltonetworks.com/xsiam-api/aspm-cicd-and-application-security/remediations.md) - [Rules](https://cortex-docs.paloaltonetworks.com/xsiam-api/aspm-cicd-and-application-security/rules.md) - [SBOM Management](https://cortex-docs.paloaltonetworks.com/xsiam-api/aspm-cicd-and-application-security/sbom-management.md) - [Scan Management](https://cortex-docs.paloaltonetworks.com/xsiam-api/aspm-cicd-and-application-security/scan-management.md) - [Cloud Coverage](https://cortex-docs.paloaltonetworks.com/xsiam-api/aspm-cicd-and-application-security/cloud-coverage.md) - [Models](https://cortex-docs.paloaltonetworks.com/xsiam-api/aspm-cicd-and-application-security/models.md) - [Asset Compliance overview](https://cortex-docs.paloaltonetworks.com/xsiam-api/asset-compliance/asset-compliance-overview.md) - [Control Findings](https://cortex-docs.paloaltonetworks.com/xsiam-api/asset-compliance/control-findings.md) - [Models](https://cortex-docs.paloaltonetworks.com/xsiam-api/asset-compliance/models.md) - [Additional References](https://cortex-docs.paloaltonetworks.com/xsiam-api/asset-compliance/asset-compliance-papi-tables.md) - [Broker VM (On-Appliance) overview](https://cortex-docs.paloaltonetworks.com/xsiam-api/broker-vm-on-appliance/broker-vm-appliance-overview.md) - [Auth (bootstrap)](https://cortex-docs.paloaltonetworks.com/xsiam-api/broker-vm-on-appliance/auth-bootstrap.md) - [Registration](https://cortex-docs.paloaltonetworks.com/xsiam-api/broker-vm-on-appliance/registration.md) - [Network configuration](https://cortex-docs.paloaltonetworks.com/xsiam-api/broker-vm-on-appliance/network-configuration.md) - [Local log bundle](https://cortex-docs.paloaltonetworks.com/xsiam-api/broker-vm-on-appliance/local-log-bundle.md) - [Models](https://cortex-docs.paloaltonetworks.com/xsiam-api/broker-vm-on-appliance/models.md) - [Broker VM (Tenant-Side) overview](https://cortex-docs.paloaltonetworks.com/xsiam-api/broker-vm-tenant-side/broker-vm-tenant-overview.md) - [Brokers](https://cortex-docs.paloaltonetworks.com/xsiam-api/broker-vm-tenant-side/brokers.md) - [Actions](https://cortex-docs.paloaltonetworks.com/xsiam-api/broker-vm-tenant-side/actions.md) - [Install images](https://cortex-docs.paloaltonetworks.com/xsiam-api/broker-vm-tenant-side/install-images.md) - [Applets](https://cortex-docs.paloaltonetworks.com/xsiam-api/broker-vm-tenant-side/applets.md) - [Remote log bundle](https://cortex-docs.paloaltonetworks.com/xsiam-api/broker-vm-tenant-side/remote-log-bundle.md) - [Models](https://cortex-docs.paloaltonetworks.com/xsiam-api/broker-vm-tenant-side/models.md) - [Additional References](https://cortex-docs.paloaltonetworks.com/xsiam-api/broker-vm-tenant-side/broker-papi-tables.md) - [Cases APIs overview](https://cortex-docs.paloaltonetworks.com/xsiam-api/cases-apis/cases-apis-overview.md) - [Cases](https://cortex-docs.paloaltonetworks.com/xsiam-api/cases-apis/cases.md) - [Models](https://cortex-docs.paloaltonetworks.com/xsiam-api/cases-apis/models.md) - [Additional References](https://cortex-docs.paloaltonetworks.com/xsiam-api/cases-apis/cases-papi-tables.md) - [Cloud Infrastructure Entitlement Management (CIEM) overview](https://cortex-docs.paloaltonetworks.com/xsiam-api/cloud-infrastructure-entitlement-management-ciem/cloud-infrastructure-entitlement-management-ciem-overview.md) - [CIEM](https://cortex-docs.paloaltonetworks.com/xsiam-api/cloud-infrastructure-entitlement-management-ciem/ciem.md) - [Models](https://cortex-docs.paloaltonetworks.com/xsiam-api/cloud-infrastructure-entitlement-management-ciem/models.md) - [Cloud Onboarding API overview](https://cortex-docs.paloaltonetworks.com/xsiam-api/cloud-onboarding/cloud-onboarding-overview.md) - [Cloud Instance Management](https://cortex-docs.paloaltonetworks.com/xsiam-api/cloud-onboarding/cloud-instance-management.md) - [Manual Onboarding](https://cortex-docs.paloaltonetworks.com/xsiam-api/cloud-onboarding/manual-onboarding.md) - [Cloud Account Management](https://cortex-docs.paloaltonetworks.com/xsiam-api/cloud-onboarding/cloud-account-management.md) - [Outpost Management](https://cortex-docs.paloaltonetworks.com/xsiam-api/cloud-onboarding/outpost-management.md) - [General](https://cortex-docs.paloaltonetworks.com/xsiam-api/cloud-onboarding/general.md) - [Models](https://cortex-docs.paloaltonetworks.com/xsiam-api/cloud-onboarding/models.md) - [Cloud Workload Protection Overview](https://cortex-docs.paloaltonetworks.com/xsiam-api/cloud-workload-protection/cloud-workload-protection-overview.md) - [Policies](https://cortex-docs.paloaltonetworks.com/xsiam-api/cloud-workload-protection/policies.md) - [SBOM](https://cortex-docs.paloaltonetworks.com/xsiam-api/cloud-workload-protection/sbom.md) - [Registry Onboarding](https://cortex-docs.paloaltonetworks.com/xsiam-api/cloud-workload-protection/registry-onboarding.md) - [Models](https://cortex-docs.paloaltonetworks.com/xsiam-api/cloud-workload-protection/models.md) - [Compliance Controls Overview](https://cortex-docs.paloaltonetworks.com/xsiam-api/compliance-controls/compliance-controls-overview.md) - [Assessment Profiles](https://cortex-docs.paloaltonetworks.com/xsiam-api/compliance-controls/assessment-profiles.md) - [Assessment Results](https://cortex-docs.paloaltonetworks.com/xsiam-api/compliance-controls/assessment-results.md) - [Categories](https://cortex-docs.paloaltonetworks.com/xsiam-api/compliance-controls/categories.md) - [Compliance Assets](https://cortex-docs.paloaltonetworks.com/xsiam-api/compliance-controls/compliance-assets.md) - [Controls](https://cortex-docs.paloaltonetworks.com/xsiam-api/compliance-controls/controls.md) - [Reports](https://cortex-docs.paloaltonetworks.com/xsiam-api/compliance-controls/reports.md) - [Results](https://cortex-docs.paloaltonetworks.com/xsiam-api/compliance-controls/results.md) - [Rules](https://cortex-docs.paloaltonetworks.com/xsiam-api/compliance-controls/rules.md) - [Standards](https://cortex-docs.paloaltonetworks.com/xsiam-api/compliance-controls/standards.md) - [Models](https://cortex-docs.paloaltonetworks.com/xsiam-api/compliance-controls/models.md) - [Data Security Posture Management overview](https://cortex-docs.paloaltonetworks.com/xsiam-api/data-security-posture-management/data-security-posture-management-overview.md) - [Data Security Posture Management APIs](https://cortex-docs.paloaltonetworks.com/xsiam-api/data-security-posture-management/data-security-posture-management-apis.md) - [Models](https://cortex-docs.paloaltonetworks.com/xsiam-api/data-security-posture-management/models.md) - [Disable Injection and Prevention Rules overview](https://cortex-docs.paloaltonetworks.com/xsiam-api/disable-injection-and-prevention-rules/disable-injection-and-prevention-rules-overview.md) - [Disable Injection and Prevention Rules Public API](https://cortex-docs.paloaltonetworks.com/xsiam-api/disable-injection-and-prevention-rules/disable-injection-and-prevention-rules-public-api.md) - [Models](https://cortex-docs.paloaltonetworks.com/xsiam-api/disable-injection-and-prevention-rules/models.md) - [Disable Prevention Rule overview](https://cortex-docs.paloaltonetworks.com/xsiam-api/disable-prevention-rule/disable-prevention-rule-overview.md) - [Disable Prevention Rule Public APIs](https://cortex-docs.paloaltonetworks.com/xsiam-api/disable-prevention-rule/disable-prevention-rule-public-apis.md) - [Models](https://cortex-docs.paloaltonetworks.com/xsiam-api/disable-prevention-rule/models.md) - [External Application Management overview](https://cortex-docs.paloaltonetworks.com/xsiam-api/external-application-management/external-application-management-overview.md) - [External Applications](https://cortex-docs.paloaltonetworks.com/xsiam-api/external-application-management/external-applications.md) - [Models](https://cortex-docs.paloaltonetworks.com/xsiam-api/external-application-management/models.md) - [Forensics overview](https://cortex-docs.paloaltonetworks.com/xsiam-api/forensics/forensics-overview.md) - [Forensics](https://cortex-docs.paloaltonetworks.com/xsiam-api/forensics/forensics.md) - [Models](https://cortex-docs.paloaltonetworks.com/xsiam-api/forensics/models.md) - [Cortex Platform IAM Overview](https://cortex-docs.paloaltonetworks.com/xsiam-api/identity-and-access-management-iam/cortex-platform-iam-overview.md) - [API Keys](https://cortex-docs.paloaltonetworks.com/xsiam-api/identity-and-access-management-iam/api-keys.md) - [Roles](https://cortex-docs.paloaltonetworks.com/xsiam-api/identity-and-access-management-iam/roles.md) - [Scopes](https://cortex-docs.paloaltonetworks.com/xsiam-api/identity-and-access-management-iam/scopes.md) - [User](https://cortex-docs.paloaltonetworks.com/xsiam-api/identity-and-access-management-iam/user.md) - [User Groups](https://cortex-docs.paloaltonetworks.com/xsiam-api/identity-and-access-management-iam/user-groups.md) - [Models](https://cortex-docs.paloaltonetworks.com/xsiam-api/identity-and-access-management-iam/models.md) - [Integrations overview](https://cortex-docs.paloaltonetworks.com/xsiam-api/integrations/integrations-overview.md) - [Integrations](https://cortex-docs.paloaltonetworks.com/xsiam-api/integrations/integrations.md) - [Models](https://cortex-docs.paloaltonetworks.com/xsiam-api/integrations/models.md) - [Issues APIs overview](https://cortex-docs.paloaltonetworks.com/xsiam-api/issues-apis/issues-apis-overview.md) - [Issues](https://cortex-docs.paloaltonetworks.com/xsiam-api/issues-apis/issues.md) - [Models](https://cortex-docs.paloaltonetworks.com/xsiam-api/issues-apis/models.md) - [Logging and Collection Service Management overview](https://cortex-docs.paloaltonetworks.com/xsiam-api/logging-and-collection-service-management/logging-and-collection-service-management-overview.md) - [CLCS Management](https://cortex-docs.paloaltonetworks.com/xsiam-api/logging-and-collection-service-management/clcs-management.md) - [Models](https://cortex-docs.paloaltonetworks.com/xsiam-api/logging-and-collection-service-management/models.md) - [Managed Services Overview](https://cortex-docs.paloaltonetworks.com/xsiam-api/managed-services/managed-services-overview.md) - [Assignment](https://cortex-docs.paloaltonetworks.com/xsiam-api/managed-services/assignment.md) - [Comments](https://cortex-docs.paloaltonetworks.com/xsiam-api/managed-services/comments.md) - [Reports](https://cortex-docs.paloaltonetworks.com/xsiam-api/managed-services/reports.md) - [Status](https://cortex-docs.paloaltonetworks.com/xsiam-api/managed-services/status.md) - [Models](https://cortex-docs.paloaltonetworks.com/xsiam-api/managed-services/models.md) - [Netscan overview](https://cortex-docs.paloaltonetworks.com/xsiam-api/netscan/netscan-overview.md) - [Vulnerability Network Scan Management](https://cortex-docs.paloaltonetworks.com/xsiam-api/netscan/vulnerability-network-scan-management.md) - [Models](https://cortex-docs.paloaltonetworks.com/xsiam-api/netscan/models.md) - [Policies overview](https://cortex-docs.paloaltonetworks.com/xsiam-api/policies/policies-overview.md) - [Cloud Security Policies](https://cortex-docs.paloaltonetworks.com/xsiam-api/policies/cloud-security-policies.md) - [Models](https://cortex-docs.paloaltonetworks.com/xsiam-api/policies/models.md) - [Restore Distributions overview](https://cortex-docs.paloaltonetworks.com/xsiam-api/restore-distributions/restore-distributions-overview.md) - [Restore Distributions](https://cortex-docs.paloaltonetworks.com/xsiam-api/restore-distributions/restore-distributions.md) - [Models](https://cortex-docs.paloaltonetworks.com/xsiam-api/restore-distributions/models.md) - [Unified Rules overview](https://cortex-docs.paloaltonetworks.com/xsiam-api/unified-rules/unified-rules-overview.md) - [Unified Rules](https://cortex-docs.paloaltonetworks.com/xsiam-api/unified-rules/unified-rules.md) - [Models](https://cortex-docs.paloaltonetworks.com/xsiam-api/unified-rules/models.md) - [Vulnerability Intelligence Overview](https://cortex-docs.paloaltonetworks.com/xsiam-api/vulnerability-intelligence/vulnerability-intelligence-overview.md) - [Affected Software](https://cortex-docs.paloaltonetworks.com/xsiam-api/vulnerability-intelligence/affected-software.md) - [Vulnerabilities](https://cortex-docs.paloaltonetworks.com/xsiam-api/vulnerability-intelligence/vulnerabilities.md) - [Models](https://cortex-docs.paloaltonetworks.com/xsiam-api/vulnerability-intelligence/models.md) - [Additional References](https://cortex-docs.paloaltonetworks.com/xsiam-api/vulnerability-intelligence/vulnerability-intelligence-papi-tables.md) - [Vulnerability Management Overview](https://cortex-docs.paloaltonetworks.com/xsiam-api/vulnerability-management/vulnerability-management-overview.md) - [Vulnerability Management](https://cortex-docs.paloaltonetworks.com/xsiam-api/vulnerability-management/vulnerability-management.md) - [Vulnerability Findings](https://cortex-docs.paloaltonetworks.com/xsiam-api/vulnerability-management/vulnerability-findings.md) - [Vulnerability Findings Snapshot](https://cortex-docs.paloaltonetworks.com/xsiam-api/vulnerability-management/vulnerability-findings-snapshot.md) - [Bring Your Own Scanner](https://cortex-docs.paloaltonetworks.com/xsiam-api/vulnerability-management/bring-your-own-scanner.md) - [Models](https://cortex-docs.paloaltonetworks.com/xsiam-api/vulnerability-management/models.md) - [Forensics](https://cortex-docs.paloaltonetworks.com/xsiam-api/forensics-1/forensics.md) - [Models](https://cortex-docs.paloaltonetworks.com/xsiam-api/forensics-1/models.md) - [Cloud Consumption Dashboard API overview](https://cortex-docs.paloaltonetworks.com/xsiam-api/cloud-consumption-dashboard/cloud-consumption-overview.md) - [Cloud Consumption Dashboard](https://cortex-docs.paloaltonetworks.com/xsiam-api/cloud-consumption-dashboard/cloud-consumption-dashboard.md): Retrieve workload consumption data per asset type, over time, and in a paginated details grid. - [Licensing](https://cortex-docs.paloaltonetworks.com/xsiam-api/cloud-consumption-dashboard/licensing.md): Retrieve tenant license entitlements and add-on information. - [Models](https://cortex-docs.paloaltonetworks.com/xsiam-api/cloud-consumption-dashboard/models.md) ## XSOAR 8.x APIs - [Get started with Cortex XSOAR 8.x APIs](https://cortex-docs.paloaltonetworks.com/xsoar-8-api/get-started-with-cortex-xsoar-8-apis.md) - [Changes in this release](https://cortex-docs.paloaltonetworks.com/xsoar-8-api/changes-in-this-release.md) - [Create a new API key](https://cortex-docs.paloaltonetworks.com/xsoar-8-api/create-a-new-api-key.md) - [Get your Cortex XSOAR API key ID](https://cortex-docs.paloaltonetworks.com/xsoar-8-api/get-your-cortex-xsoar-api-key-id.md) - [Get your FQDN](https://cortex-docs.paloaltonetworks.com/xsoar-8-api/get-your-fqdn.md) - [Make your first API call](https://cortex-docs.paloaltonetworks.com/xsoar-8-api/make-your-first-api-call.md) - [Optimistic locking and versioning](https://cortex-docs.paloaltonetworks.com/xsoar-8-api/optimistic-locking-and-versioning.md) - [Cortex XSOAR 8 APIs Overview](https://cortex-docs.paloaltonetworks.com/xsoar-8-api/cortex-xsoar-8.x-apis/cortex-xsoar-8-apis-overview.md) - [API Keys](https://cortex-docs.paloaltonetworks.com/xsoar-8-api/cortex-xsoar-8.x-apis/api-keys.md) - [Audit Log](https://cortex-docs.paloaltonetworks.com/xsoar-8-api/cortex-xsoar-8.x-apis/audit-log.md) - [Authentication Settings](https://cortex-docs.paloaltonetworks.com/xsoar-8-api/cortex-xsoar-8.x-apis/authentication-settings.md) - [Content Packs](https://cortex-docs.paloaltonetworks.com/xsoar-8-api/cortex-xsoar-8.x-apis/content-packs.md) - [Dashboards](https://cortex-docs.paloaltonetworks.com/xsoar-8-api/cortex-xsoar-8.x-apis/dashboards.md) - [Engines](https://cortex-docs.paloaltonetworks.com/xsoar-8-api/cortex-xsoar-8.x-apis/engines.md) - [Entry](https://cortex-docs.paloaltonetworks.com/xsoar-8-api/cortex-xsoar-8.x-apis/entry.md) - [Evidence](https://cortex-docs.paloaltonetworks.com/xsoar-8-api/cortex-xsoar-8.x-apis/evidence.md) - [Incident Fields](https://cortex-docs.paloaltonetworks.com/xsoar-8-api/cortex-xsoar-8.x-apis/incident-fields.md) - [Incidents](https://cortex-docs.paloaltonetworks.com/xsoar-8-api/cortex-xsoar-8.x-apis/incidents.md) - [Indicators](https://cortex-docs.paloaltonetworks.com/xsoar-8-api/cortex-xsoar-8.x-apis/indicators.md) - [Integrations](https://cortex-docs.paloaltonetworks.com/xsoar-8-api/cortex-xsoar-8.x-apis/integrations.md) - [Investigations](https://cortex-docs.paloaltonetworks.com/xsoar-8-api/cortex-xsoar-8.x-apis/investigations.md) - [Jobs](https://cortex-docs.paloaltonetworks.com/xsoar-8-api/cortex-xsoar-8.x-apis/jobs.md) - [Lists](https://cortex-docs.paloaltonetworks.com/xsoar-8-api/cortex-xsoar-8.x-apis/lists.md) - [Multi Tenant](https://cortex-docs.paloaltonetworks.com/xsoar-8-api/cortex-xsoar-8.x-apis/multi-tenant.md) - [Playbooks](https://cortex-docs.paloaltonetworks.com/xsoar-8-api/cortex-xsoar-8.x-apis/playbooks.md) - [Remote Repository](https://cortex-docs.paloaltonetworks.com/xsoar-8-api/cortex-xsoar-8.x-apis/remote-repository.md) - [Reports](https://cortex-docs.paloaltonetworks.com/xsoar-8-api/cortex-xsoar-8.x-apis/reports.md) - [Scripts](https://cortex-docs.paloaltonetworks.com/xsoar-8-api/cortex-xsoar-8.x-apis/scripts.md) - [Syslog Servers](https://cortex-docs.paloaltonetworks.com/xsoar-8-api/cortex-xsoar-8.x-apis/syslog-servers.md) - [System Management](https://cortex-docs.paloaltonetworks.com/xsoar-8-api/cortex-xsoar-8.x-apis/system-management.md) - [Widgets](https://cortex-docs.paloaltonetworks.com/xsoar-8-api/cortex-xsoar-8.x-apis/widgets.md) - [Models](https://cortex-docs.paloaltonetworks.com/xsoar-8-api/cortex-xsoar-8.x-apis/models.md) - [Additional References](https://cortex-docs.paloaltonetworks.com/xsoar-8-api/cortex-xsoar-8.x-apis/xsoar-8-tables.md) ## XSOAR 6.x APIs - [Get started with Cortex XSOAR 6.x APIs](https://cortex-docs.paloaltonetworks.com/xsoar-6-api/readme.md) - [Create a new API key](https://cortex-docs.paloaltonetworks.com/xsoar-6-api/create-a-new-api-key.md) - [Make your first API call](https://cortex-docs.paloaltonetworks.com/xsoar-6-api/make-your-first-api-call.md) - [Optimistic locking and versioning](https://cortex-docs.paloaltonetworks.com/xsoar-6-api/optimistic-locking-and-versioning.md) - [Cortex XSOAR 6 APIs Overview](https://cortex-docs.paloaltonetworks.com/xsoar-6-api/cortex-xsoar-6.x-apis/cortex-xsoar-6-apis-overview.md) - [API Keys](https://cortex-docs.paloaltonetworks.com/xsoar-6-api/cortex-xsoar-6.x-apis/api-keys.md) - [Audit Log](https://cortex-docs.paloaltonetworks.com/xsoar-6-api/cortex-xsoar-6.x-apis/audit-log.md) - [Authentication](https://cortex-docs.paloaltonetworks.com/xsoar-6-api/cortex-xsoar-6.x-apis/authentication.md) - [Content Packs](https://cortex-docs.paloaltonetworks.com/xsoar-6-api/cortex-xsoar-6.x-apis/content-packs.md) - [Dashboards](https://cortex-docs.paloaltonetworks.com/xsoar-6-api/cortex-xsoar-6.x-apis/dashboards.md) - [Entry](https://cortex-docs.paloaltonetworks.com/xsoar-6-api/cortex-xsoar-6.x-apis/entry.md) - [Evidence](https://cortex-docs.paloaltonetworks.com/xsoar-6-api/cortex-xsoar-6.x-apis/evidence.md) - [Incident Fields](https://cortex-docs.paloaltonetworks.com/xsoar-6-api/cortex-xsoar-6.x-apis/incident-fields.md) - [Incidents](https://cortex-docs.paloaltonetworks.com/xsoar-6-api/cortex-xsoar-6.x-apis/incidents.md) - [Indicators](https://cortex-docs.paloaltonetworks.com/xsoar-6-api/cortex-xsoar-6.x-apis/indicators.md) - [Integrations](https://cortex-docs.paloaltonetworks.com/xsoar-6-api/cortex-xsoar-6.x-apis/integrations.md) - [Investigations](https://cortex-docs.paloaltonetworks.com/xsoar-6-api/cortex-xsoar-6.x-apis/investigations.md) - [Playbooks](https://cortex-docs.paloaltonetworks.com/xsoar-6-api/cortex-xsoar-6.x-apis/playbooks.md) - [Reports](https://cortex-docs.paloaltonetworks.com/xsoar-6-api/cortex-xsoar-6.x-apis/reports.md) - [Scripts](https://cortex-docs.paloaltonetworks.com/xsoar-6-api/cortex-xsoar-6.x-apis/scripts.md) - [System Management](https://cortex-docs.paloaltonetworks.com/xsoar-6-api/cortex-xsoar-6.x-apis/system-management.md) - [Widgets](https://cortex-docs.paloaltonetworks.com/xsoar-6-api/cortex-xsoar-6.x-apis/widgets.md) - [Models](https://cortex-docs.paloaltonetworks.com/xsoar-6-api/cortex-xsoar-6.x-apis/models.md) ## AgentiX APIs - [Get started with Cortex AgentiX APIs](https://cortex-docs.paloaltonetworks.com/agentix-api/get-started-with-cortex-apis.md) - [Create a new API key](https://cortex-docs.paloaltonetworks.com/agentix-api/readme.md) - [Get your Cortex AgentiX API key ID](https://cortex-docs.paloaltonetworks.com/agentix-api/get-your-cortex-api-key-id.md) - [Get your FQDN](https://cortex-docs.paloaltonetworks.com/agentix-api/get-your-fqdn.md) - [Make your first API call](https://cortex-docs.paloaltonetworks.com/agentix-api/make-your-first-api-call.md) - [Run XQL query APIs](https://cortex-docs.paloaltonetworks.com/agentix-api/run-xql-query-apis.md) - [Understand Cortex AgentiX licenses](https://cortex-docs.paloaltonetworks.com/agentix-api/understand-cortex-agentix-licenses.md) - [Cortex AgentiX Platform Overview](https://cortex-docs.paloaltonetworks.com/agentix-api/cortex-agentix/cortex-agentix-platform-overview.md) - [API Keys](https://cortex-docs.paloaltonetworks.com/agentix-api/cortex-agentix/api-keys.md) - [Audit Log](https://cortex-docs.paloaltonetworks.com/agentix-api/cortex-agentix/audit-log.md) - [Authentication Settings](https://cortex-docs.paloaltonetworks.com/agentix-api/cortex-agentix/authentication-settings.md) - [Cases](https://cortex-docs.paloaltonetworks.com/agentix-api/cortex-agentix/cases.md) - [Correlation Rules](https://cortex-docs.paloaltonetworks.com/agentix-api/cortex-agentix/correlation-rules.md) - [Dashboards](https://cortex-docs.paloaltonetworks.com/agentix-api/cortex-agentix/dashboards.md) - [Dataset Management](https://cortex-docs.paloaltonetworks.com/agentix-api/cortex-agentix/dataset-management.md) - [Issues](https://cortex-docs.paloaltonetworks.com/agentix-api/cortex-agentix/issues.md) - [Lookup Datasets](https://cortex-docs.paloaltonetworks.com/agentix-api/cortex-agentix/lookup-datasets.md) - [Playbooks](https://cortex-docs.paloaltonetworks.com/agentix-api/cortex-agentix/playbooks.md) - [Query Library](https://cortex-docs.paloaltonetworks.com/agentix-api/cortex-agentix/query-library.md) - [Scheduled Queries](https://cortex-docs.paloaltonetworks.com/agentix-api/cortex-agentix/scheduled-queries.md) - [Script Execution](https://cortex-docs.paloaltonetworks.com/agentix-api/cortex-agentix/script-execution.md) - [Scripts](https://cortex-docs.paloaltonetworks.com/agentix-api/cortex-agentix/scripts.md) - [Syslog Servers](https://cortex-docs.paloaltonetworks.com/agentix-api/cortex-agentix/syslog-servers.md) - [System Management](https://cortex-docs.paloaltonetworks.com/agentix-api/cortex-agentix/system-management.md) - [Widgets](https://cortex-docs.paloaltonetworks.com/agentix-api/cortex-agentix/widgets.md) - [XQL Query](https://cortex-docs.paloaltonetworks.com/agentix-api/cortex-agentix/xql-query.md) - [Models](https://cortex-docs.paloaltonetworks.com/agentix-api/cortex-agentix/models.md) - [Cortex Platform IAM Overview](https://cortex-docs.paloaltonetworks.com/agentix-api/cortex-platform-iam/cortex-platform-iam-overview.md) - [API Keys](https://cortex-docs.paloaltonetworks.com/agentix-api/cortex-platform-iam/api-keys.md) - [Roles](https://cortex-docs.paloaltonetworks.com/agentix-api/cortex-platform-iam/roles.md) - [Scopes](https://cortex-docs.paloaltonetworks.com/agentix-api/cortex-platform-iam/scopes.md) - [User](https://cortex-docs.paloaltonetworks.com/agentix-api/cortex-platform-iam/user.md) - [User Groups](https://cortex-docs.paloaltonetworks.com/agentix-api/cortex-platform-iam/user-groups.md) - [Models](https://cortex-docs.paloaltonetworks.com/agentix-api/cortex-platform-iam/models.md) ## Xpanse APIs - [Get Started with Xpanse APIs](https://cortex-docs.paloaltonetworks.com/xpanse-api/get-started-with-cortex-xpanse-apis.md) - [What's new in this release](https://cortex-docs.paloaltonetworks.com/xpanse-api/changes-to-the-api-in-this-release.md) - [Cortex Xpanse API Overview](https://cortex-docs.paloaltonetworks.com/xpanse-api/xpanse-public-api/cortex-xpanse-api-overview.md) - [Asset Management](https://cortex-docs.paloaltonetworks.com/xpanse-api/xpanse-public-api/asset-management.md) - [Attack Surface Rules](https://cortex-docs.paloaltonetworks.com/xpanse-api/xpanse-public-api/attack-surface-rules.md) - [Audit Log](https://cortex-docs.paloaltonetworks.com/xpanse-api/xpanse-public-api/audit-log.md) - [Incident Management](https://cortex-docs.paloaltonetworks.com/xpanse-api/xpanse-public-api/incident-management.md) - [Remediation Path Rules](https://cortex-docs.paloaltonetworks.com/xpanse-api/xpanse-public-api/remediation-path-rules.md) - [Remediation Scanning](https://cortex-docs.paloaltonetworks.com/xpanse-api/xpanse-public-api/remediation-scanning.md) - [System Management](https://cortex-docs.paloaltonetworks.com/xpanse-api/xpanse-public-api/system-management.md) - [Tag Management](https://cortex-docs.paloaltonetworks.com/xpanse-api/xpanse-public-api/tag-management.md) - [Vulnerability Testing](https://cortex-docs.paloaltonetworks.com/xpanse-api/xpanse-public-api/vulnerability-testing.md) - [Models](https://cortex-docs.paloaltonetworks.com/xpanse-api/xpanse-public-api/models.md) ## XQL Schema Reference - [Cortex XQL Schema Reference Guide](https://cortex-docs.paloaltonetworks.com/xql-schema-reference/readme.md) - [XDR\_DATA Fields by Actor](https://cortex-docs.paloaltonetworks.com/xql-schema-reference/xdr-data-fields-by-actor.md) - [Action Actor](https://cortex-docs.paloaltonetworks.com/xql-schema-reference/xdr-data-fields-by-actor/action-actor.md) - [Actor Actor](https://cortex-docs.paloaltonetworks.com/xql-schema-reference/xdr-data-fields-by-actor/actor-actor.md) - [Causality Actor](https://cortex-docs.paloaltonetworks.com/xql-schema-reference/xdr-data-fields-by-actor/causality-actor.md) - [DST Action Actor](https://cortex-docs.paloaltonetworks.com/xql-schema-reference/xdr-data-fields-by-actor/dst-action-actor.md) - [DST Causality Actor](https://cortex-docs.paloaltonetworks.com/xql-schema-reference/xdr-data-fields-by-actor/dst-causality-actor.md) - [DST OS Actor](https://cortex-docs.paloaltonetworks.com/xql-schema-reference/xdr-data-fields-by-actor/dst-os-actor.md) - [OS Actor](https://cortex-docs.paloaltonetworks.com/xql-schema-reference/xdr-data-fields-by-actor/os-actor.md) - [XDR\_DATA Fields](https://cortex-docs.paloaltonetworks.com/xql-schema-reference/xdr-data-fields.md) ## XSIAM Data Model Schema - [XSIAM Data Model Schema](https://cortex-docs.paloaltonetworks.com/xsiam-data-model-schema/readme.md) - [XDM Aliases](https://cortex-docs.paloaltonetworks.com/xsiam-data-model-schema/aliases.md) - [XDM\_ALIAS.ipv4](https://cortex-docs.paloaltonetworks.com/xsiam-data-model-schema/aliases/ipv4.md) - [XDM\_ALIAS.ipv6](https://cortex-docs.paloaltonetworks.com/xsiam-data-model-schema/aliases/ipv6.md) - [XDM\_ALIAS.ip](https://cortex-docs.paloaltonetworks.com/xsiam-data-model-schema/aliases/ip.md) - [XDM\_ALIAS.user](https://cortex-docs.paloaltonetworks.com/xsiam-data-model-schema/aliases/user.md) - [XDM\_ALIAS.identity\_type](https://cortex-docs.paloaltonetworks.com/xsiam-data-model-schema/aliases/identity-type.md) - [XDM\_ALIAS.file](https://cortex-docs.paloaltonetworks.com/xsiam-data-model-schema/aliases/file.md) - [XDM\_ALIAS.file\_hash](https://cortex-docs.paloaltonetworks.com/xsiam-data-model-schema/aliases/file-hash.md) - [XDM\_ALIAS.domain](https://cortex-docs.paloaltonetworks.com/xsiam-data-model-schema/aliases/domain.md) - [XDM\_ALIAS.hostname](https://cortex-docs.paloaltonetworks.com/xsiam-data-model-schema/aliases/hostname.md) - [XDM\_ALIAS.country](https://cortex-docs.paloaltonetworks.com/xsiam-data-model-schema/aliases/country.md) - [XDM\_ALIAS.resource](https://cortex-docs.paloaltonetworks.com/xsiam-data-model-schema/aliases/resource.md) - [XDM\_ALIAS.cloud\_project](https://cortex-docs.paloaltonetworks.com/xsiam-data-model-schema/aliases/cloud-project.md) - [XDM\_ALIAS.cloud\_provider](https://cortex-docs.paloaltonetworks.com/xsiam-data-model-schema/aliases/cloud-provider.md) - [XDM\_ALIAS.cloud\_zone](https://cortex-docs.paloaltonetworks.com/xsiam-data-model-schema/aliases/cloud-zone.md) - [XDM Consts](https://cortex-docs.paloaltonetworks.com/xsiam-data-model-schema/consts.md) - [XDM\_CONST.DEPLOYMENT\_STATUS](https://cortex-docs.paloaltonetworks.com/xsiam-data-model-schema/consts/deployment-status.md) - [XDM\_CONST.DEPLOYMENT\_PROVISIONING\_STATUS](https://cortex-docs.paloaltonetworks.com/xsiam-data-model-schema/consts/deployment-provisioning-status.md) - [XDM\_CONST.DEPLOYMENT\_LAUNCH\_TYPE](https://cortex-docs.paloaltonetworks.com/xsiam-data-model-schema/consts/deployment-launch-type.md) - [XDM\_CONST.EVENT\_TAG](https://cortex-docs.paloaltonetworks.com/xsiam-data-model-schema/consts/event-tag.md) - [XDM\_CONST.OUTCOME](https://cortex-docs.paloaltonetworks.com/xsiam-data-model-schema/consts/outcome.md) - [XDM\_CONST.PRIVILEGE\_LEVEL](https://cortex-docs.paloaltonetworks.com/xsiam-data-model-schema/consts/privilege-level.md) - [XDM\_CONST.USER\_TYPE](https://cortex-docs.paloaltonetworks.com/xsiam-data-model-schema/consts/user-type.md) - [XDM\_CONST.FORMAT\_TYPE](https://cortex-docs.paloaltonetworks.com/xsiam-data-model-schema/consts/format-type.md) - [XDM\_CONST.KUBERNETES\_RESOURCE\_CATEGORY](https://cortex-docs.paloaltonetworks.com/xsiam-data-model-schema/consts/kubernetes-resource-category.md) - [XDM\_CONST.KUBERNETES\_CONNECTOR\_STATUS](https://cortex-docs.paloaltonetworks.com/xsiam-data-model-schema/consts/kubernetes-connector-status.md) - [XDM\_CONST.KUBERNETES\_PROFILE\_CAPABILITY\_STATUS](https://cortex-docs.paloaltonetworks.com/xsiam-data-model-schema/consts/kubernetes-profile-capability-status.md) - [XDM\_CONST.KUBERNETES\_POD\_CONTAINER\_TYPE](https://cortex-docs.paloaltonetworks.com/xsiam-data-model-schema/consts/kubernetes-pod-container-type.md) - [XDM\_CONST.KUBERNETES\_DISTRIBUTION](https://cortex-docs.paloaltonetworks.com/xsiam-data-model-schema/consts/kubernetes-distribution.md) - [XDM\_CONST.KUBERNETES\_SETTINGS\_AUTO\_UPGRADE\_POLICY](https://cortex-docs.paloaltonetworks.com/xsiam-data-model-schema/consts/kubernetes-settings-auto-upgrade-policy.md) - [XDM\_CONST.IP\_PROTOCOL](https://cortex-docs.paloaltonetworks.com/xsiam-data-model-schema/consts/ip-protocol.md) - [XDM\_CONST.PROVIDER](https://cortex-docs.paloaltonetworks.com/xsiam-data-model-schema/consts/provider.md) - [XDM\_CONST.CLOUD\_PROVIDER](https://cortex-docs.paloaltonetworks.com/xsiam-data-model-schema/consts/cloud-provider.md) - [XDM\_CONST.DEVELOPMENT\_CYCLE\_STAGE](https://cortex-docs.paloaltonetworks.com/xsiam-data-model-schema/consts/development-cycle-stage.md) - [XDM\_CONST.OS\_FAMILY](https://cortex-docs.paloaltonetworks.com/xsiam-data-model-schema/consts/os-family.md) - [XDM\_CONST.AGENT\_TYPE](https://cortex-docs.paloaltonetworks.com/xsiam-data-model-schema/consts/agent-type.md) - [XDM\_CONST.SIGNATURE\_STATUS](https://cortex-docs.paloaltonetworks.com/xsiam-data-model-schema/consts/signature-status.md) - [XDM\_CONST.SECRET\_VALIDATION](https://cortex-docs.paloaltonetworks.com/xsiam-data-model-schema/consts/secret-validation.md) - [XDM\_CONST.APPSEC\_IMPACT](https://cortex-docs.paloaltonetworks.com/xsiam-data-model-schema/consts/appsec-impact.md) - [XDM\_CONST.IMAGE\_SPECIFICATION\_TYPE](https://cortex-docs.paloaltonetworks.com/xsiam-data-model-schema/consts/image-specification-type.md) - [XDM\_CONST.HOST\_STATE\_TYPE](https://cortex-docs.paloaltonetworks.com/xsiam-data-model-schema/consts/host-state-type.md) - [XDM\_CONST.REGISTRY\_VALUE\_TYPE](https://cortex-docs.paloaltonetworks.com/xsiam-data-model-schema/consts/registry-value-type.md) - [XDM\_CONST.IMAGE\_VISIBILITY](https://cortex-docs.paloaltonetworks.com/xsiam-data-model-schema/consts/image-visibility.md) - [XDM\_CONST.HTTP\_METHOD](https://cortex-docs.paloaltonetworks.com/xsiam-data-model-schema/consts/http-method.md) - [XDM\_CONST.HTTP\_RSP\_CODE](https://cortex-docs.paloaltonetworks.com/xsiam-data-model-schema/consts/http-rsp-code.md) - [XDM\_CONST.DHCP\_MESSAGE\_TYPE](https://cortex-docs.paloaltonetworks.com/xsiam-data-model-schema/consts/dhcp-message-type.md) - [XDM\_CONST.DCERPC\_OPERATION](https://cortex-docs.paloaltonetworks.com/xsiam-data-model-schema/consts/dcerpc-operation.md) - [XDM\_CONST.KERBEROS\_MSG\_TYPE](https://cortex-docs.paloaltonetworks.com/xsiam-data-model-schema/consts/kerberos-msg-type.md) - [XDM\_CONST.KERBEROS\_PRINCIPAL\_TYPE](https://cortex-docs.paloaltonetworks.com/xsiam-data-model-schema/consts/kerberos-principal-type.md) - [XDM\_CONST.KERBEROS\_KDC\_OPTION](https://cortex-docs.paloaltonetworks.com/xsiam-data-model-schema/consts/kerberos-kdc-option.md) - [XDM\_CONST.KERBEROS\_ENCRYPTION\_TYPE](https://cortex-docs.paloaltonetworks.com/xsiam-data-model-schema/consts/kerberos-encryption-type.md) - [XDM\_CONST.KERBEROS\_PA\_TYPE](https://cortex-docs.paloaltonetworks.com/xsiam-data-model-schema/consts/kerberos-pa-type.md) - [XDM\_CONST.KERBEROS\_ERROR\_CODE](https://cortex-docs.paloaltonetworks.com/xsiam-data-model-schema/consts/kerberos-error-code.md) - [XDM\_CONST.LDAP\_OPERATION](https://cortex-docs.paloaltonetworks.com/xsiam-data-model-schema/consts/ldap-operation.md) - [XDM\_CONST.LDAP\_SCOPE](https://cortex-docs.paloaltonetworks.com/xsiam-data-model-schema/consts/ldap-scope.md) - [XDM\_CONST.LDAP\_BIND\_AUTH\_TYPE](https://cortex-docs.paloaltonetworks.com/xsiam-data-model-schema/consts/ldap-bind-auth-type.md) - [XDM\_CONST.LOGON\_TYPE](https://cortex-docs.paloaltonetworks.com/xsiam-data-model-schema/consts/logon-type.md) - [XDM\_CONST.LOGON\_IMPERSONATION\_LEVEL](https://cortex-docs.paloaltonetworks.com/xsiam-data-model-schema/consts/logon-impersonation-level.md) - [XDM\_CONST.LOGON\_ASSIGNED\_RIGHT](https://cortex-docs.paloaltonetworks.com/xsiam-data-model-schema/consts/logon-assigned-right.md) - [XDM\_CONST.DB\_OPERATION](https://cortex-docs.paloaltonetworks.com/xsiam-data-model-schema/consts/db-operation.md) - [XDM\_CONST.MITRE\_TACTIC](https://cortex-docs.paloaltonetworks.com/xsiam-data-model-schema/consts/mitre-tactic.md) - [XDM\_CONST.MITRE\_TECHNIQUE](https://cortex-docs.paloaltonetworks.com/xsiam-data-model-schema/consts/mitre-technique.md) - [XDM\_CONST.THREAT\_CATEGORY](https://cortex-docs.paloaltonetworks.com/xsiam-data-model-schema/consts/threat-category.md) - [XDM\_CONST.URL\_CATEGORY](https://cortex-docs.paloaltonetworks.com/xsiam-data-model-schema/consts/url-category.md) - [XDM\_CONST.DNS\_RESPONSE\_CODE](https://cortex-docs.paloaltonetworks.com/xsiam-data-model-schema/consts/dns-response-code.md) - [XDM\_CONST.DNS\_RECORD\_TYPE](https://cortex-docs.paloaltonetworks.com/xsiam-data-model-schema/consts/dns-record-type.md) - [XDM\_CONST.OPERATION\_TYPE](https://cortex-docs.paloaltonetworks.com/xsiam-data-model-schema/consts/operation-type.md) - [XDM\_CONST.IDENTITY\_TYPE](https://cortex-docs.paloaltonetworks.com/xsiam-data-model-schema/consts/identity-type.md) - [XDM\_CONST.SCOPE\_TYPE](https://cortex-docs.paloaltonetworks.com/xsiam-data-model-schema/consts/scope-type.md) - [XDM\_CONST.LOG\_LEVEL](https://cortex-docs.paloaltonetworks.com/xsiam-data-model-schema/consts/log-level.md) - [XDM\_CONST.BACKUP\_ASSET\_TYPE](https://cortex-docs.paloaltonetworks.com/xsiam-data-model-schema/consts/backup-asset-type.md) - [XDM\_CONST.PACKAGE\_INSTALLATION\_TYPE](https://cortex-docs.paloaltonetworks.com/xsiam-data-model-schema/consts/package-installation-type.md) - [XDM\_CONST.IDENTITY\_PROVIDER](https://cortex-docs.paloaltonetworks.com/xsiam-data-model-schema/consts/identity-provider.md) - [XDM\_CONST.IDENTITY\_SECRET\_STATUS](https://cortex-docs.paloaltonetworks.com/xsiam-data-model-schema/consts/identity-secret-status.md) - [XDM\_CONST.IDENTITY\_ACCOUNT\_ACCESS](https://cortex-docs.paloaltonetworks.com/xsiam-data-model-schema/consts/identity-account-access.md) - [XDM\_CONST.IDENTITY\_SECRET\_SERVICE\_SCOPE](https://cortex-docs.paloaltonetworks.com/xsiam-data-model-schema/consts/identity-secret-service-scope.md) - [XDM\_CONST.IDENTITY\_ACCESS\_LEVEL](https://cortex-docs.paloaltonetworks.com/xsiam-data-model-schema/consts/identity-access-level.md) - [XDM\_CONST.LICENSE\_CATEGORY](https://cortex-docs.paloaltonetworks.com/xsiam-data-model-schema/consts/license-category.md) - [XDM\_CONST.ASSET\_GROUP\_TYPE](https://cortex-docs.paloaltonetworks.com/xsiam-data-model-schema/consts/asset-group-type.md) - [XDM\_CONST.OPERATIONAL\_RISK](https://cortex-docs.paloaltonetworks.com/xsiam-data-model-schema/consts/operational-risk.md) - [XDM\_CONST.MODEL\_ENDPOINT\_TYPE](https://cortex-docs.paloaltonetworks.com/xsiam-data-model-schema/consts/model-endpoint-type.md) - [XDM\_CONST.MODEL\_KIND](https://cortex-docs.paloaltonetworks.com/xsiam-data-model-schema/consts/model-kind.md) - [XDM\_CONST.MODEL\_FAMILY](https://cortex-docs.paloaltonetworks.com/xsiam-data-model-schema/consts/model-family.md) - [XDM\_CONST.SCAN\_SOURCE](https://cortex-docs.paloaltonetworks.com/xsiam-data-model-schema/consts/scan-source.md) - [XDM\_CONST.ARCH](https://cortex-docs.paloaltonetworks.com/xsiam-data-model-schema/consts/arch.md) - [XDM\_CONST.DATABASE\_TYPE](https://cortex-docs.paloaltonetworks.com/xsiam-data-model-schema/consts/database-type.md) - [XDM\_CONST.BACKLOG\_STATUS](https://cortex-docs.paloaltonetworks.com/xsiam-data-model-schema/consts/backlog-status.md) - [XDM\_CONST.FINDING\_SOURCE](https://cortex-docs.paloaltonetworks.com/xsiam-data-model-schema/consts/finding-source.md) - [XDM\_CONST.PARTITION\_ID\_TYPE](https://cortex-docs.paloaltonetworks.com/xsiam-data-model-schema/consts/partition-id-type.md) - [XDM\_CONST.ALERT\_STATUS](https://cortex-docs.paloaltonetworks.com/xsiam-data-model-schema/consts/alert-status.md) - [XDM\_CONST.SECURITY\_CONTROL\_EFFECTIVENESS](https://cortex-docs.paloaltonetworks.com/xsiam-data-model-schema/consts/security-control-effectiveness.md) - [XDM\_CONST.DOMAIN\_MODES](https://cortex-docs.paloaltonetworks.com/xsiam-data-model-schema/consts/domain-modes.md) - [XDM\_CONST.TRUST\_DIRECTION](https://cortex-docs.paloaltonetworks.com/xsiam-data-model-schema/consts/trust-direction.md) - [XDM\_CONST.ENCRYPTION\_TYPE](https://cortex-docs.paloaltonetworks.com/xsiam-data-model-schema/consts/encryption-type.md) - [XDM Fieldsets](https://cortex-docs.paloaltonetworks.com/xsiam-data-model-schema/fieldsets.md) - [fieldset.xdm\_core](https://cortex-docs.paloaltonetworks.com/xsiam-data-model-schema/fieldsets/xdm-core.md) - [fieldset.xdm\_cloud](https://cortex-docs.paloaltonetworks.com/xsiam-data-model-schema/fieldsets/xdm-cloud.md) - [fieldset.xdm\_endpoint](https://cortex-docs.paloaltonetworks.com/xsiam-data-model-schema/fieldsets/xdm-endpoint.md) - [fieldset.xdm\_identity](https://cortex-docs.paloaltonetworks.com/xsiam-data-model-schema/fieldsets/xdm-identity.md) - [fieldset.xdm\_network](https://cortex-docs.paloaltonetworks.com/xsiam-data-model-schema/fieldsets/xdm-network.md) - [XDM Fields](https://cortex-docs.paloaltonetworks.com/xsiam-data-model-schema/fields.md) - [xdm.session\_context\_id](https://cortex-docs.paloaltonetworks.com/xsiam-data-model-schema/fields/session-context-id.md) - [xdm.event](https://cortex-docs.paloaltonetworks.com/xsiam-data-model-schema/fields/event.md) - [xdm.source](https://cortex-docs.paloaltonetworks.com/xsiam-data-model-schema/fields/source.md) - [xdm.source.host](https://cortex-docs.paloaltonetworks.com/xsiam-data-model-schema/fields/source/host.md) - [xdm.source.agent](https://cortex-docs.paloaltonetworks.com/xsiam-data-model-schema/fields/source/agent.md) - [xdm.source.identity](https://cortex-docs.paloaltonetworks.com/xsiam-data-model-schema/fields/source/identity.md) - [xdm.source.identity.idp](https://cortex-docs.paloaltonetworks.com/xsiam-data-model-schema/fields/source/identity/idp.md) - [xdm.source.identity.app\_registration](https://cortex-docs.paloaltonetworks.com/xsiam-data-model-schema/fields/source/identity/app-registration.md) - [xdm.source.identity.app\_registration.owners](https://cortex-docs.paloaltonetworks.com/xsiam-data-model-schema/fields/source/identity/app-registration/owners.md) - [xdm.source.identity.group](https://cortex-docs.paloaltonetworks.com/xsiam-data-model-schema/fields/source/identity/group.md) - [xdm.source.identity.policy](https://cortex-docs.paloaltonetworks.com/xsiam-data-model-schema/fields/source/identity/policy.md) - [xdm.source.identity.policy.security\_properties](https://cortex-docs.paloaltonetworks.com/xsiam-data-model-schema/fields/source/identity/policy/security-properties.md) - [xdm.source.identity.secret](https://cortex-docs.paloaltonetworks.com/xsiam-data-model-schema/fields/source/identity/secret.md) - [xdm.source.identity.access\_keys](https://cortex-docs.paloaltonetworks.com/xsiam-data-model-schema/fields/source/identity/access-keys.md) - [xdm.source.identity.access\_statistics](https://cortex-docs.paloaltonetworks.com/xsiam-data-model-schema/fields/source/identity/access-statistics.md) - [xdm.source.identity.key\_management](https://cortex-docs.paloaltonetworks.com/xsiam-data-model-schema/fields/source/identity/key-management.md) - [xdm.source.user](https://cortex-docs.paloaltonetworks.com/xsiam-data-model-schema/fields/source/user.md) - [xdm.source.user.idp](https://cortex-docs.paloaltonetworks.com/xsiam-data-model-schema/fields/source/user/idp.md) - [xdm.source.user.app\_registration](https://cortex-docs.paloaltonetworks.com/xsiam-data-model-schema/fields/source/user/app-registration.md) - [xdm.source.user.app\_registration.owners](https://cortex-docs.paloaltonetworks.com/xsiam-data-model-schema/fields/source/user/app-registration/owners.md) - [xdm.source.user.group](https://cortex-docs.paloaltonetworks.com/xsiam-data-model-schema/fields/source/user/group.md) - [xdm.source.user.policy](https://cortex-docs.paloaltonetworks.com/xsiam-data-model-schema/fields/source/user/policy.md) - [xdm.source.user.policy.security\_properties](https://cortex-docs.paloaltonetworks.com/xsiam-data-model-schema/fields/source/user/policy/security-properties.md) - [xdm.source.user.secret](https://cortex-docs.paloaltonetworks.com/xsiam-data-model-schema/fields/source/user/secret.md) - [xdm.source.user.access\_keys](https://cortex-docs.paloaltonetworks.com/xsiam-data-model-schema/fields/source/user/access-keys.md) - [xdm.source.user.access\_statistics](https://cortex-docs.paloaltonetworks.com/xsiam-data-model-schema/fields/source/user/access-statistics.md) - [xdm.source.user.key\_management](https://cortex-docs.paloaltonetworks.com/xsiam-data-model-schema/fields/source/user/key-management.md) - [xdm.source.location](https://cortex-docs.paloaltonetworks.com/xsiam-data-model-schema/fields/source/location.md) - [xdm.source.process](https://cortex-docs.paloaltonetworks.com/xsiam-data-model-schema/fields/source/process.md) - [xdm.source.process.executable](https://cortex-docs.paloaltonetworks.com/xsiam-data-model-schema/fields/source/process/executable.md) - [xdm.source.process.executable.permissions](https://cortex-docs.paloaltonetworks.com/xsiam-data-model-schema/fields/source/process/executable/permissions.md) - [xdm.source.process.executable.position](https://cortex-docs.paloaltonetworks.com/xsiam-data-model-schema/fields/source/process/executable/position.md) - [xdm.source.process.executable.position.start](https://cortex-docs.paloaltonetworks.com/xsiam-data-model-schema/fields/source/process/executable/position/start.md) - [xdm.source.process.executable.position.end](https://cortex-docs.paloaltonetworks.com/xsiam-data-model-schema/fields/source/process/executable/position/end.md) - [xdm.source.application](https://cortex-docs.paloaltonetworks.com/xsiam-data-model-schema/fields/source/application.md) - [xdm.source.asn](https://cortex-docs.paloaltonetworks.com/xsiam-data-model-schema/fields/source/asn.md) - [xdm.source.cloud](https://cortex-docs.paloaltonetworks.com/xsiam-data-model-schema/fields/source/cloud.md) - [xdm.source.cloud.function](https://cortex-docs.paloaltonetworks.com/xsiam-data-model-schema/fields/source/cloud/function.md) - [xdm.source.virtualization](https://cortex-docs.paloaltonetworks.com/xsiam-data-model-schema/fields/source/virtualization.md) - [xdm.source.virtualization.data\_center](https://cortex-docs.paloaltonetworks.com/xsiam-data-model-schema/fields/source/virtualization/data-center.md) - [xdm.source.virtualization.data\_store](https://cortex-docs.paloaltonetworks.com/xsiam-data-model-schema/fields/source/virtualization/data-store.md) - [xdm.source.virtualization.task](https://cortex-docs.paloaltonetworks.com/xsiam-data-model-schema/fields/source/virtualization/task.md) - [xdm.source.virtualization.vm](https://cortex-docs.paloaltonetworks.com/xsiam-data-model-schema/fields/source/virtualization/vm.md) - [xdm.intermediate](https://cortex-docs.paloaltonetworks.com/xsiam-data-model-schema/fields/intermediate.md) - [xdm.intermediate.host](https://cortex-docs.paloaltonetworks.com/xsiam-data-model-schema/fields/intermediate/host.md) - [xdm.intermediate.location](https://cortex-docs.paloaltonetworks.com/xsiam-data-model-schema/fields/intermediate/location.md) - [xdm.intermediate.agent](https://cortex-docs.paloaltonetworks.com/xsiam-data-model-schema/fields/intermediate/agent.md) - [xdm.intermediate.identity](https://cortex-docs.paloaltonetworks.com/xsiam-data-model-schema/fields/intermediate/identity.md) - [xdm.intermediate.identity.idp](https://cortex-docs.paloaltonetworks.com/xsiam-data-model-schema/fields/intermediate/identity/idp.md) - [xdm.intermediate.identity.app\_registration](https://cortex-docs.paloaltonetworks.com/xsiam-data-model-schema/fields/intermediate/identity/app-registration.md) - [xdm.intermediate.identity.app\_registration.owners](https://cortex-docs.paloaltonetworks.com/xsiam-data-model-schema/fields/intermediate/identity/app-registration/owners.md) - [xdm.intermediate.identity.group](https://cortex-docs.paloaltonetworks.com/xsiam-data-model-schema/fields/intermediate/identity/group.md) - [xdm.intermediate.identity.policy](https://cortex-docs.paloaltonetworks.com/xsiam-data-model-schema/fields/intermediate/identity/policy.md) - [xdm.intermediate.identity.policy.security\_properties](https://cortex-docs.paloaltonetworks.com/xsiam-data-model-schema/fields/intermediate/identity/policy/security-properties.md) - [xdm.intermediate.identity.secret](https://cortex-docs.paloaltonetworks.com/xsiam-data-model-schema/fields/intermediate/identity/secret.md) - [xdm.intermediate.identity.access\_keys](https://cortex-docs.paloaltonetworks.com/xsiam-data-model-schema/fields/intermediate/identity/access-keys.md) - [xdm.intermediate.identity.access\_statistics](https://cortex-docs.paloaltonetworks.com/xsiam-data-model-schema/fields/intermediate/identity/access-statistics.md) - [xdm.intermediate.identity.key\_management](https://cortex-docs.paloaltonetworks.com/xsiam-data-model-schema/fields/intermediate/identity/key-management.md) - [xdm.intermediate.user](https://cortex-docs.paloaltonetworks.com/xsiam-data-model-schema/fields/intermediate/user.md) - [xdm.intermediate.user.idp](https://cortex-docs.paloaltonetworks.com/xsiam-data-model-schema/fields/intermediate/user/idp.md) - [xdm.intermediate.user.app\_registration](https://cortex-docs.paloaltonetworks.com/xsiam-data-model-schema/fields/intermediate/user/app-registration.md) - [xdm.intermediate.user.app\_registration.owners](https://cortex-docs.paloaltonetworks.com/xsiam-data-model-schema/fields/intermediate/user/app-registration/owners.md) - [xdm.intermediate.user.group](https://cortex-docs.paloaltonetworks.com/xsiam-data-model-schema/fields/intermediate/user/group.md) - [xdm.intermediate.user.policy](https://cortex-docs.paloaltonetworks.com/xsiam-data-model-schema/fields/intermediate/user/policy.md) - [xdm.intermediate.user.policy.security\_properties](https://cortex-docs.paloaltonetworks.com/xsiam-data-model-schema/fields/intermediate/user/policy/security-properties.md) - [xdm.intermediate.user.secret](https://cortex-docs.paloaltonetworks.com/xsiam-data-model-schema/fields/intermediate/user/secret.md) - [xdm.intermediate.user.access\_keys](https://cortex-docs.paloaltonetworks.com/xsiam-data-model-schema/fields/intermediate/user/access-keys.md) - [xdm.intermediate.user.access\_statistics](https://cortex-docs.paloaltonetworks.com/xsiam-data-model-schema/fields/intermediate/user/access-statistics.md) - [xdm.intermediate.user.key\_management](https://cortex-docs.paloaltonetworks.com/xsiam-data-model-schema/fields/intermediate/user/key-management.md) - [xdm.intermediate.process](https://cortex-docs.paloaltonetworks.com/xsiam-data-model-schema/fields/intermediate/process.md) - [xdm.intermediate.process.executable](https://cortex-docs.paloaltonetworks.com/xsiam-data-model-schema/fields/intermediate/process/executable.md) - [xdm.intermediate.process.executable.permissions](https://cortex-docs.paloaltonetworks.com/xsiam-data-model-schema/fields/intermediate/process/executable/permissions.md) - [xdm.intermediate.process.executable.position](https://cortex-docs.paloaltonetworks.com/xsiam-data-model-schema/fields/intermediate/process/executable/position.md) - [xdm.intermediate.process.executable.position.start](https://cortex-docs.paloaltonetworks.com/xsiam-data-model-schema/fields/intermediate/process/executable/position/start.md) - [xdm.intermediate.process.executable.position.end](https://cortex-docs.paloaltonetworks.com/xsiam-data-model-schema/fields/intermediate/process/executable/position/end.md) - [xdm.intermediate.application](https://cortex-docs.paloaltonetworks.com/xsiam-data-model-schema/fields/intermediate/application.md) - [xdm.intermediate.asn](https://cortex-docs.paloaltonetworks.com/xsiam-data-model-schema/fields/intermediate/asn.md) - [xdm.intermediate.cloud](https://cortex-docs.paloaltonetworks.com/xsiam-data-model-schema/fields/intermediate/cloud.md) - [xdm.intermediate.cloud.function](https://cortex-docs.paloaltonetworks.com/xsiam-data-model-schema/fields/intermediate/cloud/function.md) - [xdm.target](https://cortex-docs.paloaltonetworks.com/xsiam-data-model-schema/fields/target.md) - [xdm.target.host](https://cortex-docs.paloaltonetworks.com/xsiam-data-model-schema/fields/target/host.md) - [xdm.target.agent](https://cortex-docs.paloaltonetworks.com/xsiam-data-model-schema/fields/target/agent.md) - [xdm.target.identity](https://cortex-docs.paloaltonetworks.com/xsiam-data-model-schema/fields/target/identity.md) - [xdm.target.identity.idp](https://cortex-docs.paloaltonetworks.com/xsiam-data-model-schema/fields/target/identity/idp.md) - [xdm.target.identity.app\_registration](https://cortex-docs.paloaltonetworks.com/xsiam-data-model-schema/fields/target/identity/app-registration.md) - [xdm.target.identity.app\_registration.owners](https://cortex-docs.paloaltonetworks.com/xsiam-data-model-schema/fields/target/identity/app-registration/owners.md) - [xdm.target.identity.group](https://cortex-docs.paloaltonetworks.com/xsiam-data-model-schema/fields/target/identity/group.md) - [xdm.target.identity.policy](https://cortex-docs.paloaltonetworks.com/xsiam-data-model-schema/fields/target/identity/policy.md) - [xdm.target.identity.policy.security\_properties](https://cortex-docs.paloaltonetworks.com/xsiam-data-model-schema/fields/target/identity/policy/security-properties.md) - [xdm.target.identity.secret](https://cortex-docs.paloaltonetworks.com/xsiam-data-model-schema/fields/target/identity/secret.md) - [xdm.target.identity.access\_keys](https://cortex-docs.paloaltonetworks.com/xsiam-data-model-schema/fields/target/identity/access-keys.md) - [xdm.target.identity.access\_statistics](https://cortex-docs.paloaltonetworks.com/xsiam-data-model-schema/fields/target/identity/access-statistics.md) - [xdm.target.identity.key\_management](https://cortex-docs.paloaltonetworks.com/xsiam-data-model-schema/fields/target/identity/key-management.md) - [xdm.target.user](https://cortex-docs.paloaltonetworks.com/xsiam-data-model-schema/fields/target/user.md) - [xdm.target.user.idp](https://cortex-docs.paloaltonetworks.com/xsiam-data-model-schema/fields/target/user/idp.md) - [xdm.target.user.app\_registration](https://cortex-docs.paloaltonetworks.com/xsiam-data-model-schema/fields/target/user/app-registration.md) - [xdm.target.user.app\_registration.owners](https://cortex-docs.paloaltonetworks.com/xsiam-data-model-schema/fields/target/user/app-registration/owners.md) - [xdm.target.user.group](https://cortex-docs.paloaltonetworks.com/xsiam-data-model-schema/fields/target/user/group.md) - [xdm.target.user.policy](https://cortex-docs.paloaltonetworks.com/xsiam-data-model-schema/fields/target/user/policy.md) - [xdm.target.user.policy.security\_properties](https://cortex-docs.paloaltonetworks.com/xsiam-data-model-schema/fields/target/user/policy/security-properties.md) - [xdm.target.user.secret](https://cortex-docs.paloaltonetworks.com/xsiam-data-model-schema/fields/target/user/secret.md) - [xdm.target.user.access\_keys](https://cortex-docs.paloaltonetworks.com/xsiam-data-model-schema/fields/target/user/access-keys.md) - [xdm.target.user.access\_statistics](https://cortex-docs.paloaltonetworks.com/xsiam-data-model-schema/fields/target/user/access-statistics.md) - [xdm.target.user.key\_management](https://cortex-docs.paloaltonetworks.com/xsiam-data-model-schema/fields/target/user/key-management.md) - [xdm.target.location](https://cortex-docs.paloaltonetworks.com/xsiam-data-model-schema/fields/target/location.md) - [xdm.target.process](https://cortex-docs.paloaltonetworks.com/xsiam-data-model-schema/fields/target/process.md) - [xdm.target.process.executable](https://cortex-docs.paloaltonetworks.com/xsiam-data-model-schema/fields/target/process/executable.md) - [xdm.target.process.executable.permissions](https://cortex-docs.paloaltonetworks.com/xsiam-data-model-schema/fields/target/process/executable/permissions.md) - [xdm.target.process.executable.position](https://cortex-docs.paloaltonetworks.com/xsiam-data-model-schema/fields/target/process/executable/position.md) - [xdm.target.process.executable.position.start](https://cortex-docs.paloaltonetworks.com/xsiam-data-model-schema/fields/target/process/executable/position/start.md) - [xdm.target.process.executable.position.end](https://cortex-docs.paloaltonetworks.com/xsiam-data-model-schema/fields/target/process/executable/position/end.md) - [xdm.target.application](https://cortex-docs.paloaltonetworks.com/xsiam-data-model-schema/fields/target/application.md) - [xdm.target.asn](https://cortex-docs.paloaltonetworks.com/xsiam-data-model-schema/fields/target/asn.md) - [xdm.target.cloud](https://cortex-docs.paloaltonetworks.com/xsiam-data-model-schema/fields/target/cloud.md) - [xdm.target.cloud.function](https://cortex-docs.paloaltonetworks.com/xsiam-data-model-schema/fields/target/cloud/function.md) - [xdm.target.module](https://cortex-docs.paloaltonetworks.com/xsiam-data-model-schema/fields/target/module.md) - [xdm.target.module.permissions](https://cortex-docs.paloaltonetworks.com/xsiam-data-model-schema/fields/target/module/permissions.md) - [xdm.target.module.position](https://cortex-docs.paloaltonetworks.com/xsiam-data-model-schema/fields/target/module/position.md) - [xdm.target.module.position.start](https://cortex-docs.paloaltonetworks.com/xsiam-data-model-schema/fields/target/module/position/start.md) - [xdm.target.module.position.end](https://cortex-docs.paloaltonetworks.com/xsiam-data-model-schema/fields/target/module/position/end.md) - [xdm.target.registry](https://cortex-docs.paloaltonetworks.com/xsiam-data-model-schema/fields/target/registry.md) - [xdm.target.registry\_before](https://cortex-docs.paloaltonetworks.com/xsiam-data-model-schema/fields/target/registry-before.md) - [xdm.target.file](https://cortex-docs.paloaltonetworks.com/xsiam-data-model-schema/fields/target/file.md) - [xdm.target.file.permissions](https://cortex-docs.paloaltonetworks.com/xsiam-data-model-schema/fields/target/file/permissions.md) - [xdm.target.file.position](https://cortex-docs.paloaltonetworks.com/xsiam-data-model-schema/fields/target/file/position.md) - [xdm.target.file.position.start](https://cortex-docs.paloaltonetworks.com/xsiam-data-model-schema/fields/target/file/position/start.md) - [xdm.target.file.position.end](https://cortex-docs.paloaltonetworks.com/xsiam-data-model-schema/fields/target/file/position/end.md) - [xdm.target.file\_before](https://cortex-docs.paloaltonetworks.com/xsiam-data-model-schema/fields/target/file-before.md) - [xdm.target.file\_before.permissions](https://cortex-docs.paloaltonetworks.com/xsiam-data-model-schema/fields/target/file-before/permissions.md) - [xdm.target.file\_before.position](https://cortex-docs.paloaltonetworks.com/xsiam-data-model-schema/fields/target/file-before/position.md) - [xdm.target.file\_before.position.start](https://cortex-docs.paloaltonetworks.com/xsiam-data-model-schema/fields/target/file-before/position/start.md) - [xdm.target.file\_before.position.end](https://cortex-docs.paloaltonetworks.com/xsiam-data-model-schema/fields/target/file-before/position/end.md) - [xdm.target.resource](https://cortex-docs.paloaltonetworks.com/xsiam-data-model-schema/fields/target/resource.md) - [xdm.target.resource\_before](https://cortex-docs.paloaltonetworks.com/xsiam-data-model-schema/fields/target/resource-before.md) - [xdm.target.virtualization](https://cortex-docs.paloaltonetworks.com/xsiam-data-model-schema/fields/target/virtualization.md) - [xdm.target.virtualization.data\_center](https://cortex-docs.paloaltonetworks.com/xsiam-data-model-schema/fields/target/virtualization/data-center.md) - [xdm.target.virtualization.data\_store](https://cortex-docs.paloaltonetworks.com/xsiam-data-model-schema/fields/target/virtualization/data-store.md) - [xdm.target.virtualization.task](https://cortex-docs.paloaltonetworks.com/xsiam-data-model-schema/fields/target/virtualization/task.md) - [xdm.target.virtualization.vm](https://cortex-docs.paloaltonetworks.com/xsiam-data-model-schema/fields/target/virtualization/vm.md) - [xdm.observer](https://cortex-docs.paloaltonetworks.com/xsiam-data-model-schema/fields/observer.md) - [xdm.alert](https://cortex-docs.paloaltonetworks.com/xsiam-data-model-schema/fields/alert.md) - [xdm.network](https://cortex-docs.paloaltonetworks.com/xsiam-data-model-schema/fields/network.md) - [xdm.network.icmp](https://cortex-docs.paloaltonetworks.com/xsiam-data-model-schema/fields/network/icmp.md) - [xdm.network.dhcp](https://cortex-docs.paloaltonetworks.com/xsiam-data-model-schema/fields/network/dhcp.md) - [xdm.network.dns](https://cortex-docs.paloaltonetworks.com/xsiam-data-model-schema/fields/network/dns.md) - [xdm.network.dns.dns\_question](https://cortex-docs.paloaltonetworks.com/xsiam-data-model-schema/fields/network/dns/dns-question.md) - [xdm.network.dns.dns\_resource\_record](https://cortex-docs.paloaltonetworks.com/xsiam-data-model-schema/fields/network/dns/dns-resource-record.md) - [xdm.network.http](https://cortex-docs.paloaltonetworks.com/xsiam-data-model-schema/fields/network/http.md) - [xdm.network.http.request](https://cortex-docs.paloaltonetworks.com/xsiam-data-model-schema/fields/network/http/request.md) - [xdm.network.http.request.headers](https://cortex-docs.paloaltonetworks.com/xsiam-data-model-schema/fields/network/http/request/headers.md) - [xdm.network.http.request.query\_params](https://cortex-docs.paloaltonetworks.com/xsiam-data-model-schema/fields/network/http/request/query-params.md) - [xdm.network.http.response](https://cortex-docs.paloaltonetworks.com/xsiam-data-model-schema/fields/network/http/response.md) - [xdm.network.http.response.headers](https://cortex-docs.paloaltonetworks.com/xsiam-data-model-schema/fields/network/http/response/headers.md) - [xdm.network.http.http\_header](https://cortex-docs.paloaltonetworks.com/xsiam-data-model-schema/fields/network/http/http-header.md) - [xdm.network.tls](https://cortex-docs.paloaltonetworks.com/xsiam-data-model-schema/fields/network/tls.md) - [xdm.network.tls.client\_certificate](https://cortex-docs.paloaltonetworks.com/xsiam-data-model-schema/fields/network/tls/client-certificate.md) - [xdm.network.tls.client\_certificate.subject\_details](https://cortex-docs.paloaltonetworks.com/xsiam-data-model-schema/fields/network/tls/client-certificate/subject-details.md) - [xdm.network.tls.client\_certificate.issuer\_details](https://cortex-docs.paloaltonetworks.com/xsiam-data-model-schema/fields/network/tls/client-certificate/issuer-details.md) - [xdm.network.tls.server\_certificate](https://cortex-docs.paloaltonetworks.com/xsiam-data-model-schema/fields/network/tls/server-certificate.md) - [xdm.network.tls.server\_certificate.subject\_details](https://cortex-docs.paloaltonetworks.com/xsiam-data-model-schema/fields/network/tls/server-certificate/subject-details.md) - [xdm.network.tls.server\_certificate.issuer\_details](https://cortex-docs.paloaltonetworks.com/xsiam-data-model-schema/fields/network/tls/server-certificate/issuer-details.md) - [xdm.network.dcerpc](https://cortex-docs.paloaltonetworks.com/xsiam-data-model-schema/fields/network/dcerpc.md) - [xdm.network.ldap](https://cortex-docs.paloaltonetworks.com/xsiam-data-model-schema/fields/network/ldap.md) - [xdm.network.vpn](https://cortex-docs.paloaltonetworks.com/xsiam-data-model-schema/fields/network/vpn.md) - [xdm.auth](https://cortex-docs.paloaltonetworks.com/xsiam-data-model-schema/fields/auth.md) - [xdm.auth.kerberos\_tgt](https://cortex-docs.paloaltonetworks.com/xsiam-data-model-schema/fields/auth/kerberos-tgt.md) - [xdm.auth.kerberos\_tgs](https://cortex-docs.paloaltonetworks.com/xsiam-data-model-schema/fields/auth/kerberos-tgs.md) - [xdm.auth.ntlm](https://cortex-docs.paloaltonetworks.com/xsiam-data-model-schema/fields/auth/ntlm.md) - [xdm.auth.mfa](https://cortex-docs.paloaltonetworks.com/xsiam-data-model-schema/fields/auth/mfa.md) - [xdm.logon](https://cortex-docs.paloaltonetworks.com/xsiam-data-model-schema/fields/logon.md) - [xdm.database](https://cortex-docs.paloaltonetworks.com/xsiam-data-model-schema/fields/database.md) - [xdm.email](https://cortex-docs.paloaltonetworks.com/xsiam-data-model-schema/fields/email.md) - [xdm.email.attachment](https://cortex-docs.paloaltonetworks.com/xsiam-data-model-schema/fields/email/attachment.md) - [xdm.email.attachment.permissions](https://cortex-docs.paloaltonetworks.com/xsiam-data-model-schema/fields/email/attachment/permissions.md) - [xdm.email.attachment.position](https://cortex-docs.paloaltonetworks.com/xsiam-data-model-schema/fields/email/attachment/position.md) - [xdm.email.attachment.position.start](https://cortex-docs.paloaltonetworks.com/xsiam-data-model-schema/fields/email/attachment/position/start.md) - [xdm.email.attachment.position.end](https://cortex-docs.paloaltonetworks.com/xsiam-data-model-schema/fields/email/attachment/position/end.md) - [XDM System Fields](https://cortex-docs.paloaltonetworks.com/xsiam-data-model-schema/system-fields.md) - [\_insert\_time](https://cortex-docs.paloaltonetworks.com/xsiam-data-model-schema/system-fields/insert-time.md) - [\_time](https://cortex-docs.paloaltonetworks.com/xsiam-data-model-schema/system-fields/time.md) - [\_vendor](https://cortex-docs.paloaltonetworks.com/xsiam-data-model-schema/system-fields/vendor.md) - [\_product](https://cortex-docs.paloaltonetworks.com/xsiam-data-model-schema/system-fields/product.md) - [\_reception\_time](https://cortex-docs.paloaltonetworks.com/xsiam-data-model-schema/system-fields/reception-time.md) ## Linux Kernel Versions - [Linux Kernel Versions](https://cortex-docs.paloaltonetworks.com/linux-kernel-versions/readme.md) - [AlmaLinux](https://cortex-docs.paloaltonetworks.com/linux-kernel-versions/almalinux.md) - [AlmaLinux \[x86\_64\]](https://cortex-docs.paloaltonetworks.com/linux-kernel-versions/almalinux/x86_64.md) - [AlmaLinux 8 \[x86\_64\]](https://cortex-docs.paloaltonetworks.com/linux-kernel-versions/almalinux/x86_64/8.md) - [AlmaLinux 9 \[x86\_64\]](https://cortex-docs.paloaltonetworks.com/linux-kernel-versions/almalinux/x86_64/9.md) - [AlmaLinux 10 \[x86\_64\]](https://cortex-docs.paloaltonetworks.com/linux-kernel-versions/almalinux/x86_64/10.md) - [Amazon Linux](https://cortex-docs.paloaltonetworks.com/linux-kernel-versions/amazon-linux.md) - [Amazon Linux \[x86\_64\]](https://cortex-docs.paloaltonetworks.com/linux-kernel-versions/amazon-linux/x86_64.md) - [Amazon Linux 2018 \[x86\_64\]](https://cortex-docs.paloaltonetworks.com/linux-kernel-versions/amazon-linux/x86_64/2018.md) - [Amazon Linux 2](https://cortex-docs.paloaltonetworks.com/linux-kernel-versions/amazon-linux-2.md) - [Amazon Linux 2 \[x86\_64\]](https://cortex-docs.paloaltonetworks.com/linux-kernel-versions/amazon-linux-2/x86_64.md) - [Amazon Linux 2 2017 \[x86\_64\]](https://cortex-docs.paloaltonetworks.com/linux-kernel-versions/amazon-linux-2/x86_64/2017.md) - [Amazon Linux 2 2018 \[x86\_64\]](https://cortex-docs.paloaltonetworks.com/linux-kernel-versions/amazon-linux-2/x86_64/2018.md) - [Amazon Linux 2 2019 \[x86\_64\]](https://cortex-docs.paloaltonetworks.com/linux-kernel-versions/amazon-linux-2/x86_64/2019.md) - [Amazon Linux 2 2020 \[x86\_64\]](https://cortex-docs.paloaltonetworks.com/linux-kernel-versions/amazon-linux-2/x86_64/2020.md) - [Amazon Linux 2 \[aarch64\]](https://cortex-docs.paloaltonetworks.com/linux-kernel-versions/amazon-linux-2/aarch64.md) - [Amazon Linux 2 2017 \[aarch64\]](https://cortex-docs.paloaltonetworks.com/linux-kernel-versions/amazon-linux-2/aarch64/2017.md) - [Amazon Linux 2 2018 \[aarch64\]](https://cortex-docs.paloaltonetworks.com/linux-kernel-versions/amazon-linux-2/aarch64/2018.md) - [Amazon Linux 2 2019 \[aarch64\]](https://cortex-docs.paloaltonetworks.com/linux-kernel-versions/amazon-linux-2/aarch64/2019.md) - [Amazon Linux 2 2020 \[aarch64\]](https://cortex-docs.paloaltonetworks.com/linux-kernel-versions/amazon-linux-2/aarch64/2020.md) - [Amazon Linux 2023](https://cortex-docs.paloaltonetworks.com/linux-kernel-versions/amazon-linux-2023.md) - [Amazon Linux 2023 \[x86\_64\]](https://cortex-docs.paloaltonetworks.com/linux-kernel-versions/amazon-linux-2023/x86_64.md) - [Amazon Linux 2023 2023 \[x86\_64\]](https://cortex-docs.paloaltonetworks.com/linux-kernel-versions/amazon-linux-2023/x86_64/2023.md) - [Amazon Linux 2023 \[aarch64\]](https://cortex-docs.paloaltonetworks.com/linux-kernel-versions/amazon-linux-2023/aarch64.md) - [Amazon Linux 2023 2023 \[aarch64\]](https://cortex-docs.paloaltonetworks.com/linux-kernel-versions/amazon-linux-2023/aarch64/2023.md) - [CentOS](https://cortex-docs.paloaltonetworks.com/linux-kernel-versions/centos.md) - [CentOS \[x86\_64\]](https://cortex-docs.paloaltonetworks.com/linux-kernel-versions/centos/x86_64.md) - [CentOS 6 \[x86\_64\]](https://cortex-docs.paloaltonetworks.com/linux-kernel-versions/centos/x86_64/6.md) - [CentOS 7 \[x86\_64\]](https://cortex-docs.paloaltonetworks.com/linux-kernel-versions/centos/x86_64/7.md) - [CentOS 8 \[x86\_64\]](https://cortex-docs.paloaltonetworks.com/linux-kernel-versions/centos/x86_64/8.md) - [CentOS \[aarch64\]](https://cortex-docs.paloaltonetworks.com/linux-kernel-versions/centos/aarch64.md) - [CentOS 7 \[aarch64\]](https://cortex-docs.paloaltonetworks.com/linux-kernel-versions/centos/aarch64/7.md) - [CentOS 8 \[aarch64\]](https://cortex-docs.paloaltonetworks.com/linux-kernel-versions/centos/aarch64/8.md) - [CentOS Stream](https://cortex-docs.paloaltonetworks.com/linux-kernel-versions/centos-stream.md) - [CentOS Stream \[x86\_64\]](https://cortex-docs.paloaltonetworks.com/linux-kernel-versions/centos-stream/x86_64.md) - [CentOS Stream 8 \[x86\_64\]](https://cortex-docs.paloaltonetworks.com/linux-kernel-versions/centos-stream/x86_64/8.md) - [CentOS Stream 9 \[x86\_64\]](https://cortex-docs.paloaltonetworks.com/linux-kernel-versions/centos-stream/x86_64/9.md) - [CentOS Stream \[aarch64\]](https://cortex-docs.paloaltonetworks.com/linux-kernel-versions/centos-stream/aarch64.md) - [CentOS Stream 8 \[aarch64\]](https://cortex-docs.paloaltonetworks.com/linux-kernel-versions/centos-stream/aarch64/8.md) - [Debian](https://cortex-docs.paloaltonetworks.com/linux-kernel-versions/debian.md) - [Debian \[x86\_64\]](https://cortex-docs.paloaltonetworks.com/linux-kernel-versions/debian/x86_64.md) - [Debian 9 \[x86\_64\]](https://cortex-docs.paloaltonetworks.com/linux-kernel-versions/debian/x86_64/9.md) - [Debian 10 \[x86\_64\]](https://cortex-docs.paloaltonetworks.com/linux-kernel-versions/debian/x86_64/10.md) - [Debian 11 \[x86\_64\]](https://cortex-docs.paloaltonetworks.com/linux-kernel-versions/debian/x86_64/11.md) - [Debian 12 \[x86\_64\]](https://cortex-docs.paloaltonetworks.com/linux-kernel-versions/debian/x86_64/12.md) - [Debian 13 \[x86\_64\]](https://cortex-docs.paloaltonetworks.com/linux-kernel-versions/debian/x86_64/13.md) - [Debian \[aarch64\]](https://cortex-docs.paloaltonetworks.com/linux-kernel-versions/debian/aarch64.md) - [Debian 10 \[aarch64\]](https://cortex-docs.paloaltonetworks.com/linux-kernel-versions/debian/aarch64/10.md) - [OpenSUSE](https://cortex-docs.paloaltonetworks.com/linux-kernel-versions/opensuse.md) - [OpenSUSE \[x86\_64\]](https://cortex-docs.paloaltonetworks.com/linux-kernel-versions/opensuse/x86_64.md) - [OpenSUSE 15 \[x86\_64\]](https://cortex-docs.paloaltonetworks.com/linux-kernel-versions/opensuse/x86_64/15.md) - [Oracle Linux](https://cortex-docs.paloaltonetworks.com/linux-kernel-versions/oracle-linux.md) - [Oracle Linux \[x86\_64\]](https://cortex-docs.paloaltonetworks.com/linux-kernel-versions/oracle-linux/x86_64.md) - [Oracle Linux 6 \[x86\_64\]](https://cortex-docs.paloaltonetworks.com/linux-kernel-versions/oracle-linux/x86_64/6.md) - [Oracle Linux 7 \[x86\_64\]](https://cortex-docs.paloaltonetworks.com/linux-kernel-versions/oracle-linux/x86_64/7.md) - [Oracle Linux 8 \[x86\_64\]](https://cortex-docs.paloaltonetworks.com/linux-kernel-versions/oracle-linux/x86_64/8.md) - [Oracle Linux 9 \[x86\_64\]](https://cortex-docs.paloaltonetworks.com/linux-kernel-versions/oracle-linux/x86_64/9.md) - [Oracle Linux 10 \[x86\_64\]](https://cortex-docs.paloaltonetworks.com/linux-kernel-versions/oracle-linux/x86_64/10.md) - [Oracle Linux \[aarch64\]](https://cortex-docs.paloaltonetworks.com/linux-kernel-versions/oracle-linux/aarch64.md) - [Oracle Linux 8 \[aarch64\]](https://cortex-docs.paloaltonetworks.com/linux-kernel-versions/oracle-linux/aarch64/8.md) - [Oracle Linux 9 \[aarch64\]](https://cortex-docs.paloaltonetworks.com/linux-kernel-versions/oracle-linux/aarch64/9.md) - [Oracle Linux 10 \[aarch64\]](https://cortex-docs.paloaltonetworks.com/linux-kernel-versions/oracle-linux/aarch64/10.md) - [Red Hat Enterprise Linux (RHEL)](https://cortex-docs.paloaltonetworks.com/linux-kernel-versions/red-hat-enterprise-linux-rhel.md) - [Red Hat Enterprise Linux (RHEL) \[x86\_64\]](https://cortex-docs.paloaltonetworks.com/linux-kernel-versions/red-hat-enterprise-linux-rhel/x86_64.md) - [Red Hat Enterprise Linux (RHEL) 6 \[x86\_64\]](https://cortex-docs.paloaltonetworks.com/linux-kernel-versions/red-hat-enterprise-linux-rhel/x86_64/6.md) - [Red Hat Enterprise Linux (RHEL) 7 \[x86\_64\]](https://cortex-docs.paloaltonetworks.com/linux-kernel-versions/red-hat-enterprise-linux-rhel/x86_64/7.md) - [Red Hat Enterprise Linux (RHEL) 8 \[x86\_64\]](https://cortex-docs.paloaltonetworks.com/linux-kernel-versions/red-hat-enterprise-linux-rhel/x86_64/8.md) - [Red Hat Enterprise Linux (RHEL) 9 \[x86\_64\]](https://cortex-docs.paloaltonetworks.com/linux-kernel-versions/red-hat-enterprise-linux-rhel/x86_64/9.md) - [Red Hat Enterprise Linux (RHEL) 10 \[x86\_64\]](https://cortex-docs.paloaltonetworks.com/linux-kernel-versions/red-hat-enterprise-linux-rhel/x86_64/10.md) - [Red Hat Enterprise Linux (RHEL) \[aarch64\]](https://cortex-docs.paloaltonetworks.com/linux-kernel-versions/red-hat-enterprise-linux-rhel/aarch64.md) - [Red Hat Enterprise Linux (RHEL) 8 \[aarch64\]](https://cortex-docs.paloaltonetworks.com/linux-kernel-versions/red-hat-enterprise-linux-rhel/aarch64/8.md) - [Red Hat Enterprise Linux (RHEL) 9 \[aarch64\]](https://cortex-docs.paloaltonetworks.com/linux-kernel-versions/red-hat-enterprise-linux-rhel/aarch64/9.md) - [Red Hat Enterprise Linux (RHEL) 10 \[aarch64\]](https://cortex-docs.paloaltonetworks.com/linux-kernel-versions/red-hat-enterprise-linux-rhel/aarch64/10.md) - [Rocky Linux](https://cortex-docs.paloaltonetworks.com/linux-kernel-versions/rocky-linux.md) - [Rocky Linux \[x86\_64\]](https://cortex-docs.paloaltonetworks.com/linux-kernel-versions/rocky-linux/x86_64.md) - [Rocky Linux 8 \[x86\_64\]](https://cortex-docs.paloaltonetworks.com/linux-kernel-versions/rocky-linux/x86_64/8.md) - [Rocky Linux 9 \[x86\_64\]](https://cortex-docs.paloaltonetworks.com/linux-kernel-versions/rocky-linux/x86_64/9.md) - [Rocky Linux 10 \[x86\_64\]](https://cortex-docs.paloaltonetworks.com/linux-kernel-versions/rocky-linux/x86_64/10.md) - [Rocky Linux \[aarch64\]](https://cortex-docs.paloaltonetworks.com/linux-kernel-versions/rocky-linux/aarch64.md) - [Rocky Linux 9 \[aarch64\]](https://cortex-docs.paloaltonetworks.com/linux-kernel-versions/rocky-linux/aarch64/9.md) - [SUSE Linux Enterprise Server](https://cortex-docs.paloaltonetworks.com/linux-kernel-versions/suse-linux-enterprise-server.md) - [SUSE Linux Enterprise Server \[x86\_64\]](https://cortex-docs.paloaltonetworks.com/linux-kernel-versions/suse-linux-enterprise-server/x86_64.md) - [SUSE Linux Enterprise Server 11 \[x86\_64\]](https://cortex-docs.paloaltonetworks.com/linux-kernel-versions/suse-linux-enterprise-server/x86_64/11.md) - [SUSE Linux Enterprise Server 12 \[x86\_64\]](https://cortex-docs.paloaltonetworks.com/linux-kernel-versions/suse-linux-enterprise-server/x86_64/12.md) - [SUSE Linux Enterprise Server 15 \[x86\_64\]](https://cortex-docs.paloaltonetworks.com/linux-kernel-versions/suse-linux-enterprise-server/x86_64/15.md) - [SUSE Linux Enterprise Server 16 \[x86\_64\]](https://cortex-docs.paloaltonetworks.com/linux-kernel-versions/suse-linux-enterprise-server/x86_64/16.md) - [Ubuntu](https://cortex-docs.paloaltonetworks.com/linux-kernel-versions/ubuntu.md) - [Ubuntu \[x86\_64\]](https://cortex-docs.paloaltonetworks.com/linux-kernel-versions/ubuntu/x86_64.md) - [Ubuntu 12 \[x86\_64\]](https://cortex-docs.paloaltonetworks.com/linux-kernel-versions/ubuntu/x86_64/12.md) - [Ubuntu 14 \[x86\_64\]](https://cortex-docs.paloaltonetworks.com/linux-kernel-versions/ubuntu/x86_64/14.md) - [Ubuntu 16 \[x86\_64\]](https://cortex-docs.paloaltonetworks.com/linux-kernel-versions/ubuntu/x86_64/16.md) - [Ubuntu 18 \[x86\_64\]](https://cortex-docs.paloaltonetworks.com/linux-kernel-versions/ubuntu/x86_64/18.md) - [Ubuntu 20 \[x86\_64\]](https://cortex-docs.paloaltonetworks.com/linux-kernel-versions/ubuntu/x86_64/20.md) - [Ubuntu 22 \[x86\_64\]](https://cortex-docs.paloaltonetworks.com/linux-kernel-versions/ubuntu/x86_64/22.md) - [Ubuntu 24 \[x86\_64\]](https://cortex-docs.paloaltonetworks.com/linux-kernel-versions/ubuntu/x86_64/24.md) - [Ubuntu 26 \[x86\_64\]](https://cortex-docs.paloaltonetworks.com/linux-kernel-versions/ubuntu/x86_64/26.md) - [Ubuntu \[aarch64\]](https://cortex-docs.paloaltonetworks.com/linux-kernel-versions/ubuntu/aarch64.md) - [Ubuntu 18 \[aarch64\]](https://cortex-docs.paloaltonetworks.com/linux-kernel-versions/ubuntu/aarch64/18.md) - [Ubuntu 20 \[aarch64\]](https://cortex-docs.paloaltonetworks.com/linux-kernel-versions/ubuntu/aarch64/20.md) - [Ubuntu 22 \[aarch64\]](https://cortex-docs.paloaltonetworks.com/linux-kernel-versions/ubuntu/aarch64/22.md) - [Ubuntu 24 \[aarch64\]](https://cortex-docs.paloaltonetworks.com/linux-kernel-versions/ubuntu/aarch64/24.md) - [Ubuntu 26 \[aarch64\]](https://cortex-docs.paloaltonetworks.com/linux-kernel-versions/ubuntu/aarch64/26.md) ## Compatibility Matrix - [Where can I install the Cortex XDR agent?](https://cortex-docs.paloaltonetworks.com/compatibility-matrix/where-can-i-install-the-cortex-xdr-agent.md) - [Endpoint operating systems supported](https://cortex-docs.paloaltonetworks.com/compatibility-matrix/where-can-i-install-the-cortex-xdr-agent/endpoint-operating-systems-supported.md) - [Mac](https://cortex-docs.paloaltonetworks.com/compatibility-matrix/where-can-i-install-the-cortex-xdr-agent/endpoint-operating-systems-supported/mac.md) - [Windows](https://cortex-docs.paloaltonetworks.com/compatibility-matrix/where-can-i-install-the-cortex-xdr-agent/endpoint-operating-systems-supported/windows.md) - [Linux](https://cortex-docs.paloaltonetworks.com/compatibility-matrix/where-can-i-install-the-cortex-xdr-agent/endpoint-operating-systems-supported/linux.md) - [Cloud platforms supported with Cortex XDR agent](https://cortex-docs.paloaltonetworks.com/compatibility-matrix/where-can-i-install-the-cortex-xdr-agent/cloud-platforms-supported-with-cortex-xdr-agent.md) - [Kubernetes platforms supported](https://cortex-docs.paloaltonetworks.com/compatibility-matrix/where-can-i-install-the-cortex-xdr-agent/kubernetes-platforms-supported.md) - [Virtual applications supported](https://cortex-docs.paloaltonetworks.com/compatibility-matrix/where-can-i-install-the-cortex-xdr-agent/virtual-applications-supported.md) - [Mobile operating systems supported with Cortex XDR](https://cortex-docs.paloaltonetworks.com/compatibility-matrix/where-can-i-install-the-cortex-xdr-agent/mobile-operating-systems-supported-with-cortex-xdr.md) - [Cortex XDR agent compatibility with third-party security products](https://cortex-docs.paloaltonetworks.com/compatibility-matrix/cortex-xdr-agent-compatibility-with-third-party-security-products.md) - [Third-party Windows security applications](https://cortex-docs.paloaltonetworks.com/compatibility-matrix/cortex-xdr-agent-compatibility-with-third-party-security-products/third-party-windows-security-applications.md) - [Third-party Mac security applications](https://cortex-docs.paloaltonetworks.com/compatibility-matrix/cortex-xdr-agent-compatibility-with-third-party-security-products/third-party-mac-security-applications.md) - [Third-party Linux security applications](https://cortex-docs.paloaltonetworks.com/compatibility-matrix/cortex-xdr-agent-compatibility-with-third-party-security-products/third-party-linux-security-applications.md) ## Cortex XSIAM Developer Guide - [Getting Started](https://cortex-docs.paloaltonetworks.com/cortex-xsiam-developer-guide/cortex-xsiam-development-guide/readme.md): Get started developing content for Cortex XSIAM. - [Design](https://cortex-docs.paloaltonetworks.com/cortex-xsiam-developer-guide/cortex-xsiam-development-guide/readme/design.md): Cortex XSIAM design guidance for content and Marketplace packs. - [Use Case Design for Cortex XSIAM](https://cortex-docs.paloaltonetworks.com/cortex-xsiam-developer-guide/cortex-xsiam-development-guide/readme/design/use-case-design-for-cortex-xsiam.md): Cortex XSIAM guidance for designing efficient incident investigation workflows. - [Development scope](https://cortex-docs.paloaltonetworks.com/cortex-xsiam-developer-guide/cortex-xsiam-development-guide/readme/design/development-scope.md): Cortex XSIAM guidance for defining your content development scope. - [Integration design](https://cortex-docs.paloaltonetworks.com/cortex-xsiam-developer-guide/cortex-xsiam-development-guide/readme/design/integration-design.md): Cortex XSIAM guidance for designing reliable, documented integrations. - [Design best practices](https://cortex-docs.paloaltonetworks.com/cortex-xsiam-developer-guide/cortex-xsiam-development-guide/readme/design/design-best-practices.md): Cortex XSIAM best practices for designing integrations. - [Content development environments](https://cortex-docs.paloaltonetworks.com/cortex-xsiam-developer-guide/cortex-xsiam-development-guide/readme/content-development-environments.md): Cortex XSIAM development environments and tools for content authors. - [IDE for script development](https://cortex-docs.paloaltonetworks.com/cortex-xsiam-developer-guide/cortex-xsiam-development-guide/readme/content-development-environments/ide-for-script-development.md): Use the Cortex XSIAM built-in IDE to create and edit automation scripts, access Script Helper functions, configure script settings, and use editor keyboard shortcuts. - [Set up a local development environment](https://cortex-docs.paloaltonetworks.com/cortex-xsiam-developer-guide/cortex-xsiam-development-guide/readme/content-development-environments/set-up-a-local-development-environment.md): Steps for setting up a local integration development environment in Cortex XSIAM. - [Set up a GitHub Codespace environment](https://cortex-docs.paloaltonetworks.com/cortex-xsiam-developer-guide/cortex-xsiam-development-guide/readme/content-development-environments/set-up-a-github-codespace-environment.md): Steps for setting up a GitHub Codespaces development environment in Cortex XSIAM. - [Set up a containerized development environment](https://cortex-docs.paloaltonetworks.com/cortex-xsiam-developer-guide/cortex-xsiam-development-guide/readme/content-development-environments/set-up-a-containerized-development-environment.md): Set up a Docker-based Cortex XSIAM content development environment with Visual Studio Code and Dev Containers. - [Demisto SDK](https://cortex-docs.paloaltonetworks.com/cortex-xsiam-developer-guide/cortex-xsiam-development-guide/readme/content-development-environments/demisto-sdk.md): Use the Demisto SDK Python library to facilitate the Cortex XSIAM content development process. - [Visual Studio Code extension](https://cortex-docs.paloaltonetworks.com/cortex-xsiam-developer-guide/cortex-xsiam-development-guide/readme/content-development-environments/visual-studio-code-extension.md): Use Visual Studio Code extension to design and author scripts and integrations for Cortex XSIAM directly from VS Code. - [Frequently asked questions](https://cortex-docs.paloaltonetworks.com/cortex-xsiam-developer-guide/cortex-xsiam-development-guide/readme/frequently-asked-questions.md): Cortex XSIAM development FAQs covering IDEs, tools, languages, operating systems, licensing, and CLA troubleshooting. - [Integrations and scripts](https://cortex-docs.paloaltonetworks.com/cortex-xsiam-developer-guide/cortex-xsiam-development-guide/integrations-and-scripts.md): Cortex XSIAM guidance for developing and testing integrations and scripts. - [Components](https://cortex-docs.paloaltonetworks.com/cortex-xsiam-developer-guide/cortex-xsiam-development-guide/integrations-and-scripts/components.md): Cortex XSIAM integration and script components, metadata, and file requirements. - [Integration directory structure](https://cortex-docs.paloaltonetworks.com/cortex-xsiam-developer-guide/cortex-xsiam-development-guide/integrations-and-scripts/components/integration-directory-structure.md): Cortex XSIAM integration directory structure and required files. - [Integration metadata YAML file](https://cortex-docs.paloaltonetworks.com/cortex-xsiam-developer-guide/cortex-xsiam-development-guide/integrations-and-scripts/components/integration-metadata-yaml-file.md): Cortex XSIAM integration and script metadata YAML file reference. - [Integration and script parameter types](https://cortex-docs.paloaltonetworks.com/cortex-xsiam-developer-guide/cortex-xsiam-development-guide/integrations-and-scripts/components/integration-and-script-parameter-types.md): Cortex XSIAM parameter types for integration instances and scripts. - [Integration description file](https://cortex-docs.paloaltonetworks.com/cortex-xsiam-developer-guide/cortex-xsiam-development-guide/integrations-and-scripts/components/integration-description-file.md): Cortex XSIAM integration description files and instance configuration. - [Integration Logo Requirements](https://cortex-docs.paloaltonetworks.com/cortex-xsiam-developer-guide/cortex-xsiam-development-guide/integrations-and-scripts/components/integration-logo-requirements.md): Cortex XSIAM integration logo requirements for size and background. - [Developing](https://cortex-docs.paloaltonetworks.com/cortex-xsiam-developer-guide/cortex-xsiam-development-guide/integrations-and-scripts/developing.md): Code conventions for Cortex XSIAM. - [Python code conventions](https://cortex-docs.paloaltonetworks.com/cortex-xsiam-developer-guide/cortex-xsiam-development-guide/integrations-and-scripts/developing/python-code-conventions.md): Python code conventions for Cortex XSIAM. - [PowerShell](https://cortex-docs.paloaltonetworks.com/cortex-xsiam-developer-guide/cortex-xsiam-development-guide/integrations-and-scripts/developing/powershell.md): Cortex XSIAM PowerShell development guidance. - [General naming conventions](https://cortex-docs.paloaltonetworks.com/cortex-xsiam-developer-guide/cortex-xsiam-development-guide/integrations-and-scripts/developing/general-naming-conventions.md): Cortex XSIAM naming conventions for integrations, commands, and outputs. - [Integration Parameters](https://cortex-docs.paloaltonetworks.com/cortex-xsiam-developer-guide/cortex-xsiam-development-guide/integrations-and-scripts/developing/integration-parameters.md): Cortex XSIAM configurable integration parameter types. - [Context and outputs](https://cortex-docs.paloaltonetworks.com/cortex-xsiam-developer-guide/cortex-xsiam-development-guide/integrations-and-scripts/developing/context-and-outputs.md): Cortex XSIAM context maps and outputs for integrations and playbooks. - [Context standards](https://cortex-docs.paloaltonetworks.com/cortex-xsiam-developer-guide/cortex-xsiam-development-guide/integrations-and-scripts/developing/context-standards.md): Cortex XSIAM standards for structuring incident context data. - [Generic commands](https://cortex-docs.paloaltonetworks.com/cortex-xsiam-developer-guide/cortex-xsiam-development-guide/integrations-and-scripts/developing/generic-commands.md): Cortex XSIAM generic commands for consistent integration workflows. - [Reputation and DBot score](https://cortex-docs.paloaltonetworks.com/cortex-xsiam-developer-guide/cortex-xsiam-development-guide/integrations-and-scripts/developing/reputation-and-dbot-score.md): Cortex XSIAM guidance for indicator reputation and DBot scores. - [Integration commands](https://cortex-docs.paloaltonetworks.com/cortex-xsiam-developer-guide/cortex-xsiam-development-guide/integrations-and-scripts/developing/integration-commands.md): Cortex XSIAM integration command design, arguments, and outputs. - [Using Docker](https://cortex-docs.paloaltonetworks.com/cortex-xsiam-developer-guide/cortex-xsiam-development-guide/integrations-and-scripts/developing/using-docker.md): Cortex XSIAM guidance for running integrations and scripts with Docker. - [Advanced topics](https://cortex-docs.paloaltonetworks.com/cortex-xsiam-developer-guide/cortex-xsiam-development-guide/integrations-and-scripts/advanced-topics.md): Advanced information for content development in Cortex XSIAM. - [Fetching credentials](https://cortex-docs.paloaltonetworks.com/cortex-xsiam-developer-guide/cortex-xsiam-development-guide/integrations-and-scripts/advanced-topics/fetching-credentials.md): Integrate with third-party credential vaults for Cortex XSIAM to authenticate with integrations. - [Event collector integrations](https://cortex-docs.paloaltonetworks.com/cortex-xsiam-developer-guide/cortex-xsiam-development-guide/integrations-and-scripts/advanced-topics/event-collector-integrations.md): Develop event collector integrations to fetch events and logs from external products to Cortex XSIAM. - [Feed Integrations](https://cortex-docs.paloaltonetworks.com/cortex-xsiam-developer-guide/cortex-xsiam-development-guide/integrations-and-scripts/advanced-topics/feed-integrations.md): Cortex XSIAM guidance for developing feed integrations. - [Long Running Containers](https://cortex-docs.paloaltonetworks.com/cortex-xsiam-developer-guide/cortex-xsiam-development-guide/integrations-and-scripts/advanced-topics/long-running-containers.md): Cortex XSIAM guidance for long-running integration containers. - [Transform Language (DT)](https://cortex-docs.paloaltonetworks.com/cortex-xsiam-developer-guide/cortex-xsiam-development-guide/integrations-and-scripts/advanced-topics/transform-language-dt.md): Use DT for various context related functions in Cortex XSIAM. DT is a query language for JSON objects, similar to JSONQuery. - [Integration cache](https://cortex-docs.paloaltonetworks.com/cortex-xsiam-developer-guide/cortex-xsiam-development-guide/integrations-and-scripts/advanced-topics/integration-cache.md): Cortex XSIAM integration cache storage between command runs. - [OpenAPI (Swagger) Codegen](https://cortex-docs.paloaltonetworks.com/cortex-xsiam-developer-guide/cortex-xsiam-development-guide/integrations-and-scripts/advanced-topics/openapi-swagger-codegen.md): Use the openapi-codegen command in the Demisto SDK to generate a Cortex XSIAM integration package (YAML and Python files). - [Postman code generator](https://cortex-docs.paloaltonetworks.com/cortex-xsiam-developer-guide/cortex-xsiam-development-guide/integrations-and-scripts/advanced-topics/postman-code-generator.md): Cortex XSIAM guidance for generating integrations from Postman collections. - [Generate Integration Python Code from JSON](https://cortex-docs.paloaltonetworks.com/cortex-xsiam-developer-guide/cortex-xsiam-development-guide/integrations-and-scripts/advanced-topics/generate-integration-python-code-from-json.md): use the demisto-sdk generate-integration  command to generate a Cortex XSIAM integration from an integration config JSON file. - [Generate YAML from Python](https://cortex-docs.paloaltonetworks.com/cortex-xsiam-developer-guide/cortex-xsiam-development-guide/integrations-and-scripts/advanced-topics/generate-yaml-from-python.md): Cortex XSIAM guidance for generating integration YAML from Python. - [Scheduled Commands](https://cortex-docs.paloaltonetworks.com/cortex-xsiam-developer-guide/cortex-xsiam-development-guide/integrations-and-scripts/advanced-topics/scheduled-commands.md): Cortex XSIAM guidance for scheduling commands in playbook tasks. - [Fetch missing incidents with generic lookback methods](https://cortex-docs.paloaltonetworks.com/cortex-xsiam-developer-guide/cortex-xsiam-development-guide/integrations-and-scripts/advanced-topics/fetch-missing-incidents-with-generic-lookback-methods.md): Cortex XSIAM guidance for retrieving missing incidents with generic lookback. - [Create a sample integration](https://cortex-docs.paloaltonetworks.com/cortex-xsiam-developer-guide/cortex-xsiam-development-guide/integrations-and-scripts/create-a-sample-integration.md): Create a sample integration for Cortex XSIAM. - [Define sample integration settings](https://cortex-docs.paloaltonetworks.com/cortex-xsiam-developer-guide/cortex-xsiam-development-guide/integrations-and-scripts/create-a-sample-integration/define-sample-integration-settings.md): Define integration settings for a sample integration in Cortex XSIAM. - [Write integration code](https://cortex-docs.paloaltonetworks.com/cortex-xsiam-developer-guide/cortex-xsiam-development-guide/integrations-and-scripts/create-a-sample-integration/write-integration-code.md): Cortex XSIAM steps for writing sample integration code. - [Test the integration](https://cortex-docs.paloaltonetworks.com/cortex-xsiam-developer-guide/cortex-xsiam-development-guide/integrations-and-scripts/create-a-sample-integration/test-the-integration.md): Cortex XSIAM steps for testing a sample integration. - [Playbooks](https://cortex-docs.paloaltonetworks.com/cortex-xsiam-developer-guide/cortex-xsiam-development-guide/playbooks.md): Create playbooks with the Playbook Editor to automate complex workflows in Cortex XSIAM without requiring complicated coding. Add the playbook to a content pack. - [Add a Playbook to a Content Pack](https://cortex-docs.paloaltonetworks.com/cortex-xsiam-developer-guide/cortex-xsiam-development-guide/playbooks/add-a-playbook-to-a-content-pack.md): Cortex XSIAM steps for adding a playbook to a content pack. - [Playbook conventions](https://cortex-docs.paloaltonetworks.com/cortex-xsiam-developer-guide/cortex-xsiam-development-guide/playbooks/playbook-conventions.md): Cortex XSIAM conventions for playbook design, tasks, and naming. - [Generic playbooks](https://cortex-docs.paloaltonetworks.com/cortex-xsiam-developer-guide/cortex-xsiam-development-guide/playbooks/generic-playbooks.md): Cortex XSIAM generic playbooks for common analyst workflows. - [Lists](https://cortex-docs.paloaltonetworks.com/cortex-xsiam-developer-guide/cortex-xsiam-development-guide/lists.md): Cortex XSIAM steps for creating and packaging lists. - [Issues](https://cortex-docs.paloaltonetworks.com/cortex-xsiam-developer-guide/cortex-xsiam-development-guide/alerts.md): Create a content pack for Cortex XSIAM with custom content for issues. - [Data modeling rules](https://cortex-docs.paloaltonetworks.com/cortex-xsiam-developer-guide/cortex-xsiam-development-guide/data-modeling-rules.md): Map your Cortex XSIAM logs into a single, unified data model with a consolidated schema. - [Create data model rules](https://cortex-docs.paloaltonetworks.com/cortex-xsiam-developer-guide/cortex-xsiam-development-guide/data-modeling-rules/create-data-model-rules.md): Once events are ingested in the data set, create data model rules in the repository and then map the ingested raw events to Cortex XSIAM system fields. - [Test Data Model Rules](https://cortex-docs.paloaltonetworks.com/cortex-xsiam-developer-guide/cortex-xsiam-development-guide/data-modeling-rules/create-data-model-rules/test-data-model-rules.md): Cortex XSIAM steps for testing data model rules. - [Indicators](https://cortex-docs.paloaltonetworks.com/cortex-xsiam-developer-guide/cortex-xsiam-development-guide/indicators.md): Cortex XSIAM guidance for indicators, relationships, and extraction. - [URL extraction](https://cortex-docs.paloaltonetworks.com/cortex-xsiam-developer-guide/cortex-xsiam-development-guide/indicators/url-extraction.md): Cortex XSIAM guidance for extracting URL indicators from text. - [Domain extraction](https://cortex-docs.paloaltonetworks.com/cortex-xsiam-developer-guide/cortex-xsiam-development-guide/indicators/domain-extraction.md): Cortex XSIAM guidance for extracting domain indicators from text. - [Relationships](https://cortex-docs.paloaltonetworks.com/cortex-xsiam-developer-guide/cortex-xsiam-development-guide/indicators/relationships.md): Cortex XSIAM guidance for creating indicator relationships during enrichment. - [Documentation](https://cortex-docs.paloaltonetworks.com/cortex-xsiam-developer-guide/cortex-xsiam-development-guide/documentation.md): Cortex XSIAM documentation best practices for content packs and contributions. - [Documentation best practices](https://cortex-docs.paloaltonetworks.com/cortex-xsiam-developer-guide/cortex-xsiam-development-guide/documentation/documentation-best-practices.md): Cortex XSIAM documentation best practices for content authors. - [Content pack metadata file](https://cortex-docs.paloaltonetworks.com/cortex-xsiam-developer-guide/cortex-xsiam-development-guide/documentation/content-pack-metadata-file.md): Cortex XSIAM content pack metadata file reference for Marketplace publishing. - [Content pack release notes](https://cortex-docs.paloaltonetworks.com/cortex-xsiam-developer-guide/cortex-xsiam-development-guide/documentation/content-pack-release-notes.md): Cortex XSIAM best practices for content pack release notes. - [Content Pack README](https://cortex-docs.paloaltonetworks.com/cortex-xsiam-developer-guide/cortex-xsiam-development-guide/documentation/content-pack-readme.md): Cortex XSIAM guidance for writing content pack README files. - [README files for content entities](https://cortex-docs.paloaltonetworks.com/cortex-xsiam-developer-guide/cortex-xsiam-development-guide/documentation/readme-files-for-content-entities.md): Cortex XSIAM guidance for README files for content entities. - [Images in documentation](https://cortex-docs.paloaltonetworks.com/cortex-xsiam-developer-guide/cortex-xsiam-development-guide/documentation/images-in-documentation.md): Cortex XSIAM guidance for adding images to documentation. - [Videos in documentation](https://cortex-docs.paloaltonetworks.com/cortex-xsiam-developer-guide/cortex-xsiam-development-guide/documentation/videos-in-documentation.md): Cortex XSIAM guidance for adding videos to documentation. - [Documentation Contributions](https://cortex-docs.paloaltonetworks.com/cortex-xsiam-developer-guide/cortex-xsiam-development-guide/documentation/documentation-contributions.md): Cortex XSIAM steps for contributing documentation or reporting issues. - [Testing](https://cortex-docs.paloaltonetworks.com/cortex-xsiam-developer-guide/cortex-xsiam-development-guide/testing.md): Cortex XSIAM methods for linting, testing, and debugging content. - [Linting](https://cortex-docs.paloaltonetworks.com/cortex-xsiam-developer-guide/cortex-xsiam-development-guide/testing/linting.md): Cortex XSIAM guidance for linting content and finding code issues. - [Unit testing](https://cortex-docs.paloaltonetworks.com/cortex-xsiam-developer-guide/cortex-xsiam-development-guide/testing/unit-testing.md): Cortex XSIAM guidance for writing and running unit tests. - [Test playbooks](https://cortex-docs.paloaltonetworks.com/cortex-xsiam-developer-guide/cortex-xsiam-development-guide/testing/test-playbooks.md): Cortex XSIAM steps for testing integration commands and scripts with playbooks. - [Debugging](https://cortex-docs.paloaltonetworks.com/cortex-xsiam-developer-guide/cortex-xsiam-development-guide/testing/debugging.md): Cortex XSIAM debugging guidance for logs, War Room, and IDE tools. - [Contributing content](https://cortex-docs.paloaltonetworks.com/cortex-xsiam-developer-guide/cortex-xsiam-development-guide/contributing-content.md): How to contribute content for Cortex XSIAM. - [Contribution requirements](https://cortex-docs.paloaltonetworks.com/cortex-xsiam-developer-guide/cortex-xsiam-development-guide/contributing-content/contribution-requirements.md): Prerequisite tools and environments for developing content for contributions to Cortex XSIAM. - [File checklist](https://cortex-docs.paloaltonetworks.com/cortex-xsiam-developer-guide/cortex-xsiam-development-guide/contributing-content/file-checklist.md): A checklist of all the files you need to contribute to the Cortex XSIAM content repository. - [Content pack structure](https://cortex-docs.paloaltonetworks.com/cortex-xsiam-developer-guide/cortex-xsiam-development-guide/contributing-content/content-pack-structure.md): File structure for files included in the Cortex XSIAM content pack. - [Content pack dependencies](https://cortex-docs.paloaltonetworks.com/cortex-xsiam-developer-guide/cortex-xsiam-development-guide/contributing-content/content-pack-dependencies.md): Cortex XSIAM steps for identifying and fixing content pack dependencies. - [Pull request conventions](https://cortex-docs.paloaltonetworks.com/cortex-xsiam-developer-guide/cortex-xsiam-development-guide/contributing-content/pull-request-conventions.md): Cortex XSIAM pull request conventions and build process guidance. - [Contribution demo preparation](https://cortex-docs.paloaltonetworks.com/cortex-xsiam-developer-guide/cortex-xsiam-development-guide/contributing-content/contribution-demo-preparation.md): Cortex XSIAM guidance for preparing a content contribution demo. - [Contribution SLA](https://cortex-docs.paloaltonetworks.com/cortex-xsiam-developer-guide/cortex-xsiam-development-guide/contributing-content/contribution-sla.md): An SLA detailing the required services and the expected level of services when contributing content to the Cortex XSIAM Marketplace ## Cortex CLI - [Cortex CLI](https://cortex-docs.paloaltonetworks.com/cortex-cli/cortex-cli.md): The Cortex CLI is a unified command-line tool integrating Cloud Workload Protection, API Security, and Code Security scans into a single executable. - [Connect Cortex CLI](https://cortex-docs.paloaltonetworks.com/cortex-cli/connect-cortex-cli.md) - [Authenticate credentials](https://cortex-docs.paloaltonetworks.com/cortex-cli/authenticate-credentials.md) - [Cortex CLI usage](https://cortex-docs.paloaltonetworks.com/cortex-cli/cortex-cli-usage.md) - [Self-service API keys for CLI scans](https://cortex-docs.paloaltonetworks.com/cortex-cli/self-service-api-keys-for-cli-scans.md) - [Cortex CLI common command line reference guide](https://cortex-docs.paloaltonetworks.com/cortex-cli/cortex-cli-common-command-line-reference-guide.md) - [Cortex CLI for API Security](https://cortex-docs.paloaltonetworks.com/cortex-cli/cortex-cli-for-api-security.md) - [Cortex CLI for Cloud Workload Protection](https://cortex-docs.paloaltonetworks.com/cortex-cli/cortex-cli-for-cloud-workload-protection.md) - [Cortex CLI for Code Security](https://cortex-docs.paloaltonetworks.com/cortex-cli/cortex-cli-for-code-security.md) - [Cortex CLI usage for Application Security](https://cortex-docs.paloaltonetworks.com/cortex-cli/cortex-cli-for-code-security/cortex-cli-usage-for-application-security.md) - [Cortex CLI Application Security command line reference](https://cortex-docs.paloaltonetworks.com/cortex-cli/cortex-cli-for-code-security/cortex-cli-application-security-command-line-reference.md) - [Cortex CLI pre-commit hooks](https://cortex-docs.paloaltonetworks.com/cortex-cli/cortex-cli-for-code-security/cortex-cli-pre-commit-hooks.md) - [Pre-commit hook usage](https://cortex-docs.paloaltonetworks.com/cortex-cli/cortex-cli-for-code-security/pre-commit-hook-usage.md) - [Cortex CLI pre-receive hooks](https://cortex-docs.paloaltonetworks.com/cortex-cli/cortex-cli-for-code-security/cortex-cli-pre-receive-hooks.md) - [Pre-receive hook usage](https://cortex-docs.paloaltonetworks.com/cortex-cli/cortex-cli-for-code-security/pre-receive-hook-usage.md) ## XQL Command Reference Guide - [Cortex XQL Command Reference](https://cortex-docs.paloaltonetworks.com/xql-command-reference-guide/readme.md) - [Reference overview](https://cortex-docs.paloaltonetworks.com/xql-command-reference-guide/readme/introduction.md) - [Browse the reference](https://cortex-docs.paloaltonetworks.com/xql-command-reference-guide/readme/summary.md) - [Functions](https://cortex-docs.paloaltonetworks.com/xql-command-reference-guide/readme/functions.md) - [Functions overview](https://cortex-docs.paloaltonetworks.com/xql-command-reference-guide/readme/functions/index.md) - [Functions list](https://cortex-docs.paloaltonetworks.com/xql-command-reference-guide/readme/functions/functions-list.md) - [acos](https://cortex-docs.paloaltonetworks.com/xql-command-reference-guide/readme/functions/acos.md) - [add](https://cortex-docs.paloaltonetworks.com/xql-command-reference-guide/readme/functions/add.md) - [approx\_count](https://cortex-docs.paloaltonetworks.com/xql-command-reference-guide/readme/functions/approx_count.md) - [approx\_quantiles](https://cortex-docs.paloaltonetworks.com/xql-command-reference-guide/readme/functions/approx_quantiles.md) - [approx\_top](https://cortex-docs.paloaltonetworks.com/xql-command-reference-guide/readme/functions/approx_top.md) - [array\_all](https://cortex-docs.paloaltonetworks.com/xql-command-reference-guide/readme/functions/array_all.md) - [array\_any](https://cortex-docs.paloaltonetworks.com/xql-command-reference-guide/readme/functions/array_any.md) - [array\_length](https://cortex-docs.paloaltonetworks.com/xql-command-reference-guide/readme/functions/array_length.md) - [arrayconcat](https://cortex-docs.paloaltonetworks.com/xql-command-reference-guide/readme/functions/arrayconcat.md) - [arraycreate](https://cortex-docs.paloaltonetworks.com/xql-command-reference-guide/readme/functions/arraycreate.md) - [arraydistinct](https://cortex-docs.paloaltonetworks.com/xql-command-reference-guide/readme/functions/arraydistinct.md) - [arrayfilter](https://cortex-docs.paloaltonetworks.com/xql-command-reference-guide/readme/functions/arrayfilter.md) - [arrayindex](https://cortex-docs.paloaltonetworks.com/xql-command-reference-guide/readme/functions/arrayindex.md) - [arrayindexof](https://cortex-docs.paloaltonetworks.com/xql-command-reference-guide/readme/functions/arrayindexof.md) - [arraymap](https://cortex-docs.paloaltonetworks.com/xql-command-reference-guide/readme/functions/arraymap.md) - [arraymerge](https://cortex-docs.paloaltonetworks.com/xql-command-reference-guide/readme/functions/arraymerge.md) - [arrayrange](https://cortex-docs.paloaltonetworks.com/xql-command-reference-guide/readme/functions/arrayrange.md) - [arraystring](https://cortex-docs.paloaltonetworks.com/xql-command-reference-guide/readme/functions/arraystring.md) - [asin](https://cortex-docs.paloaltonetworks.com/xql-command-reference-guide/readme/functions/asin.md) - [avg (comp)](https://cortex-docs.paloaltonetworks.com/xql-command-reference-guide/readme/functions/avg_with_comp_stage.md) - [avg (windowcomp)](https://cortex-docs.paloaltonetworks.com/xql-command-reference-guide/readme/functions/avg_with_windowcomp_stage.md) - [bitwise\_and](https://cortex-docs.paloaltonetworks.com/xql-command-reference-guide/readme/functions/bitwise_and.md) - [bitwise\_or](https://cortex-docs.paloaltonetworks.com/xql-command-reference-guide/readme/functions/bitwise_or.md) - [bitwise\_sleft](https://cortex-docs.paloaltonetworks.com/xql-command-reference-guide/readme/functions/bitwise_sleft.md) - [bitwise\_sright](https://cortex-docs.paloaltonetworks.com/xql-command-reference-guide/readme/functions/bitwise_sright.md) - [bitwise\_xor](https://cortex-docs.paloaltonetworks.com/xql-command-reference-guide/readme/functions/bitwise_xor.md) - [cbrt](https://cortex-docs.paloaltonetworks.com/xql-command-reference-guide/readme/functions/cbrt.md) - [ceil](https://cortex-docs.paloaltonetworks.com/xql-command-reference-guide/readme/functions/ceil.md) - [coalesce](https://cortex-docs.paloaltonetworks.com/xql-command-reference-guide/readme/functions/coalesce.md) - [concat](https://cortex-docs.paloaltonetworks.com/xql-command-reference-guide/readme/functions/concat.md) - [convert\_from\_base\_64](https://cortex-docs.paloaltonetworks.com/xql-command-reference-guide/readme/functions/convert_from_base_64.md) - [convert\_to\_base\_64](https://cortex-docs.paloaltonetworks.com/xql-command-reference-guide/readme/functions/convert_to_base_64.md) - [cos](https://cortex-docs.paloaltonetworks.com/xql-command-reference-guide/readme/functions/cos.md) - [cosine\_distance](https://cortex-docs.paloaltonetworks.com/xql-command-reference-guide/readme/functions/cosine_distance.md) - [cot](https://cortex-docs.paloaltonetworks.com/xql-command-reference-guide/readme/functions/cot.md) - [count\_distinct](https://cortex-docs.paloaltonetworks.com/xql-command-reference-guide/readme/functions/count_distinct.md) - [count (comp)](https://cortex-docs.paloaltonetworks.com/xql-command-reference-guide/readme/functions/count_with_comp_stage.md) - [count (windowcomp)](https://cortex-docs.paloaltonetworks.com/xql-command-reference-guide/readme/functions/count_with_windowcomp_stage.md) - [csc](https://cortex-docs.paloaltonetworks.com/xql-command-reference-guide/readme/functions/csc.md) - [current\_time](https://cortex-docs.paloaltonetworks.com/xql-command-reference-guide/readme/functions/current_time.md) - [date\_floor](https://cortex-docs.paloaltonetworks.com/xql-command-reference-guide/readme/functions/date_floor.md) - [div](https://cortex-docs.paloaltonetworks.com/xql-command-reference-guide/readme/functions/div.md) - [divide](https://cortex-docs.paloaltonetworks.com/xql-command-reference-guide/readme/functions/divide.md) - [earliest](https://cortex-docs.paloaltonetworks.com/xql-command-reference-guide/readme/functions/earliest.md) - [euclidean\_distance](https://cortex-docs.paloaltonetworks.com/xql-command-reference-guide/readme/functions/euclidean_distance.md) - [exp](https://cortex-docs.paloaltonetworks.com/xql-command-reference-guide/readme/functions/exp.md) - [extract\_time](https://cortex-docs.paloaltonetworks.com/xql-command-reference-guide/readme/functions/extract_time.md) - [extract\_url\_host](https://cortex-docs.paloaltonetworks.com/xql-command-reference-guide/readme/functions/extract_url_host.md) - [extract\_url\_pub\_suffix](https://cortex-docs.paloaltonetworks.com/xql-command-reference-guide/readme/functions/extract_url_pub_suffix.md) - [extract\_url\_registered\_domain](https://cortex-docs.paloaltonetworks.com/xql-command-reference-guide/readme/functions/extract_url_registered_domain.md) - [first](https://cortex-docs.paloaltonetworks.com/xql-command-reference-guide/readme/functions/first.md) - [first\_value](https://cortex-docs.paloaltonetworks.com/xql-command-reference-guide/readme/functions/first_value.md) - [floor](https://cortex-docs.paloaltonetworks.com/xql-command-reference-guide/readme/functions/floor.md) - [format\_string](https://cortex-docs.paloaltonetworks.com/xql-command-reference-guide/readme/functions/format_string.md) - [format\_timestamp](https://cortex-docs.paloaltonetworks.com/xql-command-reference-guide/readme/functions/format_timestamp.md) - [greatest](https://cortex-docs.paloaltonetworks.com/xql-command-reference-guide/readme/functions/greatest.md) - [hierarchy\_match](https://cortex-docs.paloaltonetworks.com/xql-command-reference-guide/readme/functions/hierarchy_match.md) - [if](https://cortex-docs.paloaltonetworks.com/xql-command-reference-guide/readme/functions/if.md) - [incidr](https://cortex-docs.paloaltonetworks.com/xql-command-reference-guide/readme/functions/incidr.md) - [incidr6](https://cortex-docs.paloaltonetworks.com/xql-command-reference-guide/readme/functions/incidr6.md) - [incidrlist](https://cortex-docs.paloaltonetworks.com/xql-command-reference-guide/readme/functions/incidrlist.md) - [int\_to\_ip](https://cortex-docs.paloaltonetworks.com/xql-command-reference-guide/readme/functions/int_to_ip.md) - [ip\_to\_int](https://cortex-docs.paloaltonetworks.com/xql-command-reference-guide/readme/functions/ip_to_int.md) - [is\_ipv4](https://cortex-docs.paloaltonetworks.com/xql-command-reference-guide/readme/functions/is_ipv4.md) - [is\_ipv6](https://cortex-docs.paloaltonetworks.com/xql-command-reference-guide/readme/functions/is_ipv6.md) - [is\_known\_private\_ipv4](https://cortex-docs.paloaltonetworks.com/xql-command-reference-guide/readme/functions/is_known_private_ipv4.md) - [is\_known\_private\_ipv6](https://cortex-docs.paloaltonetworks.com/xql-command-reference-guide/readme/functions/is_known_private_ipv6.md) - [is\_sla\_breached](https://cortex-docs.paloaltonetworks.com/xql-command-reference-guide/readme/functions/is_sla_breached.md) - [json\_extract](https://cortex-docs.paloaltonetworks.com/xql-command-reference-guide/readme/functions/json_extract.md) - [json\_extract\_array](https://cortex-docs.paloaltonetworks.com/xql-command-reference-guide/readme/functions/json_extract_array.md) - [json\_extract\_scalar](https://cortex-docs.paloaltonetworks.com/xql-command-reference-guide/readme/functions/json_extract_scalar.md) - [json\_extract\_scalar\_array](https://cortex-docs.paloaltonetworks.com/xql-command-reference-guide/readme/functions/json_extract_scalar_array.md) - [XQL JSON Functions Reference](https://cortex-docs.paloaltonetworks.com/xql-command-reference-guide/readme/functions/json_functions_reference.md) - [json\_path\_extract](https://cortex-docs.paloaltonetworks.com/xql-command-reference-guide/readme/functions/json_path_extract.md) - [lag](https://cortex-docs.paloaltonetworks.com/xql-command-reference-guide/readme/functions/lag.md) - [last](https://cortex-docs.paloaltonetworks.com/xql-command-reference-guide/readme/functions/last.md) - [last\_value](https://cortex-docs.paloaltonetworks.com/xql-command-reference-guide/readme/functions/last_value.md) - [latest](https://cortex-docs.paloaltonetworks.com/xql-command-reference-guide/readme/functions/latest.md) - [least](https://cortex-docs.paloaltonetworks.com/xql-command-reference-guide/readme/functions/least.md) - [len](https://cortex-docs.paloaltonetworks.com/xql-command-reference-guide/readme/functions/len.md) - [list (comp)](https://cortex-docs.paloaltonetworks.com/xql-command-reference-guide/readme/functions/list_with_comp_stage.md) - [ln](https://cortex-docs.paloaltonetworks.com/xql-command-reference-guide/readme/functions/ln.md) - [log](https://cortex-docs.paloaltonetworks.com/xql-command-reference-guide/readme/functions/log.md) - [log10](https://cortex-docs.paloaltonetworks.com/xql-command-reference-guide/readme/functions/log10.md) - [lowercase](https://cortex-docs.paloaltonetworks.com/xql-command-reference-guide/readme/functions/lowercase.md) - [ltrim](https://cortex-docs.paloaltonetworks.com/xql-command-reference-guide/readme/functions/ltrim.md) - [max (comp)](https://cortex-docs.paloaltonetworks.com/xql-command-reference-guide/readme/functions/max_with_comp_stage.md) - [max (windowcomp)](https://cortex-docs.paloaltonetworks.com/xql-command-reference-guide/readme/functions/max_with_windowcomp_stage.md) - [md5](https://cortex-docs.paloaltonetworks.com/xql-command-reference-guide/readme/functions/md5.md) - [median (comp)](https://cortex-docs.paloaltonetworks.com/xql-command-reference-guide/readme/functions/median_with_comp_stage.md) - [median (windowcomp)](https://cortex-docs.paloaltonetworks.com/xql-command-reference-guide/readme/functions/median_with_windowcomp_stage.md) - [min (comp)](https://cortex-docs.paloaltonetworks.com/xql-command-reference-guide/readme/functions/min_with_comp_stage.md) - [min (windowcomp)](https://cortex-docs.paloaltonetworks.com/xql-command-reference-guide/readme/functions/min_with_windowcomp_stage.md) - [mod](https://cortex-docs.paloaltonetworks.com/xql-command-reference-guide/readme/functions/mod.md) - [multiply](https://cortex-docs.paloaltonetworks.com/xql-command-reference-guide/readme/functions/multiply.md) - [object\_create](https://cortex-docs.paloaltonetworks.com/xql-command-reference-guide/readme/functions/object_create.md) - [object\_merge](https://cortex-docs.paloaltonetworks.com/xql-command-reference-guide/readme/functions/object_merge.md) - [parse\_epoch](https://cortex-docs.paloaltonetworks.com/xql-command-reference-guide/readme/functions/parse_epoch.md) - [parse\_timestamp](https://cortex-docs.paloaltonetworks.com/xql-command-reference-guide/readme/functions/parse_timestamp.md) - [pow](https://cortex-docs.paloaltonetworks.com/xql-command-reference-guide/readme/functions/pow.md) - [power](https://cortex-docs.paloaltonetworks.com/xql-command-reference-guide/readme/functions/power.md) - [rand](https://cortex-docs.paloaltonetworks.com/xql-command-reference-guide/readme/functions/rand.md) - [range\_bucket](https://cortex-docs.paloaltonetworks.com/xql-command-reference-guide/readme/functions/range_bucket.md) - [rank (windowcomp)](https://cortex-docs.paloaltonetworks.com/xql-command-reference-guide/readme/functions/rank_with_windowcomp_stage.md) - [regexcapture](https://cortex-docs.paloaltonetworks.com/xql-command-reference-guide/readme/functions/regexcapture.md) - [regextract](https://cortex-docs.paloaltonetworks.com/xql-command-reference-guide/readme/functions/regextract.md) - [replace](https://cortex-docs.paloaltonetworks.com/xql-command-reference-guide/readme/functions/replace.md) - [replex](https://cortex-docs.paloaltonetworks.com/xql-command-reference-guide/readme/functions/replex.md) - [round](https://cortex-docs.paloaltonetworks.com/xql-command-reference-guide/readme/functions/round.md) - [row\_number (windowcomp)](https://cortex-docs.paloaltonetworks.com/xql-command-reference-guide/readme/functions/row_number_with_windowcomp_stage.md) - [rtrim](https://cortex-docs.paloaltonetworks.com/xql-command-reference-guide/readme/functions/rtrim.md) - [safe\_add](https://cortex-docs.paloaltonetworks.com/xql-command-reference-guide/readme/functions/safe_add.md) - [safe\_divide](https://cortex-docs.paloaltonetworks.com/xql-command-reference-guide/readme/functions/safe_divide.md) - [safe\_multiply](https://cortex-docs.paloaltonetworks.com/xql-command-reference-guide/readme/functions/safe_multiply.md) - [safe\_negate](https://cortex-docs.paloaltonetworks.com/xql-command-reference-guide/readme/functions/safe_negate.md) - [safe\_subtract](https://cortex-docs.paloaltonetworks.com/xql-command-reference-guide/readme/functions/safe_subtract.md) - [sec](https://cortex-docs.paloaltonetworks.com/xql-command-reference-guide/readme/functions/sec.md) - [sha1](https://cortex-docs.paloaltonetworks.com/xql-command-reference-guide/readme/functions/sha1.md) - [sha256](https://cortex-docs.paloaltonetworks.com/xql-command-reference-guide/readme/functions/sha256.md) - [sha512](https://cortex-docs.paloaltonetworks.com/xql-command-reference-guide/readme/functions/sha512.md) - [sign](https://cortex-docs.paloaltonetworks.com/xql-command-reference-guide/readme/functions/sign.md) - [sin](https://cortex-docs.paloaltonetworks.com/xql-command-reference-guide/readme/functions/sin.md) - [sla\_time\_remaining](https://cortex-docs.paloaltonetworks.com/xql-command-reference-guide/readme/functions/sla_time_remaining.md) - [split](https://cortex-docs.paloaltonetworks.com/xql-command-reference-guide/readme/functions/split.md) - [sqrt](https://cortex-docs.paloaltonetworks.com/xql-command-reference-guide/readme/functions/sqrt.md) - [stddev\_population (comp)](https://cortex-docs.paloaltonetworks.com/xql-command-reference-guide/readme/functions/stddev_population_with_comp_stage.md) - [stddev\_population (windowcomp)](https://cortex-docs.paloaltonetworks.com/xql-command-reference-guide/readme/functions/stddev_population_with_windowcomp_stage.md) - [stddev\_sample (comp)](https://cortex-docs.paloaltonetworks.com/xql-command-reference-guide/readme/functions/stddev_sample_with_comp_stage.md) - [stddev\_sample (windowcomp)](https://cortex-docs.paloaltonetworks.com/xql-command-reference-guide/readme/functions/stddev_sample_with_windowcomp_stage.md) - [string\_count](https://cortex-docs.paloaltonetworks.com/xql-command-reference-guide/readme/functions/string_count.md) - [subtract](https://cortex-docs.paloaltonetworks.com/xql-command-reference-guide/readme/functions/subtract.md) - [sum (comp)](https://cortex-docs.paloaltonetworks.com/xql-command-reference-guide/readme/functions/sum_with_comp_stage.md) - [sum (windowcomp)](https://cortex-docs.paloaltonetworks.com/xql-command-reference-guide/readme/functions/sum_with_windowcomp_stage.md) - [tan](https://cortex-docs.paloaltonetworks.com/xql-command-reference-guide/readme/functions/tan.md) - [time\_frame\_end](https://cortex-docs.paloaltonetworks.com/xql-command-reference-guide/readme/functions/time_frame_end.md) - [timestamp\_diff](https://cortex-docs.paloaltonetworks.com/xql-command-reference-guide/readme/functions/timestamp_diff.md) - [timestamp\_seconds](https://cortex-docs.paloaltonetworks.com/xql-command-reference-guide/readme/functions/timestamp_seconds.md) - [to\_boolean](https://cortex-docs.paloaltonetworks.com/xql-command-reference-guide/readme/functions/to_boolean.md) - [to\_epoch](https://cortex-docs.paloaltonetworks.com/xql-command-reference-guide/readme/functions/to_epoch.md) - [to\_float](https://cortex-docs.paloaltonetworks.com/xql-command-reference-guide/readme/functions/to_float.md) - [to\_integer](https://cortex-docs.paloaltonetworks.com/xql-command-reference-guide/readme/functions/to_integer.md) - [to\_json\_string](https://cortex-docs.paloaltonetworks.com/xql-command-reference-guide/readme/functions/to_json_string.md) - [to\_number](https://cortex-docs.paloaltonetworks.com/xql-command-reference-guide/readme/functions/to_number.md) - [to\_string](https://cortex-docs.paloaltonetworks.com/xql-command-reference-guide/readme/functions/to_string.md) - [to\_timestamp](https://cortex-docs.paloaltonetworks.com/xql-command-reference-guide/readme/functions/to_timestamp.md) - [trim](https://cortex-docs.paloaltonetworks.com/xql-command-reference-guide/readme/functions/trim.md) - [trunc](https://cortex-docs.paloaltonetworks.com/xql-command-reference-guide/readme/functions/trunc.md) - [uppercase](https://cortex-docs.paloaltonetworks.com/xql-command-reference-guide/readme/functions/uppercase.md) - [values](https://cortex-docs.paloaltonetworks.com/xql-command-reference-guide/readme/functions/values.md) - [var](https://cortex-docs.paloaltonetworks.com/xql-command-reference-guide/readme/functions/var.md) - [wildcard\_match](https://cortex-docs.paloaltonetworks.com/xql-command-reference-guide/readme/functions/wildcard_match.md) - [Stages](https://cortex-docs.paloaltonetworks.com/xql-command-reference-guide/readme/stages.md) - [Stages overview](https://cortex-docs.paloaltonetworks.com/xql-command-reference-guide/readme/stages/index.md) - [Stages list](https://cortex-docs.paloaltonetworks.com/xql-command-reference-guide/readme/stages/stages-list.md) - [alter](https://cortex-docs.paloaltonetworks.com/xql-command-reference-guide/readme/stages/alter.md) - [arrayexpand](https://cortex-docs.paloaltonetworks.com/xql-command-reference-guide/readme/stages/arrayexpand.md) - [bin](https://cortex-docs.paloaltonetworks.com/xql-command-reference-guide/readme/stages/bin.md) - [call](https://cortex-docs.paloaltonetworks.com/xql-command-reference-guide/readme/stages/call.md) - [comp](https://cortex-docs.paloaltonetworks.com/xql-command-reference-guide/readme/stages/comp.md) - [config](https://cortex-docs.paloaltonetworks.com/xql-command-reference-guide/readme/stages/config.md) - [dataset](https://cortex-docs.paloaltonetworks.com/xql-command-reference-guide/readme/stages/dataset.md) - [dedup](https://cortex-docs.paloaltonetworks.com/xql-command-reference-guide/readme/stages/dedup.md) - [fields](https://cortex-docs.paloaltonetworks.com/xql-command-reference-guide/readme/stages/fields.md) - [filter](https://cortex-docs.paloaltonetworks.com/xql-command-reference-guide/readme/stages/filter.md) - [iploc](https://cortex-docs.paloaltonetworks.com/xql-command-reference-guide/readme/stages/iploc.md) - [join](https://cortex-docs.paloaltonetworks.com/xql-command-reference-guide/readme/stages/join.md) - [limit](https://cortex-docs.paloaltonetworks.com/xql-command-reference-guide/readme/stages/limit.md) - [pivot](https://cortex-docs.paloaltonetworks.com/xql-command-reference-guide/readme/stages/pivot.md) - [preset](https://cortex-docs.paloaltonetworks.com/xql-command-reference-guide/readme/stages/presets.md) - [replacenull](https://cortex-docs.paloaltonetworks.com/xql-command-reference-guide/readme/stages/replacenull.md) - [search](https://cortex-docs.paloaltonetworks.com/xql-command-reference-guide/readme/stages/search.md) - [sort](https://cortex-docs.paloaltonetworks.com/xql-command-reference-guide/readme/stages/sort.md) - [tag](https://cortex-docs.paloaltonetworks.com/xql-command-reference-guide/readme/stages/tag.md) - [target](https://cortex-docs.paloaltonetworks.com/xql-command-reference-guide/readme/stages/target.md) - [top](https://cortex-docs.paloaltonetworks.com/xql-command-reference-guide/readme/stages/top.md) - [transaction](https://cortex-docs.paloaltonetworks.com/xql-command-reference-guide/readme/stages/transaction.md) - [transpose](https://cortex-docs.paloaltonetworks.com/xql-command-reference-guide/readme/stages/transpose.md) - [union](https://cortex-docs.paloaltonetworks.com/xql-command-reference-guide/readme/stages/union.md) - [view](https://cortex-docs.paloaltonetworks.com/xql-command-reference-guide/readme/stages/view.md) - [windowcomp](https://cortex-docs.paloaltonetworks.com/xql-command-reference-guide/readme/stages/windowcomp.md) ## Analytics Alerts - [Cortex Analytics Alert Reference](https://cortex-docs.paloaltonetworks.com/analytics-alerts/cortex-analytics-alert-reference.md) - [Alerts by name](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name.md) - [A Backup vault policy was modified](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/a-backup-vault-policy-was-modified.md) - [A browser extension was installed or loaded in an uncommon way](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/a-browser-extension-was-installed-or-loaded-in-an-uncommon-way.md) - [A browser was opened in private mode](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/a-browser-was-opened-in-private-mode.md) - [A Cloud DB instance was exported to an unknown destination](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/a-cloud-db-instance-was-exported-to-an-unknown-destination.md) - [A cloud function was created with an unusual runtime](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/a-cloud-function-was-created-with-an-unusual-runtime.md) - [A cloud identity created or modified a security group](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/a-cloud-identity-created-or-modified-a-security-group.md) - [A cloud identity executed an API call from an unusual country](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/a-cloud-identity-executed-an-api-call-from-an-unusual-country.md) - [A cloud identity had escalated its permissions](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/a-cloud-identity-had-escalated-its-permissions.md) - [A cloud identity invoked IAM related persistence operations](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/a-cloud-identity-invoked-iam-related-persistence-operations.md) - [A cloud identity performed multiple unusual activities](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/a-cloud-identity-performed-multiple-unusual-activities.md) - [A cloud identity started a Cloud Shell session](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/a-cloud-identity-started-a-cloud-shell-session.md) - [A cloud instance was stopped](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/a-cloud-instance-was-stopped.md) - [A cloud snapshot of AWS database or storage was modified or shared](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/a-cloud-snapshot-of-aws-database-or-storage-was-modified-or-shared.md) - [A cloud storage configuration was modified](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/a-cloud-storage-configuration-was-modified.md) - [A cloud storage object was copied to a foreign cloud account](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/a-cloud-storage-object-was-copied-to-a-foreign-cloud-account.md) - [A Command Line Interface (CLI) command was executed from a GCP serverless compute service](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/a-command-line-interface-cli-command-was-executed-from-a-gcp-serverless-compute-service.md) - [A Command Line Interface (CLI) command was executed from an AWS serverless compute service](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/a-command-line-interface-cli-command-was-executed-from-an-aws-serverless-compute-service.md) - [A commonly abused process connected to a rare cloud resource](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/a-commonly-abused-process-connected-to-a-rare-cloud-resource.md) - [A commonly abused process connected to a rare external host](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/a-commonly-abused-process-connected-to-a-rare-external-host.md) - [A compiled HTML help file wrote a script file to the disk](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/a-compiled-html-help-file-wrote-a-script-file-to-the-disk.md) - [A compressed file was exfiltrated over SSH](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/a-compressed-file-was-exfiltrated-over-ssh.md) - [A compromised process accessed a rare cloud resource](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/a-compromised-process-accessed-a-rare-cloud-resource.md) - [A compromised process accessed a rare external host](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/a-compromised-process-accessed-a-rare-external-host.md) - [A compute-attached identity executed API calls outside the instance's region](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/a-compute-attached-identity-executed-api-calls-outside-the-instance-s-region.md) - [A computer account was promoted to DC](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/a-computer-account-was-promoted-to-dc.md) - [A contained executable from a mounted share initiated a suspicious outbound network connection](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/a-contained-executable-from-a-mounted-share-initiated-a-suspicious-outbound-network-connection.md) - [A contained executable was executed by an unusual process](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/a-contained-executable-was-executed-by-an-unusual-process.md) - [A contained process attempted to escape using the 'notify on release' feature](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/a-contained-process-attempted-to-escape-using-the-notify-on-release-feature.md) - [A container registry was created or deleted](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/a-container-registry-was-created-or-deleted.md) - [A disabled user attempted to authenticate via SSO](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/a-disabled-user-attempted-to-authenticate-via-sso.md) - [A disabled user attempted to log in to a VPN](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/a-disabled-user-attempted-to-log-in-to-a-vpn.md) - [A disabled user attempted to log in](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/a-disabled-user-attempted-to-log-in.md) - [A domain was added to the trusted domains list](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/a-domain-was-added-to-the-trusted-domains-list.md) - [A GCP Cloud SQL DB instance was exported from a production account](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/a-gcp-cloud-sql-db-instance-was-exported-from-a-production-account.md) - [A GCP service account was delegated domain-wide authority in Google Workspace](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/a-gcp-service-account-was-delegated-domain-wide-authority-in-google-workspace.md) - [A Google Workspace identity created, assigned or modified a role](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/a-google-workspace-identity-created-assigned-or-modified-a-role.md) - [A Google Workspace identity performed an unusual admin console activity](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/a-google-workspace-identity-performed-an-unusual-admin-console-activity.md) - [A Google Workspace identity used the security investigation tool](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/a-google-workspace-identity-used-the-security-investigation-tool.md) - [A Google Workspace Role privilege was deleted](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/a-google-workspace-role-privilege-was-deleted.md) - [A Google Workspace service was configured as unrestricted](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/a-google-workspace-service-was-configured-as-unrestricted.md) - [A Google Workspace user was added to a group](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/a-google-workspace-user-was-added-to-a-group.md) - [A Google Workspace user was removed from a group](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/a-google-workspace-user-was-removed-from-a-group.md) - [A Kubernetes API operation was successfully invoked by an anonymous user](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/a-kubernetes-api-operation-was-successfully-invoked-by-an-anonymous-user.md) - [A Kubernetes cluster role binding was created or deleted](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/a-kubernetes-cluster-role-binding-was-created-or-deleted.md) - [A Kubernetes cluster role was created](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/a-kubernetes-cluster-role-was-created.md) - [A Kubernetes cluster was created or deleted](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/a-kubernetes-cluster-was-created-or-deleted.md) - [A Kubernetes ConfigMap was created or deleted](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/a-kubernetes-configmap-was-created-or-deleted.md) - [A Kubernetes Cronjob was created](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/a-kubernetes-cronjob-was-created.md) - [A Kubernetes DaemonSet was created](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/a-kubernetes-daemonset-was-created.md) - [A Kubernetes dashboard service account was used outside the cluster](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/a-kubernetes-dashboard-service-account-was-used-outside-the-cluster.md) - [A Kubernetes deployment was created](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/a-kubernetes-deployment-was-created.md) - [A Kubernetes ephemeral container was created](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/a-kubernetes-ephemeral-container-was-created.md) - [A Kubernetes namespace was created or deleted](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/a-kubernetes-namespace-was-created-or-deleted.md) - [A Kubernetes node service account activity from external IP](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/a-kubernetes-node-service-account-activity-from-external-ip.md) - [A Kubernetes Pod was created with a sidecar container](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/a-kubernetes-pod-was-created-with-a-sidecar-container.md) - [A Kubernetes Pod was deleted](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/a-kubernetes-pod-was-deleted.md) - [A Kubernetes ReplicaSet was created](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/a-kubernetes-replicaset-was-created.md) - [A Kubernetes role binding was created or deleted](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/a-kubernetes-role-binding-was-created-or-deleted.md) - [A Kubernetes secret was created or deleted](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/a-kubernetes-secret-was-created-or-deleted.md) - [A Kubernetes service account executed an unusual API call](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/a-kubernetes-service-account-executed-an-unusual-api-call.md) - [A Kubernetes service account has enumerated its permissions](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/a-kubernetes-service-account-has-enumerated-its-permissions.md) - [A Kubernetes service account was created or deleted](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/a-kubernetes-service-account-was-created-or-deleted.md) - [A Kubernetes service was created or deleted](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/a-kubernetes-service-was-created-or-deleted.md) - [A Kubernetes StatefulSet was created](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/a-kubernetes-statefulset-was-created.md) - [A lightweight JavaScript runtime executing a script wrote a Python file to disk](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/a-lightweight-javascript-runtime-executing-a-script-wrote-a-python-file-to-disk.md) - [A LOLBIN was copied to a different location](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/a-lolbin-was-copied-to-a-different-location.md) - [A machine certificate was issued with a mismatch](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/a-machine-certificate-was-issued-with-a-mismatch.md) - [A mail forwarding rule was configured in Google Workspace](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/a-mail-forwarding-rule-was-configured-in-google-workspace.md) - [A Microsoft Teams application was installed](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/a-microsoft-teams-application-was-installed.md) - [A Microsoft Teams bot was added to a team](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/a-microsoft-teams-bot-was-added-to-a-team.md) - [A new AWS user credentials creation attempt from an unusual country](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/a-new-aws-user-credentials-creation-attempt-from-an-unusual-country.md) - [A new Azure email domain verification was requested](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/a-new-azure-email-domain-verification-was-requested.md) - [A new machine attempted Kerberos delegation](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/a-new-machine-attempted-kerberos-delegation.md) - [A New Server was Added to an Azure Active Directory Hybrid Health ADFS Environment](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/a-new-server-was-added-to-an-azure-active-directory-hybrid-health-adfs-environment.md) - [A non-browser process accessed a website UI](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/a-non-browser-process-accessed-a-website-ui.md) - [A Possible crypto miner was detected on a host](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/a-possible-crypto-miner-was-detected-on-a-host.md) - [A possible risky login to Azure](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/a-possible-risky-login-to-azure.md) - [A process connected to a rare cloud resource](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/a-process-connected-to-a-rare-cloud-resource.md) - [A process connected to a rare external host](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/a-process-connected-to-a-rare-external-host.md) - [A process connected to rare external host](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/a-process-connected-to-rare-external-host.md) - [A process is masquerading as a common Microsoft product](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/a-process-is-masquerading-as-a-common-microsoft-product.md) - [A process modified an SSH authorized\_keys file](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/a-process-modified-an-ssh-authorized-keys-file.md) - [A process queried the ADFS database decryption key via LDAP](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/a-process-queried-the-adfs-database-decryption-key-via-ldap.md) - [A process was executed with a command line obfuscated by Unicode character substitution](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/a-process-was-executed-with-a-command-line-obfuscated-by-unicode-character-substitution.md) - [A rare DLL, signed by an uncommon vendor, was hijacked into a Microsoft process](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/a-rare-dll-signed-by-an-uncommon-vendor-was-hijacked-into-a-microsoft-process.md) - [A rare file path was added to the AppInit\_DLLs registry value](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/a-rare-file-path-was-added-to-the-appinit-dlls-registry-value.md) - [A rare FTP user has been detected on an existing FTP server](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/a-rare-ftp-user-has-been-detected-on-an-existing-ftp-server.md) - [A rare local administrator login](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/a-rare-local-administrator-login.md) - [A remote service was created via RPC over SMB](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/a-remote-service-was-created-via-rpc-over-smb.md) - [A Service Principal was created in Azure](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/a-service-principal-was-created-in-azure.md) - [A Service Principal was removed from Azure](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/a-service-principal-was-removed-from-azure.md) - [A service was disabled](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/a-service-was-disabled.md) - [A Successful login from TOR](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/a-successful-login-from-tor.md) - [A successful SSO sign-in from TOR](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/a-successful-sso-sign-in-from-tor.md) - [A Successful VPN connection from TOR](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/a-successful-vpn-connection-from-tor.md) - [A suspicious direct syscall was executed](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/a-suspicious-direct-syscall-was-executed.md) - [A suspicious executable with multiple file extensions was created](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/a-suspicious-executable-with-multiple-file-extensions-was-created.md) - [A suspicious process enrolled for a certificate](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/a-suspicious-process-enrolled-for-a-certificate.md) - [A suspicious process queried AD CS objects via LDAP](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/a-suspicious-process-queried-ad-cs-objects-via-ldap.md) - [A TCP stream was created directly in a shell](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/a-tcp-stream-was-created-directly-in-a-shell.md) - [A third-party application's access to the Google Workspace domain's resources was revoked](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/a-third-party-application-s-access-to-the-google-workspace-domain-s-resources-was-revoked.md) - [A third-party application was authorized to access the Google Workspace APIs](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/a-third-party-application-was-authorized-to-access-the-google-workspace-apis.md) - [A third-party utility was copied to a different location](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/a-third-party-utility-was-copied-to-a-different-location.md) - [A Torrent client was detected on a host](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/a-torrent-client-was-detected-on-a-host.md) - [A user accessed an abnormal number of files on a remote shared folder](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/a-user-accessed-an-abnormal-number-of-files-on-a-remote-shared-folder.md) - [A user accessed an abnormal number of remote shared folders](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/a-user-accessed-an-abnormal-number-of-remote-shared-folders.md) - [A user accessed an uncommon AppID](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/a-user-accessed-an-uncommon-appid.md) - [A user accessed multiple time-consuming websites](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/a-user-accessed-multiple-time-consuming-websites.md) - [A user accessed multiple unusual resources via SSO](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/a-user-accessed-multiple-unusual-resources-via-sso.md) - [A user accessed Okta's admin application](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/a-user-accessed-okta-s-admin-application.md) - [A user account was modified to password never expires](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/a-user-account-was-modified-to-password-never-expires.md) - [A user added a Windows firewall rule](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/a-user-added-a-windows-firewall-rule.md) - [A user attempted to bypass Okta MFA](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/a-user-attempted-to-bypass-okta-mfa.md) - [A user authenticated with weak NTLM to multiple hosts](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/a-user-authenticated-with-weak-ntlm-to-multiple-hosts.md) - [A user certificate was issued with a mismatch](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/a-user-certificate-was-issued-with-a-mismatch.md) - [A user changed the Windows system time](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/a-user-changed-the-windows-system-time.md) - [A user connected a new USB storage device to a host](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/a-user-connected-a-new-usb-storage-device-to-a-host.md) - [A user connected a new USB storage device to multiple hosts](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/a-user-connected-a-new-usb-storage-device-to-multiple-hosts.md) - [A user connected a USB storage device for the first time](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/a-user-connected-a-usb-storage-device-for-the-first-time.md) - [A user connected from a new country](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/a-user-connected-from-a-new-country.md) - [A user connected to a VPN from a new country](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/a-user-connected-to-a-vpn-from-a-new-country.md) - [A user created a pfx file for the first time](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/a-user-created-a-pfx-file-for-the-first-time.md) - [A user created an abnormal password-protected archive](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/a-user-created-an-abnormal-password-protected-archive.md) - [A user enabled a default local account](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/a-user-enabled-a-default-local-account.md) - [A user established an SMB connection to multiple hosts](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/a-user-established-an-smb-connection-to-multiple-hosts.md) - [A user executed multiple LDAP enumeration queries](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/a-user-executed-multiple-ldap-enumeration-queries.md) - [A user logged in at an unusual time via SSO](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/a-user-logged-in-at-an-unusual-time-via-sso.md) - [A user logged in at an unusual time via VPN](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/a-user-logged-in-at-an-unusual-time-via-vpn.md) - [A user logged in from an abnormal country or ASN](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/a-user-logged-in-from-an-abnormal-country-or-asn.md) - [A user logged in to the AWS console for the first time](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/a-user-logged-in-to-the-aws-console-for-the-first-time.md) - [A user logged on to multiple workstations via Schannel](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/a-user-logged-on-to-multiple-workstations-via-schannel.md) - [A user modified an Okta MFA factor](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/a-user-modified-an-okta-mfa-factor.md) - [A user modified an Okta network zone](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/a-user-modified-an-okta-network-zone.md) - [A user modified an Okta policy rule](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/a-user-modified-an-okta-policy-rule.md) - [A user modified the CA audit policy](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/a-user-modified-the-ca-audit-policy.md) - [A user observed and reported unusual activity in Okta](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/a-user-observed-and-reported-unusual-activity-in-okta.md) - [A user performed suspiciously massive file activity](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/a-user-performed-suspiciously-massive-file-activity.md) - [A user printed an unusual number of files](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/a-user-printed-an-unusual-number-of-files.md) - [A user queried AD CS objects via LDAP](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/a-user-queried-ad-cs-objects-via-ldap.md) - [A user received multiple weakly encrypted service tickets](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/a-user-received-multiple-weakly-encrypted-service-tickets.md) - [A user rejected an SSO request from an unusual country](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/a-user-rejected-an-sso-request-from-an-unusual-country.md) - [A user requested multiple service tickets](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/a-user-requested-multiple-service-tickets.md) - [A user sent multiple TGT requests to irregular service](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/a-user-sent-multiple-tgt-requests-to-irregular-service.md) - [A user took numerous screenshots](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/a-user-took-numerous-screenshots.md) - [A user uploaded malware to SharePoint or OneDrive](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/a-user-uploaded-malware-to-sharepoint-or-onedrive.md) - [A user was added to a Windows security group](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/a-user-was-added-to-a-windows-security-group.md) - [A WMI subscriber was created](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/a-wmi-subscriber-was-created.md) - [Abnormal Allocation of compute resources in multiple regions](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/abnormal-allocation-of-compute-resources-in-multiple-regions.md) - [Abnormal Communication to a Rare Domain](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/abnormal-communication-to-a-rare-domain.md) - [Abnormal communication with a rare combination of TLS and HTTP User Agent](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/abnormal-communication-with-a-rare-combination-of-tls-and-http-user-agent.md) - [Abnormal connections to a dormant host from a newly seen endpoint](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/abnormal-connections-to-a-dormant-host-from-a-newly-seen-endpoint.md) - [Abnormal File Activity in SCCMContentLib Shared Folder by user](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/abnormal-file-activity-in-sccmcontentlib-shared-folder-by-user.md) - [Abnormal ICMP echo (PING) to multiple hosts](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/abnormal-icmp-echo-ping-to-multiple-hosts.md) - [Abnormal increase in network-related alerts on the same host](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/abnormal-increase-in-network-related-alerts-on-the-same-host.md) - [Abnormal network communication through TOR using an uncommon port](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/abnormal-network-communication-through-tor-using-an-uncommon-port.md) - [Abnormal network communication with a rare combination of HTTP User Agent and HTTP Server](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/abnormal-network-communication-with-a-rare-combination-of-http-user-agent-and-http-server.md) - [Abnormal process connection to default Meterpreter port](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/abnormal-process-connection-to-default-meterpreter-port.md) - [Abnormal RDP connections to multiple hosts from a rarely seen host](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/abnormal-rdp-connections-to-multiple-hosts-from-a-rarely-seen-host.md) - [Abnormal RDP connections to multiple hosts](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/abnormal-rdp-connections-to-multiple-hosts.md) - [Abnormal RDP session to a remote host from a rarely seen host](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/abnormal-rdp-session-to-a-remote-host-from-a-rarely-seen-host.md) - [Abnormal Recurring Communications to a Rare Domain](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/abnormal-recurring-communications-to-a-rare-domain.md) - [Abnormal RPC traffic to multiple hosts](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/abnormal-rpc-traffic-to-multiple-hosts.md) - [Abnormal sensitive RPC traffic to multiple hosts from a rarely seen host](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/abnormal-sensitive-rpc-traffic-to-multiple-hosts-from-a-rarely-seen-host.md) - [Abnormal sensitive RPC traffic to multiple hosts](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/abnormal-sensitive-rpc-traffic-to-multiple-hosts.md) - [Abnormal SMB activity to multiple hosts](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/abnormal-smb-activity-to-multiple-hosts.md) - [Abnormal SMB scanning activity to multiple hosts](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/abnormal-smb-scanning-activity-to-multiple-hosts.md) - [Abnormal User Login to Domain Controller](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/abnormal-user-login-to-domain-controller.md) - [Abusable command-line activity by untrusted causality actor](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/abusable-command-line-activity-by-untrusted-causality-actor.md) - [Access to kubelet credentials file](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/access-to-kubelet-credentials-file.md) - [Access to Kubernetes CA certificate file](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/access-to-kubernetes-ca-certificate-file.md) - [Access to Kubernetes configuration file](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/access-to-kubernetes-configuration-file.md) - [Access to sensitive host files from within a Kubernetes pod](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/access-to-sensitive-host-files-from-within-a-kubernetes-pod.md) - [Account probing](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/account-probing.md) - [Adding execution privileges](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/adding-execution-privileges.md) - [ADFS DKM Key Access](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/adfs-dkm-key-access.md) - [Admin privileges were granted to a Google Workspace user](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/admin-privileges-were-granted-to-a-google-workspace-user.md) - [Administrator groups enumerated via LDAP](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/administrator-groups-enumerated-via-ldap.md) - [AI-determined combination of risky alerts under the same actor process](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/ai-determined-combination-of-risky-alerts-under-the-same-actor-process.md) - [AI-determined combination of risky alerts under the same causality](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/ai-determined-combination-of-risky-alerts-under-the-same-causality.md) - [AI model discovery](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/ai-model-discovery.md) - [AI safeguards deletion attempt](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/ai-safeguards-deletion-attempt.md) - [AI safeguards were modified](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/ai-safeguards-were-modified.md) - [Allocation of multiple cloud compute resources](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/allocation-of-multiple-cloud-compute-resources.md) - [An app was added to Google Marketplace](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/an-app-was-added-to-google-marketplace.md) - [An app was added to the Google Workspace trusted OAuth apps list](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/an-app-was-added-to-the-google-workspace-trusted-oauth-apps-list.md) - [An app was removed from a blocked list in Google Workspace](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/an-app-was-removed-from-a-blocked-list-in-google-workspace.md) - [An AWS database service master user password was changed](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/an-aws-database-service-master-user-password-was-changed.md) - [An AWS EC2 instance containing sensitive data was exported](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/an-aws-ec2-instance-containing-sensitive-data-was-exported.md) - [An AWS EC2 instance was exported from a production account](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/an-aws-ec2-instance-was-exported-from-a-production-account.md) - [An AWS EC2 instance was exported into an unknown S3 bucket](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/an-aws-ec2-instance-was-exported-into-an-unknown-s3-bucket.md) - [An AWS EFS File-share mount was deleted](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/an-aws-efs-file-share-mount-was-deleted.md) - [An AWS EFS file-share was deleted](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/an-aws-efs-file-share-was-deleted.md) - [An AWS EKS cluster was created or deleted](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/an-aws-eks-cluster-was-created-or-deleted.md) - [An AWS GuardDuty IP set was created](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/an-aws-guardduty-ip-set-was-created.md) - [An AWS Lambda Function was created](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/an-aws-lambda-function-was-created.md) - [An AWS Lambda function was modified](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/an-aws-lambda-function-was-modified.md) - [An AWS RDS Global Cluster Deletion](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/an-aws-rds-global-cluster-deletion.md) - [An AWS RDS instance was created from a snapshot](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/an-aws-rds-instance-was-created-from-a-snapshot.md) - [An AWS Route 53 domain was transferred to another AWS account](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/an-aws-route-53-domain-was-transferred-to-another-aws-account.md) - [An AWS S3 bucket configuration was modified](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/an-aws-s3-bucket-configuration-was-modified.md) - [An AWS SAML provider was modified](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/an-aws-saml-provider-was-modified.md) - [An AWS SES identity was deleted](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/an-aws-ses-identity-was-deleted.md) - [An Azure application reached a throttling API rate](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/an-azure-application-reached-a-throttling-api-rate.md) - [An Azure DNS Zone was modified](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/an-azure-dns-zone-was-modified.md) - [An Azure Firewall policy deletion](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/an-azure-firewall-policy-deletion.md) - [An Azure Firewall rule collection group was modified or deleted](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/an-azure-firewall-rule-collection-group-was-modified-or-deleted.md) - [An Azure firewall rule group was modified](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/an-azure-firewall-rule-group-was-modified.md) - [An Azure Firewall was modified](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/an-azure-firewall-was-modified.md) - [An Azure identity performed multiple actions that were denied](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/an-azure-identity-performed-multiple-actions-that-were-denied.md) - [An Azure Key Vault key was modified](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/an-azure-key-vault-key-was-modified.md) - [An Azure Key Vault was modified](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/an-azure-key-vault-was-modified.md) - [An Azure Kubernetes Cluster was created or deleted](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/an-azure-kubernetes-cluster-was-created-or-deleted.md) - [An Azure Kubernetes Role-Binding or Cluster-Role-Binding was modified or deleted](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/an-azure-kubernetes-role-binding-or-cluster-role-binding-was-modified-or-deleted.md) - [An Azure Kubernetes Role or Cluster-Role was modified](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/an-azure-kubernetes-role-or-cluster-role-was-modified.md) - [An Azure Kubernetes Service Account was modified or deleted](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/an-azure-kubernetes-service-account-was-modified-or-deleted.md) - [An Azure Network Security Group was modified](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/an-azure-network-security-group-was-modified.md) - [An Azure Point-to-Site VPN was modified](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/an-azure-point-to-site-vpn-was-modified.md) - [An Azure SQL database was exported from a production subscription](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/an-azure-sql-database-was-exported-from-a-production-subscription.md) - [An Azure Suppression Rule was created](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/an-azure-suppression-rule-was-created.md) - [An Azure virtual network Device was modified](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/an-azure-virtual-network-device-was-modified.md) - [An Azure virtual network was modified](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/an-azure-virtual-network-was-modified.md) - [An Azure VM snapshot SAS URL was generated for export from a production subscription](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/an-azure-vm-snapshot-sas-url-was-generated-for-export-from-a-production-subscription.md) - [An Azure VM snapshot SAS URL was generated](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/an-azure-vm-snapshot-sas-url-was-generated.md) - [An Azure VPN Connection was modified](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/an-azure-vpn-connection-was-modified.md) - [An EBS snapshot block was downloaded](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/an-ebs-snapshot-block-was-downloaded.md) - [An Email address was added to AWS SES](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/an-email-address-was-added-to-aws-ses.md) - [An executable was written and executed by a web server](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/an-executable-was-written-and-executed-by-a-web-server.md) - [An IAM group was created](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/an-iam-group-was-created.md) - [An identity accessed a backup cloud storage](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/an-identity-accessed-a-backup-cloud-storage.md) - [An identity accessed a cloud storage for the first time](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/an-identity-accessed-a-cloud-storage-for-the-first-time.md) - [An identity accessed Azure Kubernetes Secrets](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/an-identity-accessed-azure-kubernetes-secrets.md) - [An identity attached an administrative policy to an IAM user or role](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/an-identity-attached-an-administrative-policy-to-an-iam-user-or-role.md) - [An identity created or updated password for an IAM user](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/an-identity-created-or-updated-password-for-an-iam-user.md) - [An identity disabled bucket logging](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/an-identity-disabled-bucket-logging.md) - [An identity initiated a download of multiple cloud objects](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/an-identity-initiated-a-download-of-multiple-cloud-objects.md) - [An identity performed a suspicious download of multiple cloud storage objects](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/an-identity-performed-a-suspicious-download-of-multiple-cloud-storage-objects.md) - [An identity started an AWS SSM session](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/an-identity-started-an-aws-ssm-session.md) - [An identity successfully extracted multiple secrets within the organization](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/an-identity-successfully-extracted-multiple-secrets-within-the-organization.md) - [An identity was granted permissions to manage user access to Azure resources](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/an-identity-was-granted-permissions-to-manage-user-access-to-azure-resources.md) - [An internal Cloud resource performed port scan on external networks](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/an-internal-cloud-resource-performed-port-scan-on-external-networks.md) - [An operation was performed by an identity from a domain that was not seen in the organization](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/an-operation-was-performed-by-an-identity-from-a-domain-that-was-not-seen-in-the-organization.md) - [An RDS snapshot containing sensitive data was exported](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/an-rds-snapshot-containing-sensitive-data-was-exported.md) - [An RDS snapshot was exported from a production account](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/an-rds-snapshot-was-exported-from-a-production-account.md) - [An RDS snapshot was exported to an unknown bucket](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/an-rds-snapshot-was-exported-to-an-unknown-bucket.md) - [An RDS snapshot was exported to an unknown S3 bucket](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/an-rds-snapshot-was-exported-to-an-unknown-s3-bucket.md) - [An S3 replication policy to an unknown bucket was created](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/an-s3-replication-policy-to-an-unknown-bucket-was-created.md) - [An uncommon executable was remotely written over SMB to an uncommon destination](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/an-uncommon-executable-was-remotely-written-over-smb-to-an-uncommon-destination.md) - [An uncommon file added to startup-related Registry keys](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/an-uncommon-file-added-to-startup-related-registry-keys.md) - [An uncommon file was created in the startup folder](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/an-uncommon-file-was-created-in-the-startup-folder.md) - [An uncommon lolbin execution by scheduled task](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/an-uncommon-lolbin-execution-by-scheduled-task.md) - [An uncommon RDP session from a managed host](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/an-uncommon-rdp-session-from-a-managed-host.md) - [An uncommon RDP session was established](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/an-uncommon-rdp-session-was-established.md) - [An uncommon service was started](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/an-uncommon-service-was-started.md) - [An unknown account was invited to the AWS organization](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/an-unknown-account-was-invited-to-the-aws-organization.md) - [An unpopular process accessed the microphone on the host](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/an-unpopular-process-accessed-the-microphone-on-the-host.md) - [An unsigned process created scheduled task and performed an injection](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/an-unsigned-process-created-scheduled-task-and-performed-an-injection.md) - [An unusual archive file creation by a user](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/an-unusual-archive-file-creation-by-a-user.md) - [An unusual cloud identity was granted permissions to a BigQuery resource](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/an-unusual-cloud-identity-was-granted-permissions-to-a-bigquery-resource.md) - [An unusual process in ingress-nginx has accessed a service-account token file](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/an-unusual-process-in-ingress-nginx-has-accessed-a-service-account-token-file.md) - [An unusual read activity of cloud object](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/an-unusual-read-activity-of-cloud-object.md) - [Analytics enhanced NGFW Threat Alert - Rare Internal Firewall Vulnerability Threat Alert](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/analytics-enhanced-ngfw-threat-alert-rare-internal-firewall-vulnerability-threat-alert.md) - [AppleScript executed a shell script](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/applescript-executed-a-shell-script.md) - [AppleScript interpreter dynamic library loaded into a process](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/applescript-interpreter-dynamic-library-loaded-into-a-process.md) - [AppleScript process executed with a rare command line](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/applescript-process-executed-with-a-rare-command-line.md) - [Attempt to execute a command on a remote host using PsExec.exe](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/attempt-to-execute-a-command-on-a-remote-host-using-psexec-exe.md) - [Attempted Azure application access from unknown tenant](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/attempted-azure-application-access-from-unknown-tenant.md) - [Aurora DB cluster stopped](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/aurora-db-cluster-stopped.md) - [Authentication attempt by a honey user](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/authentication-attempt-by-a-honey-user.md) - [Authentication Attempt From a Dormant Account](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/authentication-attempt-from-a-dormant-account.md) - [Authentication method added to an Azure account](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/authentication-method-added-to-an-azure-account.md) - [Authentication method was added to Azure account](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/authentication-method-was-added-to-azure-account.md) - [Autorun.inf created in root C drive](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/autorun-inf-created-in-root-c-drive.md) - [AWS Backup recovery point deletion](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/aws-backup-recovery-point-deletion.md) - [AWS Backup vault was deleted](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/aws-backup-vault-was-deleted.md) - [AWS Bedrock AI infrastructure enumeration activity](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/aws-bedrock-ai-infrastructure-enumeration-activity.md) - [AWS Bedrock model invocation logging deletion](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/aws-bedrock-model-invocation-logging-deletion.md) - [AWS CloudTrail has been stopped](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/aws-cloudtrail-has-been-stopped.md) - [AWS CloudTrail modification](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/aws-cloudtrail-modification.md) - [AWS CloudWatch log group deletion](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/aws-cloudwatch-log-group-deletion.md) - [AWS CloudWatch log stream deletion](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/aws-cloudwatch-log-stream-deletion.md) - [AWS Config Recorder stopped](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/aws-config-recorder-stopped.md) - [AWS config resource deletion](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/aws-config-resource-deletion.md) - [AWS console login without MFA](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/aws-console-login-without-mfa.md) - [AWS data asset shared public](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/aws-data-asset-shared-public.md) - [AWS EBS enumeration activity](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/aws-ebs-enumeration-activity.md) - [AWS EBS snapshot deletion](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/aws-ebs-snapshot-deletion.md) - [AWS EC2 infrastructure enumeration activity](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/aws-ec2-infrastructure-enumeration-activity.md) - [AWS EC2 instance exported into S3](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/aws-ec2-instance-exported-into-s3.md) - [AWS Flow Logs deletion](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/aws-flow-logs-deletion.md) - [AWS Guard-Duty detector deletion](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/aws-guard-duty-detector-deletion.md) - [AWS IAM resource group deletion](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/aws-iam-resource-group-deletion.md) - [AWS IAM Role Created with Cross-Account Access](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/aws-iam-role-created-with-cross-account-access.md) - [AWS IAM Role's Trusted Policy Modification Allows Cross-Account Access](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/aws-iam-role-s-trusted-policy-modification-allows-cross-account-access.md) - [AWS Lambda Cross-Account sensitive permissions configured](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/aws-lambda-cross-account-sensitive-permissions-configured.md) - [AWS Lambda infrastructure enumeration activity](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/aws-lambda-infrastructure-enumeration-activity.md) - [AWS network ACL rule creation](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/aws-network-acl-rule-creation.md) - [AWS network ACL rule deletion](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/aws-network-acl-rule-deletion.md) - [AWS Password Policy Discovery](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/aws-password-policy-discovery.md) - [AWS principals discovery](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/aws-principals-discovery.md) - [AWS RDS cluster deletion](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/aws-rds-cluster-deletion.md) - [AWS resource discovery](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/aws-resource-discovery.md) - [AWS root account activity](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/aws-root-account-activity.md) - [AWS Route53 DNS Resolver query logging configuration deletion](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/aws-route53-dns-resolver-query-logging-configuration-deletion.md) - [AWS S3 bucket data retention policy change through S3 Lifecycle rule](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/aws-s3-bucket-data-retention-policy-change-through-s3-lifecycle-rule.md) - [AWS S3 bucket or object was exposed to public access](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/aws-s3-bucket-or-object-was-exposed-to-public-access.md) - [AWS S3 Buckets enumeration activity](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/aws-s3-buckets-enumeration-activity.md) - [AWS Secrets Manager discovery](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/aws-secrets-manager-discovery.md) - [AWS Security Group remote access allowed from an unknown external IP address](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/aws-security-group-remote-access-allowed-from-an-unknown-external-ip-address.md) - [AWS Security Service Enumeration](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/aws-security-service-enumeration.md) - [AWS SecurityHub findings were modified](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/aws-securityhub-findings-were-modified.md) - [AWS SES account sending settings modified](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/aws-ses-account-sending-settings-modified.md) - [AWS SSM association created with inventory collection document](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/aws-ssm-association-created-with-inventory-collection-document.md) - [AWS SSM parameters discovery](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/aws-ssm-parameters-discovery.md) - [AWS SSM parameters retrieval](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/aws-ssm-parameters-retrieval.md) - [AWS SSM send command attempt](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/aws-ssm-send-command-attempt.md) - [AWS Storage Gateway enumeration](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/aws-storage-gateway-enumeration.md) - [AWS Storage Gateway file share enumeration](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/aws-storage-gateway-file-share-enumeration.md) - [AWS STS temporary credentials were generated](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/aws-sts-temporary-credentials-were-generated.md) - [AWS support case creation](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/aws-support-case-creation.md) - [AWS Systems Manager hosts enumeration](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/aws-systems-manager-hosts-enumeration.md) - [AWS Transfer Family server created](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/aws-transfer-family-server-created.md) - [AWS user creation](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/aws-user-creation.md) - [AWS web ACL deletion](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/aws-web-acl-deletion.md) - [Azure account creation by a non-standard account](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/azure-account-creation-by-a-non-standard-account.md) - [Azure account deletion by a non-standard account](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/azure-account-deletion-by-a-non-standard-account.md) - [Azure AD account unlock/password reset attempt](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/azure-ad-account-unlock-password-reset-attempt.md) - [Azure AD PIM alert disabled](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/azure-ad-pim-alert-disabled.md) - [Azure AD PIM elevation request](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/azure-ad-pim-elevation-request.md) - [Azure AD PIM role settings change](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/azure-ad-pim-role-settings-change.md) - [Azure application consent](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/azure-application-consent.md) - [Azure application credentials added](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/azure-application-credentials-added.md) - [Azure application removed](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/azure-application-removed.md) - [Azure application URI modification](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/azure-application-uri-modification.md) - [Azure Automation Account Creation](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/azure-automation-account-creation.md) - [Azure Automation Runbook Creation/Modification](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/azure-automation-runbook-creation-modification.md) - [Azure Automation Runbook Deletion](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/azure-automation-runbook-deletion.md) - [Azure Automation Webhook creation](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/azure-automation-webhook-creation.md) - [Azure Blob Container Access Level Modification](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/azure-blob-container-access-level-modification.md) - [Azure conditional access policy creation or modification](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/azure-conditional-access-policy-creation-or-modification.md) - [Azure diagnostic configuration deletion](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/azure-diagnostic-configuration-deletion.md) - [Azure domain federation settings modification attempt](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/azure-domain-federation-settings-modification-attempt.md) - [Azure enumeration activity using Microsoft Graph API](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/azure-enumeration-activity-using-microsoft-graph-api.md) - [Azure Event Hub Authorization rule creation/modification](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/azure-event-hub-authorization-rule-creation-modification.md) - [Azure Event Hub Deletion](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/azure-event-hub-deletion.md) - [Azure group creation/deletion](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/azure-group-creation-deletion.md) - [Azure Key Vault modification](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/azure-key-vault-modification.md) - [Azure Key Vault Secrets were modified](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/azure-key-vault-secrets-were-modified.md) - [Azure Kubernetes events were deleted](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/azure-kubernetes-events-were-deleted.md) - [Azure mailbox rule creation](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/azure-mailbox-rule-creation.md) - [Azure Monitor alert rule deleted](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/azure-monitor-alert-rule-deleted.md) - [Azure Network Watcher Deletion](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/azure-network-watcher-deletion.md) - [Azure permission delegation granted](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/azure-permission-delegation-granted.md) - [Azure Privilege Escalation Using an Application](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/azure-privilege-escalation-using-an-application.md) - [Azure Resource Group Deletion](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/azure-resource-group-deletion.md) - [Azure route table creation or modification](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/azure-route-table-creation-or-modification.md) - [Azure Service principal/Application creation](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/azure-service-principal-application-creation.md) - [Azure service principal assigned app role](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/azure-service-principal-assigned-app-role.md) - [Azure storage account blob anonymous access is enabled](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/azure-storage-account-blob-anonymous-access-is-enabled.md) - [Azure storage account cross-tenant object replication was enabled](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/azure-storage-account-cross-tenant-object-replication-was-enabled.md) - [Azure Storage Account key generated](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/azure-storage-account-key-generated.md) - [Azure storage account was publicly shared](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/azure-storage-account-was-publicly-shared.md) - [Azure Temporary Access Pass (TAP) registered to an account](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/azure-temporary-access-pass-tap-registered-to-an-account.md) - [Azure user creation/deletion](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/azure-user-creation-deletion.md) - [Azure user password reset](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/azure-user-password-reset.md) - [Azure virtual machine commands execution](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/azure-virtual-machine-commands-execution.md) - [Azure VM extension abuse attempt](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/azure-vm-extension-abuse-attempt.md) - [Bedrock model shared with a foreign account](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/bedrock-model-shared-with-a-foreign-account.md) - [BigQuery table or query results exfiltrated to a foreign project](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/bigquery-table-or-query-results-exfiltrated-to-a-foreign-project.md) - [Billing admin role was removed](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/billing-admin-role-was-removed.md) - [BitLocker key retrieval](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/bitlocker-key-retrieval.md) - [Bitsadmin.exe persistence using command-line callback](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/bitsadmin-exe-persistence-using-command-line-callback.md) - [Broker Collection Error](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/broker-collection-error.md) - [Bronze-Bit exploit](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/bronze-bit-exploit.md) - [Browser bookmark files accessed by a rare non-browser process](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/browser-bookmark-files-accessed-by-a-rare-non-browser-process.md) - [Browser Extension Installed](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/browser-extension-installed.md) - [Brute-force attempt on a local account](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/brute-force-attempt-on-a-local-account.md) - [Bucket's block public access setting turned off](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/bucket-s-block-public-access-setting-turned-off.md) - [Bucket's object ownership controls were modified](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/bucket-s-object-ownership-controls-were-modified.md) - [Cached credentials discovery with cmdkey](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/cached-credentials-discovery-with-cmdkey.md) - [Certutil pfx parsing](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/certutil-pfx-parsing.md) - [Change of sudo caching configuration](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/change-of-sudo-caching-configuration.md) - [Chrome Extension Installed By User](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/chrome-extension-installed-by-user.md) - [Chrome OS Remote Access policy was modified in Google Workspace](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/chrome-os-remote-access-policy-was-modified-in-google-workspace.md) - [ClickFix - PowerShell executed through the run application](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/clickfix-powershell-executed-through-the-run-application.md) - [Cloud access key creation](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/cloud-access-key-creation.md) - [Cloud activity from a high-risk IP address](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/cloud-activity-from-a-high-risk-ip-address.md) - [Cloud AI agent was modified](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/cloud-ai-agent-was-modified.md) - [Cloud compute instance user data script modification](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/cloud-compute-instance-user-data-script-modification.md) - [Cloud compute serial console access](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/cloud-compute-serial-console-access.md) - [Cloud compute volume creation attempt](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/cloud-compute-volume-creation-attempt.md) - [Cloud email infrastructure enumeration activity](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/cloud-email-infrastructure-enumeration-activity.md) - [Cloud email sending was enabled](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/cloud-email-sending-was-enabled.md) - [Cloud email service activity](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/cloud-email-service-activity.md) - [Cloud identity reached a throttling API rate](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/cloud-identity-reached-a-throttling-api-rate.md) - [Cloud IMDS access followed by remote token usage](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/cloud-imds-access-followed-by-remote-token-usage.md) - [Cloud impersonation attempt by unusual identity type](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/cloud-impersonation-attempt-by-unusual-identity-type.md) - [Cloud infrastructure discovery across multiple regions](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/cloud-infrastructure-discovery-across-multiple-regions.md) - [Cloud infrastructure enumeration activity](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/cloud-infrastructure-enumeration-activity.md) - [Cloud instance creation attempt](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/cloud-instance-creation-attempt.md) - [Cloud instance deletion attempt](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/cloud-instance-deletion-attempt.md) - [Cloud Organizational policy was created or modified](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/cloud-organizational-policy-was-created-or-modified.md) - [Cloud penetration testing tool activity](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/cloud-penetration-testing-tool-activity.md) - [Cloud resource logging was disabled](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/cloud-resource-logging-was-disabled.md) - [Cloud snapshot created or modified](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/cloud-snapshot-created-or-modified.md) - [Cloud snapshot of a database or storage instance was publicly shared](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/cloud-snapshot-of-a-database-or-storage-instance-was-publicly-shared.md) - [Cloud storage automatic backup disabled](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/cloud-storage-automatic-backup-disabled.md) - [Cloud storage delete protection disabled](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/cloud-storage-delete-protection-disabled.md) - [Cloud user performed multiple actions that were denied](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/cloud-user-performed-multiple-actions-that-were-denied.md) - [Cloud Watch alarm deletion](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/cloud-watch-alarm-deletion.md) - [CloudTrail logging deletion](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/cloudtrail-logging-deletion.md) - [Collection error](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/collection-error.md) - [Command execution in a Kubernetes pod](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/command-execution-in-a-kubernetes-pod.md) - [Command execution via AWS SSM](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/command-execution-via-aws-ssm.md) - [Command execution via wmiexec](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/command-execution-via-wmiexec.md) - [Command running with COMSPEC in the command line argument](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/command-running-with-comspec-in-the-command-line-argument.md) - [Common third-party software name masquerading](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/common-third-party-software-name-masquerading.md) - [Commonly abused AutoIT script connects to an external domain](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/commonly-abused-autoit-script-connects-to-an-external-domain.md) - [Commonly abused AutoIT script drops an executable file to disk](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/commonly-abused-autoit-script-drops-an-executable-file-to-disk.md) - [Commonly abused process launched as a system service](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/commonly-abused-process-launched-as-a-system-service.md) - [Compressing data using python](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/compressing-data-using-python.md) - [Compute activity in dormant cloud region](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/compute-activity-in-dormant-cloud-region.md) - [Conditional Access policy removed](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/conditional-access-policy-removed.md) - [Conhost.exe spawned a suspicious cmd process](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/conhost-exe-spawned-a-suspicious-cmd-process.md) - [Contained process execution with a rare GitHub URL](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/contained-process-execution-with-a-rare-github-url.md) - [Copy a process memory file](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/copy-a-process-memory-file.md) - [Copy a user's GnuPG directory with rsync](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/copy-a-user-s-gnupg-directory-with-rsync.md) - [Correlation rule error](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/correlation-rule-error.md) - [Creation or modification of the default command executed when opening an application](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/creation-or-modification-of-the-default-command-executed-when-opening-an-application.md) - [Credentials were added to Azure application](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/credentials-were-added-to-azure-application.md) - [Data encryption was disabled](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/data-encryption-was-disabled.md) - [Data exfiltration from cloud database](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/data-exfiltration-from-cloud-database.md) - [Data Sharing between GCP and Google Workspace was disabled](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/data-sharing-between-gcp-and-google-workspace-was-disabled.md) - [Delayed Deletion of Files](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/delayed-deletion-of-files.md) - [Deletion of AD CS certificate database entries](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/deletion-of-ad-cs-certificate-database-entries.md) - [Deletion of multiple cloud resources](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/deletion-of-multiple-cloud-resources.md) - [Denied API call by a Kubernetes service account](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/denied-api-call-by-a-kubernetes-service-account.md) - [Device Registration Policy modification](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/device-registration-policy-modification.md) - [Disable AWS audit logs through Event Selectors](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/disable-aws-audit-logs-through-event-selectors.md) - [Disable encryption operations](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/disable-encryption-operations.md) - [Disable Microsoft Defender Antivirus via registry](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/disable-microsoft-defender-antivirus-via-registry.md) - [Discovery of accounts with pre-authentication disabled via LDAP](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/discovery-of-accounts-with-pre-authentication-disabled-via-ldap.md) - [Discovery of host users via WMIC](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/discovery-of-host-users-via-wmic.md) - [Discovery of misconfigured certificate templates using LDAP](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/discovery-of-misconfigured-certificate-templates-using-ldap.md) - [Display text URL differs from actual URL](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/display-text-url-differs-from-actual-url.md) - [DLP sensitive data exposed to external users](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/dlp-sensitive-data-exposed-to-external-users.md) - [DNS Tunneling](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/dns-tunneling.md) - [Docker state manipulation via docker.sock](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/docker-state-manipulation-via-docker-sock.md) - [Download a script using the python requests module](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/download-a-script-using-the-python-requests-module.md) - [Download pattern that resembles Peer to Peer traffic](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/download-pattern-that-resembles-peer-to-peer-traffic.md) - [DSC (Desired State Configuration) lateral movement using PowerShell](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/dsc-desired-state-configuration-lateral-movement-using-powershell.md) - [EBS snapshots were created from an EC2 instance](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/ebs-snapshots-were-created-from-an-ec2-instance.md) - [EBS volume attachment attempt](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/ebs-volume-attachment-attempt.md) - [EBS volume detachment attempt](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/ebs-volume-detachment-attempt.md) - [EC2 backdoor created with newly added external SSH or RDP access](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/ec2-backdoor-created-with-newly-added-external-ssh-or-rdp-access.md) - [EC2 instance Amazon machine image was created](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/ec2-instance-amazon-machine-image-was-created.md) - [Elevation to SYSTEM via services](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/elevation-to-system-via-services.md) - [Email attachment(s) with potentially malicious MIME type](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/email-attachment-s-with-potentially-malicious-mime-type.md) - [Email attachment with a potentially malicious file extension](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/email-attachment-with-a-potentially-malicious-file-extension.md) - [Email attachment with multiple extensions](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/email-attachment-with-multiple-extensions.md) - [Email attachment with Right-to-Left Override Unicode character](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/email-attachment-with-right-to-left-override-unicode-character.md) - [Email containing a link with an IP address convention was detected](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/email-containing-a-link-with-an-ip-address-convention-was-detected.md) - [Email containing a redirected link](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/email-containing-a-redirected-link.md) - [Email contains URL delivering high-risk file type](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/email-contains-url-delivering-high-risk-file-type.md) - [Email marked as spam and bulk based on Spam Confidence Level and Bulk Complaint Level values](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/email-marked-as-spam-and-bulk-based-on-spam-confidence-level-and-bulk-complaint-level-values.md) - [Email mimics replies or forwards without an actual ongoing conversation](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/email-mimics-replies-or-forwards-without-an-actual-ongoing-conversation.md) - [Email sent using an automated system or script detected](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/email-sent-using-an-automated-system-or-script-detected.md) - [Email was received from an unknown address using a public provider domain](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/email-was-received-from-an-unknown-address-using-a-public-provider-domain.md) - [Email was received from an unknown sender using a disposable domain](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/email-was-received-from-an-unknown-sender-using-a-disposable-domain.md) - [Email with file-sharing link containing auto-download parameter](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/email-with-file-sharing-link-containing-auto-download-parameter.md) - [Email with Google Apps Script web app URL detected](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/email-with-google-apps-script-web-app-url-detected.md) - [Email with URL shortener detected](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/email-with-url-shortener-detected.md) - [Encoded information using Windows certificate management tool](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/encoded-information-using-windows-certificate-management-tool.md) - [Error in event forwarding](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/error-in-event-forwarding.md) - [Excessive user account lockouts](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/excessive-user-account-lockouts.md) - [Exchange anti-phish policy disabled or removed](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/exchange-anti-phish-policy-disabled-or-removed.md) - [Exchange audit log disabled](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/exchange-audit-log-disabled.md) - [Exchange compliance search created](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/exchange-compliance-search-created.md) - [Exchange DKIM signing configuration disabled](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/exchange-dkim-signing-configuration-disabled.md) - [Exchange email-hiding inbox rule](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/exchange-email-hiding-inbox-rule.md) - [Exchange email-hiding transport rule](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/exchange-email-hiding-transport-rule.md) - [Exchange inbox forwarding rule configured](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/exchange-inbox-forwarding-rule-configured.md) - [Exchange mailbox audit bypass](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/exchange-mailbox-audit-bypass.md) - [Exchange mailbox delegation permissions added](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/exchange-mailbox-delegation-permissions-added.md) - [Exchange mailbox folder permission modification](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/exchange-mailbox-folder-permission-modification.md) - [Exchange malware filter policy removed](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/exchange-malware-filter-policy-removed.md) - [Exchange Safe Attachment policy disabled or removed](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/exchange-safe-attachment-policy-disabled-or-removed.md) - [Exchange Safe Link policy disabled or removed](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/exchange-safe-link-policy-disabled-or-removed.md) - [Exchange transport forwarding rule configured](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/exchange-transport-forwarding-rule-configured.md) - [Exchange user mailbox forwarding](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/exchange-user-mailbox-forwarding.md) - [Executable created to disk by lsass.exe](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/executable-created-to-disk-by-lsass-exe.md) - [Executable moved to Windows system folder](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/executable-moved-to-windows-system-folder.md) - [Executable or Script file written by a web server process](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/executable-or-script-file-written-by-a-web-server-process.md) - [Execution of an uncommon process at an early startup stage by Windows system binary](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/execution-of-an-uncommon-process-at-an-early-startup-stage-by-windows-system-binary.md) - [Execution of an uncommon process at an early startup stage](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/execution-of-an-uncommon-process-at-an-early-startup-stage.md) - [Execution of an uncommon process with a local/domain user SID at an early startup stage](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/execution-of-an-uncommon-process-with-a-local-domain-user-sid-at-an-early-startup-stage.md) - [Execution of an uncommon process with a local/domain user SID at early startup by a system binary](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/execution-of-an-uncommon-process-with-a-local-domain-user-sid-at-early-startup-by-a-system-binary.md) - [Execution of command from within a Kubernetes pod using kubelet credentials](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/execution-of-command-from-within-a-kubernetes-pod-using-kubelet-credentials.md) - [Execution of dllhost.exe with an empty command line](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/execution-of-dllhost-exe-with-an-empty-command-line.md) - [Execution of masqueraded third-party utility](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/execution-of-masqueraded-third-party-utility.md) - [Execution of renamed lolbin](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/execution-of-renamed-lolbin.md) - [External email display name impersonation of internal personnel](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/external-email-display-name-impersonation-of-internal-personnel.md) - [External email with a single internal recipient hidden in BCC](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/external-email-with-a-single-internal-recipient-hidden-in-bcc.md) - [External Login Password Spray](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/external-login-password-spray.md) - [External SaaS file-sharing activity](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/external-saas-file-sharing-activity.md) - [External Sharing was turned on for Google Drive](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/external-sharing-was-turned-on-for-google-drive.md) - [External user added a link to a Microsoft Teams chat](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/external-user-added-a-link-to-a-microsoft-teams-chat.md) - [External user call via Microsoft Teams](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/external-user-call-via-microsoft-teams.md) - [External user created a Microsoft Teams conversation with suspicious operations](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/external-user-created-a-microsoft-teams-conversation-with-suspicious-operations.md) - [External user invitation to Azure tenant](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/external-user-invitation-to-azure-tenant.md) - [External user started a Microsoft Teams conversation](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/external-user-started-a-microsoft-teams-conversation.md) - [Extracting credentials from Unix files](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/extracting-credentials-from-unix-files.md) - [Failed Connections](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/failed-connections.md) - [Failed DNS](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/failed-dns.md) - [Failed Login For a Long Username With Special Characters](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/failed-login-for-a-long-username-with-special-characters.md) - [Failed Login For Locked-Out Account](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/failed-login-for-locked-out-account.md) - [File transfer from unusual IP using known tools](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/file-transfer-from-unusual-ip-using-known-tools.md) - [First Azure AD PowerShell operation for a user](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/first-azure-ad-powershell-operation-for-a-user.md) - [First connection from a country in organization](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/first-connection-from-a-country-in-organization.md) - [First-seen email from mailbox owner to external recipient's address in the last 30 days](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/first-seen-email-from-mailbox-owner-to-external-recipient-s-address-in-the-last-30-days.md) - [First SSO access from ASN for user](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/first-sso-access-from-asn-for-user.md) - [First SSO access from ASN in organization](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/first-sso-access-from-asn-in-organization.md) - [First SSO Resource Access in the Organization](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/first-sso-resource-access-in-the-organization.md) - [First-time attachment exchange](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/first-time-attachment-exchange.md) - [First-time directory sync of an on-premises domain user to an existing cloud account](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/first-time-directory-sync-of-an-on-premises-domain-user-to-an-existing-cloud-account.md) - [First VPN access attempt from a country in organization](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/first-vpn-access-attempt-from-a-country-in-organization.md) - [First VPN access from ASN for user](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/first-vpn-access-from-asn-for-user.md) - [First VPN access from ASN in organization](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/first-vpn-access-from-asn-in-organization.md) - [Fodhelper.exe UAC bypass](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/fodhelper-exe-uac-bypass.md) - [Foreign account was granted permissions to S3 bucket via resource-based policy](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/foreign-account-was-granted-permissions-to-s3-bucket-via-resource-based-policy.md) - [FTP Connection Using an Anonymous Login or Default Credentials](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/ftp-connection-using-an-anonymous-login-or-default-credentials.md) - [GCP administrative role granted to a cloud identity](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/gcp-administrative-role-granted-to-a-cloud-identity.md) - [GCP data asset shared public](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/gcp-data-asset-shared-public.md) - [GCP Firewall Rule creation](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/gcp-firewall-rule-creation.md) - [GCP Firewall Rule Modification](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/gcp-firewall-rule-modification.md) - [GCP IAM deny policy creation](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/gcp-iam-deny-policy-creation.md) - [GCP IAM Role Deletion](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/gcp-iam-role-deletion.md) - [GCP IAM Service Account Key Deletion](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/gcp-iam-service-account-key-deletion.md) - [GCP Logging Bucket Deletion](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/gcp-logging-bucket-deletion.md) - [GCP logging sink deletion](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/gcp-logging-sink-deletion.md) - [GCP logging sink modification](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/gcp-logging-sink-modification.md) - [GCP Pub/Sub Subscription Deletion](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/gcp-pub-sub-subscription-deletion.md) - [GCP Pub/Sub Topic Deletion](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/gcp-pub-sub-topic-deletion.md) - [GCP sensitive Cloud Run role granted](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/gcp-sensitive-cloud-run-role-granted.md) - [GCP sensitive compute role granted](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/gcp-sensitive-compute-role-granted.md) - [GCP sensitive Deployment Manager role granted](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/gcp-sensitive-deployment-manager-role-granted.md) - [GCP sensitive Functions role granted](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/gcp-sensitive-functions-role-granted.md) - [GCP sensitive IAM role granted](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/gcp-sensitive-iam-role-granted.md) - [GCP sensitive role granted to group](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/gcp-sensitive-role-granted-to-group.md) - [GCP sensitive Secret Manager role granted](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/gcp-sensitive-secret-manager-role-granted.md) - [GCP sensitive storage role granted](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/gcp-sensitive-storage-role-granted.md) - [GCP Service Account creation](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/gcp-service-account-creation.md) - [GCP Service Account Deletion](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/gcp-service-account-deletion.md) - [GCP Service Account Disable](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/gcp-service-account-disable.md) - [GCP service account impersonation attempt](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/gcp-service-account-impersonation-attempt.md) - [GCP Service Account key creation](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/gcp-service-account-key-creation.md) - [GCP set IAM policy activity](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/gcp-set-iam-policy-activity.md) - [GCP Storage Bucket Configuration Modification](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/gcp-storage-bucket-configuration-modification.md) - [GCP Storage Bucket deletion](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/gcp-storage-bucket-deletion.md) - [GCP Storage Bucket Permissions Modification](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/gcp-storage-bucket-permissions-modification.md) - [GCP Virtual Private Cloud (VPC) Network Deletion](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/gcp-virtual-private-cloud-vpc-network-deletion.md) - [GCP Virtual Private Network Route Creation](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/gcp-virtual-private-network-route-creation.md) - [GCP Virtual Private Network Route Deletion](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/gcp-virtual-private-network-route-deletion.md) - [GCP VPC Firewall Rule Deletion](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/gcp-vpc-firewall-rule-deletion.md) - [Globally uncommon high entropy module was loaded](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/globally-uncommon-high-entropy-module-was-loaded.md) - [Globally uncommon high entropy process was executed](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/globally-uncommon-high-entropy-process-was-executed.md) - [Globally uncommon image load from a signed process](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/globally-uncommon-image-load-from-a-signed-process.md) - [Globally uncommon injection from a signed process](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/globally-uncommon-injection-from-a-signed-process.md) - [Globally uncommon IP address by a common process (sha256)](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/globally-uncommon-ip-address-by-a-common-process-sha256.md) - [Globally uncommon IP address connection from a signed process](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/globally-uncommon-ip-address-connection-from-a-signed-process.md) - [Globally uncommon process execution from a signed process](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/globally-uncommon-process-execution-from-a-signed-process.md) - [Globally uncommon root domain from a signed process](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/globally-uncommon-root-domain-from-a-signed-process.md) - [Globally uncommon root-domain port combination by a common process (sha256)](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/globally-uncommon-root-domain-port-combination-by-a-common-process-sha256.md) - [Globally uncommon root-domain port combination from a signed process](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/globally-uncommon-root-domain-port-combination-from-a-signed-process.md) - [Gmail delegation was turned on for the organization](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/gmail-delegation-was-turned-on-for-the-organization.md) - [Gmail routing settings changed](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/gmail-routing-settings-changed.md) - [Google Marketplace restrictions were modified](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/google-marketplace-restrictions-were-modified.md) - [Google Workspace automation was created](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/google-workspace-automation-was-created.md) - [Google Workspace organizational unit was modified](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/google-workspace-organizational-unit-was-modified.md) - [Google Workspace third-party application's security settings were changed](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/google-workspace-third-party-application-s-security-settings-were-changed.md) - [Google Workspace user authentication information changed](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/google-workspace-user-authentication-information-changed.md) - [Granting Access to an Account](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/granting-access-to-an-account.md) - [Hidden Attribute was added to a file using attrib.exe](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/hidden-attribute-was-added-to-a-file-using-attrib-exe.md) - [HTTP with suspicious characteristics](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/http-with-suspicious-characteristics.md) - [Hydra Password Brute-Force Tool Execution](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/hydra-password-brute-force-tool-execution.md) - [IAM Enumeration sequence](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/iam-enumeration-sequence.md) - [IAM inline policy was added to group](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/iam-inline-policy-was-added-to-group.md) - [IAM inline policy was added to role](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/iam-inline-policy-was-added-to-role.md) - [IAM inline policy was added to user](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/iam-inline-policy-was-added-to-user.md) - [IAM instance profile associations were described](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/iam-instance-profile-associations-were-described.md) - [IAM instance profile was associated with EC2 instance](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/iam-instance-profile-was-associated-with-ec2-instance.md) - [IAM instance profile was created](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/iam-instance-profile-was-created.md) - [IAM instance profile was replaced for EC2 instance](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/iam-instance-profile-was-replaced-for-ec2-instance.md) - [IAM policy default version was changed](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/iam-policy-default-version-was-changed.md) - [IAM policy version was created](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/iam-policy-version-was-created.md) - [IAM policy was attached to group](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/iam-policy-was-attached-to-group.md) - [IAM policy was attached to role](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/iam-policy-was-attached-to-role.md) - [IAM role-attached managed policies were listed](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/iam-role-attached-managed-policies-were-listed.md) - [IAM role trust policy modification](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/iam-role-trust-policy-modification.md) - [IAM role was created](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/iam-role-was-created.md) - [IAM User added to an IAM group](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/iam-user-added-to-an-iam-group.md) - [Identity assigned an Azure AD Administrator Role](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/identity-assigned-an-azure-ad-administrator-role.md) - [Image file execution options (IFEO) registry key set](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/image-file-execution-options-ifeo-registry-key-set.md) - [Impossible travel by a cloud identity](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/impossible-travel-by-a-cloud-identity.md) - [Impossible traveler - SSO](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/impossible-traveler-sso.md) - [Impossible traveler - VPN](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/impossible-traveler-vpn.md) - [Increase in Job-Related Site Visits](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/increase-in-job-related-site-visits.md) - [Indicator blocking](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/indicator-blocking.md) - [Indirect command execution using the Program Compatibility Assistant](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/indirect-command-execution-using-the-program-compatibility-assistant.md) - [Information gathering via docker.sock](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/information-gathering-via-docker-sock.md) - [Initial person-to-person email contact](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/initial-person-to-person-email-contact.md) - [Injection into rundll32.exe](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/injection-into-rundll32-exe.md) - [Installation of a new System-V service](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/installation-of-a-new-system-v-service.md) - [Intense SSO failures](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/intense-sso-failures.md) - [Interactive at.exe privilege escalation method](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/interactive-at-exe-privilege-escalation-method.md) - [Interactive local account enumeration](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/interactive-local-account-enumeration.md) - [Interactive login by a machine account](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/interactive-login-by-a-machine-account.md) - [Interactive login by a service account](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/interactive-login-by-a-service-account.md) - [Interactive login from a shared user account](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/interactive-login-from-a-shared-user-account.md) - [Internal address failed authentication](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/internal-address-failed-authentication.md) - [Internal Login Password Spray](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/internal-login-password-spray.md) - [Invalid SAML Detected](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/invalid-saml-detected.md) - [IP Rotation Pattern in SSO Spray](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/ip-rotation-pattern-in-sso-spray.md) - [Iptables configuration command was executed](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/iptables-configuration-command-was-executed.md) - [JS runtime attempted to read Git authentication tokens](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/js-runtime-attempted-to-read-git-authentication-tokens.md) - [Kerberos Pre-Auth Failures by Host](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/kerberos-pre-auth-failures-by-host.md) - [Kerberos Pre-Auth Failures by User and Host](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/kerberos-pre-auth-failures-by-user-and-host.md) - [Kerberos Traffic from Non-Standard Process](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/kerberos-traffic-from-non-standard-process.md) - [Kerberos User Enumeration](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/kerberos-user-enumeration.md) - [Key credential attribute modification](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/key-credential-attribute-modification.md) - [Keylogging using system commands](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/keylogging-using-system-commands.md) - [KMS key policy was changed](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/kms-key-policy-was-changed.md) - [Known service display name with uncommon image-path](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/known-service-display-name-with-uncommon-image-path.md) - [Known service name with an uncommon image-path](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/known-service-name-with-an-uncommon-image-path.md) - [Kubelet server communication from a pod](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/kubelet-server-communication-from-a-pod.md) - [Kubernetes admission controller activity](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/kubernetes-admission-controller-activity.md) - [Kubernetes API server communication from within a pod](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/kubernetes-api-server-communication-from-within-a-pod.md) - [Kubernetes cluster events deletion](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/kubernetes-cluster-events-deletion.md) - [Kubernetes enumeration activity](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/kubernetes-enumeration-activity.md) - [Kubernetes environment enumeration activity](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/kubernetes-environment-enumeration-activity.md) - [Kubernetes network policy modification](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/kubernetes-network-policy-modification.md) - [Kubernetes nsenter container escape](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/kubernetes-nsenter-container-escape.md) - [Kubernetes Pod Created with host Inter Process Communications (IPC) namespace](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/kubernetes-pod-created-with-host-inter-process-communications-ipc-namespace.md) - [Kubernetes Pod created with host process ID (PID) namespace](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/kubernetes-pod-created-with-host-process-id-pid-namespace.md) - [Kubernetes Pod Created With Sensitive Volume](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/kubernetes-pod-created-with-sensitive-volume.md) - [Kubernetes pod creation from unknown container image registry](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/kubernetes-pod-creation-from-unknown-container-image-registry.md) - [Kubernetes pod creation with host network](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/kubernetes-pod-creation-with-host-network.md) - [Kubernetes Privileged Pod Creation](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/kubernetes-privileged-pod-creation.md) - [Kubernetes secret enumeration activity](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/kubernetes-secret-enumeration-activity.md) - [Kubernetes secrets enumeration for the first time](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/kubernetes-secrets-enumeration-for-the-first-time.md) - [Kubernetes service account activity outside the cluster](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/kubernetes-service-account-activity-outside-the-cluster.md) - [Kubernetes version disclosure](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/kubernetes-version-disclosure.md) - [Kubernetes vulnerability scanner activity](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/kubernetes-vulnerability-scanner-activity.md) - [Kubernetes vulnerability scanning tool usage](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/kubernetes-vulnerability-scanning-tool-usage.md) - [Large Upload (FTP)](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/large-upload-ftp.md) - [Large Upload (Generic)](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/large-upload-generic.md) - [Large Upload (HTTPS)](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/large-upload-https.md) - [Large Upload (SMTP)](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/large-upload-smtp.md) - [Large volume of files potentially containing credentials accessed in Google Drive](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/large-volume-of-files-potentially-containing-credentials-accessed-in-google-drive.md) - [LDAP AD CS Enumeration via Attack Tool](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/ldap-ad-cs-enumeration-via-attack-tool.md) - [LDAP search query from an unpopular and unsigned process](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/ldap-search-query-from-an-unpopular-and-unsigned-process.md) - [LDAP traffic from non-standard process](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/ldap-traffic-from-non-standard-process.md) - [Linux local user account creation](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/linux-local-user-account-creation.md) - [Linux network share discovery](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/linux-network-share-discovery.md) - [Linux process execution with a rare GitHub URL](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/linux-process-execution-with-a-rare-github-url.md) - [Linux system firewall was modified](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/linux-system-firewall-was-modified.md) - [Local account discovery](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/local-account-discovery.md) - [Local group enumeration via RPC](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/local-group-enumeration-via-rpc.md) - [Local group enumeration](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/local-group-enumeration.md) - [Local user account creation by a machine account](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/local-user-account-creation-by-a-machine-account.md) - [Local user account creation](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/local-user-account-creation.md) - [Local user enumeration via SAMR](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/local-user-enumeration-via-samr.md) - [Log enumeration via cloud native logging service](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/log-enumeration-via-cloud-native-logging-service.md) - [Logging was impaired via external encryption key](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/logging-was-impaired-via-external-encryption-key.md) - [Login attempt by a honey user](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/login-attempt-by-a-honey-user.md) - [Login by a dormant user](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/login-by-a-dormant-user.md) - [Logs were not collected from a data source for an abnormally long time](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/logs-were-not-collected-from-a-data-source-for-an-abnormally-long-time.md) - [LOLBAS executable injects into another process](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/lolbas-executable-injects-into-another-process.md) - [LOLBIN created a PSScriptPolicyTest PowerShell script file](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/lolbin-created-a-psscriptpolicytest-powershell-script-file.md) - [LOLBIN process executed with a high integrity level](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/lolbin-process-executed-with-a-high-integrity-level.md) - [LSASS dump file written to disk](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/lsass-dump-file-written-to-disk.md) - [Machine Account NTLM Relay](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/machine-account-ntlm-relay.md) - [Machine account was added to a domain admins group](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/machine-account-was-added-to-a-domain-admins-group.md) - [Mailbox Client Access Setting (CAS) changed](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/mailbox-client-access-setting-cas-changed.md) - [Mailbox enumeration activity by Azure application](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/mailbox-enumeration-activity-by-azure-application.md) - [Manipulation of netsh helper DLLs Registry keys](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/manipulation-of-netsh-helper-dlls-registry-keys.md) - [Masquerading as a default local account](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/masquerading-as-a-default-local-account.md) - [Masquerading as the Linux crond process](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/masquerading-as-the-linux-crond-process.md) - [Mass deletion of versioned S3 objects](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/mass-deletion-of-versioned-s3-objects.md) - [Massive file activity abnormal to process](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/massive-file-activity-abnormal-to-process.md) - [Massive file compression by user](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/massive-file-compression-by-user.md) - [Massive file downloads from SaaS service](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/massive-file-downloads-from-saas-service.md) - [Massive files deletion in Box](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/massive-files-deletion-in-box.md) - [Massive files deletion in Dropbox](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/massive-files-deletion-in-dropbox.md) - [Massive files deletion in Google Drive](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/massive-files-deletion-in-google-drive.md) - [Massive files deletion in Microsoft SharePoint or OneDrive](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/massive-files-deletion-in-microsoft-sharepoint-or-onedrive.md) - [Massive files editing in Box](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/massive-files-editing-in-box.md) - [Massive files editing in Dropbox](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/massive-files-editing-in-dropbox.md) - [Massive files editing in Google Drive](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/massive-files-editing-in-google-drive.md) - [Massive files editing in Microsoft SharePoint or OneDrive](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/massive-files-editing-in-microsoft-sharepoint-or-onedrive.md) - [Massive upload to a rare storage or mail domain](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/massive-upload-to-a-rare-storage-or-mail-domain.md) - [Massive upload to SaaS service](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/massive-upload-to-saas-service.md) - [Member added to a Windows local security group](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/member-added-to-a-windows-local-security-group.md) - [Memory dumping with comsvcs.dll](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/memory-dumping-with-comsvcs-dll.md) - [MFA device was removed/deactivated from an IAM user](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/mfa-device-was-removed-deactivated-from-an-iam-user.md) - [MFA Disabled for Google Workspace](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/mfa-disabled-for-google-workspace.md) - [MFA was disabled for a Google Workspace user](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/mfa-was-disabled-for-a-google-workspace-user.md) - [MFA was disabled for an Azure identity](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/mfa-was-disabled-for-an-azure-identity.md) - [Microsoft 365 DLP policy disabled or removed](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/microsoft-365-dlp-policy-disabled-or-removed.md) - [Microsoft 365 storage services exfiltration activity](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/microsoft-365-storage-services-exfiltration-activity.md) - [Microsoft Configuration Manager device registration and policy request](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/microsoft-configuration-manager-device-registration-and-policy-request.md) - [Microsoft HTML Application Host spawns from CMD or PowerShell](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/microsoft-html-application-host-spawns-from-cmd-or-powershell.md) - [Microsoft Office adds a value to autostart Registry key](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/microsoft-office-adds-a-value-to-autostart-registry-key.md) - [Microsoft Office injects code into a process](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/microsoft-office-injects-code-into-a-process.md) - [Microsoft Office Process Spawning a Suspicious One-Liner](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/microsoft-office-process-spawning-a-suspicious-one-liner.md) - [Microsoft Office process spawns a commonly abused process](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/microsoft-office-process-spawns-a-commonly-abused-process.md) - [Microsoft Office process spawns conhost.exe](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/microsoft-office-process-spawns-conhost-exe.md) - [Microsoft OneDrive enumeration activity](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/microsoft-onedrive-enumeration-activity.md) - [Microsoft OneNote enumeration activity](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/microsoft-onenote-enumeration-activity.md) - [Microsoft SharePoint enumeration activity](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/microsoft-sharepoint-enumeration-activity.md) - [Microsoft Teams application setup policy was modified](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/microsoft-teams-application-setup-policy-was-modified.md) - [Microsoft Teams enumeration activity](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/microsoft-teams-enumeration-activity.md) - [Microsoft Teams external communication policy was modified](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/microsoft-teams-external-communication-policy-was-modified.md) - [Microsoft Teams messages were exported from conversation](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/microsoft-teams-messages-were-exported-from-conversation.md) - [Mimikatz command-line arguments](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/mimikatz-command-line-arguments.md) - [ML artifacts destruction](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/ml-artifacts-destruction.md) - [Modification of NTLM restrictions in the Registry](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/modification-of-ntlm-restrictions-in-the-registry.md) - [Modification of PAM](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/modification-of-pam.md) - [Modification of the AD FS IdentityServer configuration file](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/modification-of-the-ad-fs-identityserver-configuration-file.md) - [Modification or Deletion of an Azure Application Gateway Detected](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/modification-or-deletion-of-an-azure-application-gateway-detected.md) - [Moniker link detected in URL(s)](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/moniker-link-detected-in-url-s.md) - [Mount command was executed from within a Kubernetes pod to list all the attached filesystems](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/mount-command-was-executed-from-within-a-kubernetes-pod-to-list-all-the-attached-filesystems.md) - [MpCmdRun.exe was used to download files into the system](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/mpcmdrun-exe-was-used-to-download-files-into-the-system.md) - [Mshta.exe launched with suspicious arguments](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/mshta-exe-launched-with-suspicious-arguments.md) - [Mshta.exe spawns from a browser process](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/mshta-exe-spawns-from-a-browser-process.md) - [MSI accessed a web page running a server-side script](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/msi-accessed-a-web-page-running-a-server-side-script.md) - [Msiexec execution of an executable from an uncommon remote location](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/msiexec-execution-of-an-executable-from-an-uncommon-remote-location.md) - [Multi region enumeration activity](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/multi-region-enumeration-activity.md) - [Multiple alerts associated with a single RDP connection](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/multiple-alerts-associated-with-a-single-rdp-connection.md) - [Multiple alerts of different MITRE tactics were seen](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/multiple-alerts-of-different-mitre-tactics-were-seen.md) - [Multiple Azure AD admin role removals](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/multiple-azure-ad-admin-role-removals.md) - [Multiple cloud snapshots export](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/multiple-cloud-snapshots-export.md) - [Multiple discovery commands on a Linux host by the same process](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/multiple-discovery-commands-on-a-linux-host-by-the-same-process.md) - [Multiple discovery commands on a Windows host by the same process](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/multiple-discovery-commands-on-a-windows-host-by-the-same-process.md) - [Multiple discovery commands](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/multiple-discovery-commands.md) - [Multiple discovery-like commands](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/multiple-discovery-like-commands.md) - [Multiple failed AWS assume role attempts](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/multiple-failed-aws-assume-role-attempts.md) - [Multiple failed logins from a single IP](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/multiple-failed-logins-from-a-single-ip.md) - [Multiple mail items were accessed in a short period of time](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/multiple-mail-items-were-accessed-in-a-short-period-of-time.md) - [Multiple network-related alerts of different MITRE tactics on the same host](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/multiple-network-related-alerts-of-different-mitre-tactics-on-the-same-host.md) - [Multiple network-related alerts produced by different detectors on the same host](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/multiple-network-related-alerts-produced-by-different-detectors-on-the-same-host.md) - [Multiple Okta MFA requests sent to a user](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/multiple-okta-mfa-requests-sent-to-a-user.md) - [Multiple Rare LOLBIN Process Executions by User](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/multiple-rare-lolbin-process-executions-by-user.md) - [Multiple Rare Process Executions in Organization](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/multiple-rare-process-executions-in-organization.md) - [Multiple risk indicators for a cloud identity](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/multiple-risk-indicators-for-a-cloud-identity.md) - [Multiple Suspicious FTP Login Attempts](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/multiple-suspicious-ftp-login-attempts.md) - [Multiple suspicious user accounts were created](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/multiple-suspicious-user-accounts-were-created.md) - [Multiple TGT requests for users without Kerberos pre-authentication](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/multiple-tgt-requests-for-users-without-kerberos-pre-authentication.md) - [Multiple uncommon SSH Servers with the same Server host key](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/multiple-uncommon-ssh-servers-with-the-same-server-host-key.md) - [Multiple user accounts failed login due to account lockouts](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/multiple-user-accounts-failed-login-due-to-account-lockouts.md) - [Multiple user accounts were deleted](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/multiple-user-accounts-were-deleted.md) - [Multiple users authenticated with weak NTLM to a host](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/multiple-users-authenticated-with-weak-ntlm-to-a-host.md) - [Multiple Weakly-Encrypted Kerberos Tickets Received](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/multiple-weakly-encrypted-kerberos-tickets-received.md) - [Near-empty email from an external sender](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/near-empty-email-from-an-external-sender.md) - [Netcat makes or gets connections](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/netcat-makes-or-gets-connections.md) - [Network sniffing detected in Cloud environment](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/network-sniffing-detected-in-cloud-environment.md) - [New addition to Windows Defender exclusion list](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/new-addition-to-windows-defender-exclusion-list.md) - [New Administrative Behavior](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/new-administrative-behavior.md) - [New cloud identity created with administrative policy](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/new-cloud-identity-created-with-administrative-policy.md) - [New FTP Server](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/new-ftp-server.md) - [New Shared User Account](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/new-shared-user-account.md) - [New Teams application published to the organization catalog](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/new-teams-application-published-to-the-organization-catalog.md) - [Non-browser access to a pastebin-like site](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/non-browser-access-to-a-pastebin-like-site.md) - [NTDS.dit file written by an uncommon executable](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/ntds-dit-file-written-by-an-uncommon-executable.md) - [NTLM Brute Force on a Service Account](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/ntlm-brute-force-on-a-service-account.md) - [NTLM Brute Force on an Administrator Account](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/ntlm-brute-force-on-an-administrator-account.md) - [NTLM Brute Force](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/ntlm-brute-force.md) - [NTLM Hash Harvesting](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/ntlm-hash-harvesting.md) - [NTLM Password Spray](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/ntlm-password-spray.md) - [NTLM Relay](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/ntlm-relay.md) - [Numerous emails sent by a single sender to multiple internal recipients](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/numerous-emails-sent-by-a-single-sender-to-multiple-internal-recipients.md) - [Object versioning was disabled](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/object-versioning-was-disabled.md) - [Office process accessed an unusual .LNK file](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/office-process-accessed-an-unusual-lnk-file.md) - [Office process spawned with suspicious command-line arguments](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/office-process-spawned-with-suspicious-command-line-arguments.md) - [Okta account reset password attempt](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/okta-account-reset-password-attempt.md) - [Okta account unlock by admin](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/okta-account-unlock-by-admin.md) - [Okta account unlock](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/okta-account-unlock.md) - [Okta admin privilege assignment](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/okta-admin-privilege-assignment.md) - [Okta API Token Created](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/okta-api-token-created.md) - [Okta device assignment](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/okta-device-assignment.md) - [Okta FastPass reported phishing attack suspected](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/okta-fastpass-reported-phishing-attack-suspected.md) - [Okta Reported Attack Suspected](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/okta-reported-attack-suspected.md) - [Okta Reported Threat Detected](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/okta-reported-threat-detected.md) - [Okta User Session Impersonation](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/okta-user-session-impersonation.md) - [OneDrive file download](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/onedrive-file-download.md) - [OneDrive file upload](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/onedrive-file-upload.md) - [OneDrive folder creation](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/onedrive-folder-creation.md) - [Outbound email contains file-sharing service link sent to external recipient](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/outbound-email-contains-file-sharing-service-link-sent-to-external-recipient.md) - [Outbound email includes an external BCC recipient observed for the first time](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/outbound-email-includes-an-external-bcc-recipient-observed-for-the-first-time.md) - [Outbound email to an address hosted by a public email service provider](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/outbound-email-to-an-address-hosted-by-a-public-email-service-provider.md) - [Outlook files accessed by an unsigned process](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/outlook-files-accessed-by-an-unsigned-process.md) - [Owner added to Azure application](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/owner-added-to-azure-application.md) - [Owner was added to Azure application](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/owner-was-added-to-azure-application.md) - [Parsing Rule Error](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/parsing-rule-error.md) - [Penetration testing tool activity attempt](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/penetration-testing-tool-activity-attempt.md) - [Permission Groups discovery commands](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/permission-groups-discovery-commands.md) - [Phantom DLL Loading](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/phantom-dll-loading.md) - [PIM privilege member removal](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/pim-privilege-member-removal.md) - [Ping to localhost from an uncommon, unsigned parent process](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/ping-to-localhost-from-an-uncommon-unsigned-parent-process.md) - [PKINIT TGT authentication request](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/pkinit-tgt-authentication-request.md) - [Port Scan](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/port-scan.md) - [Port Sweep](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/port-sweep.md) - [Possible AS-REP Roasting Attack](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/possible-as-rep-roasting-attack.md) - [Possible authentication coercion](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/possible-authentication-coercion.md) - [Possible binary padding using dd](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/possible-binary-padding-using-dd.md) - [Possible Brute-Force attempt](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/possible-brute-force-attempt.md) - [Possible brute force on sudo user](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/possible-brute-force-on-sudo-user.md) - [Possible brute force or configuration change attempt on cytool](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/possible-brute-force-or-configuration-change-attempt-on-cytool.md) - [Possible code downloading from a remote host by Regsvr32](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/possible-code-downloading-from-a-remote-host-by-regsvr32.md) - [Possible collection of screen captures with Windows Problem Steps Recorder](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/possible-collection-of-screen-captures-with-windows-problem-steps-recorder.md) - [Possible compromised machine account](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/possible-compromised-machine-account.md) - [Possible ConsentFix - OAuth Token Theft Detected](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/possible-consentfix-oauth-token-theft-detected.md) - [Possible data exfiltration over a USB storage device](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/possible-data-exfiltration-over-a-usb-storage-device.md) - [Possible data obfuscation](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/possible-data-obfuscation.md) - [Possible DCSync attack](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/possible-dcsync-attack.md) - [Possible DCSync from a non domain controller](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/possible-dcsync-from-a-non-domain-controller.md) - [Possible Distributed File System Namespace Management (DFSNM) abuse](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/possible-distributed-file-system-namespace-management-dfsnm-abuse.md) - [Possible DLL Hijack into a Microsoft process](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/possible-dll-hijack-into-a-microsoft-process.md) - [Possible DLL Search Order Hijacking](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/possible-dll-search-order-hijacking.md) - [Possible Email collection using Outlook RPC](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/possible-email-collection-using-outlook-rpc.md) - [Possible external RDP Brute-Force](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/possible-external-rdp-brute-force.md) - [Possible GPO Enumeration](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/possible-gpo-enumeration.md) - [Possible Impossible Travel Pattern - SSO](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/possible-impossible-travel-pattern-sso.md) - [Possible Insider Threat Activity](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/possible-insider-threat-activity.md) - [Possible internal data exfiltration over a USB storage device](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/possible-internal-data-exfiltration-over-a-usb-storage-device.md) - [Possible IPFS traffic was detected](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/possible-ipfs-traffic-was-detected.md) - [Possible Kerberoasting attack](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/possible-kerberoasting-attack.md) - [Possible Kerberoasting without SPNs](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/possible-kerberoasting-without-spns.md) - [Possible Kerberos relay attack](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/possible-kerberos-relay-attack.md) - [Possible Kerberos User Enumeration](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/possible-kerberos-user-enumeration.md) - [Possible LDAP enumeration by unsigned process](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/possible-ldap-enumeration-by-unsigned-process.md) - [Possible LDAP Enumeration of Microsoft Configuration Manager](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/possible-ldap-enumeration-of-microsoft-configuration-manager.md) - [Possible LDAP Enumeration Tool Usage](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/possible-ldap-enumeration-tool-usage.md) - [Possible malicious .NET compilation started by a commonly abused process](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/possible-malicious-net-compilation-started-by-a-commonly-abused-process.md) - [Possible multistage attack in Microsoft Teams](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/possible-multistage-attack-in-microsoft-teams.md) - [Possible network service discovery via command-line tool](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/possible-network-service-discovery-via-command-line-tool.md) - [Possible network sniffing attempt via tcpdump or tshark](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/possible-network-sniffing-attempt-via-tcpdump-or-tshark.md) - [Possible new DHCP server](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/possible-new-dhcp-server.md) - [Possible Pass-the-Hash](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/possible-pass-the-hash.md) - [Possible path traversal via HTTP request](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/possible-path-traversal-via-http-request.md) - [Possible Persistence via group policy Registry keys](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/possible-persistence-via-group-policy-registry-keys.md) - [Possible phishing attack via Microsoft Teams](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/possible-phishing-attack-via-microsoft-teams.md) - [Possible Privilege Escalation using Delegated MSA account](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/possible-privilege-escalation-using-delegated-msa-account.md) - [Possible RDP session hijacking using tscon.exe](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/possible-rdp-session-hijacking-using-tscon-exe.md) - [Possible Search For Password Files](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/possible-search-for-password-files.md) - [Possible SPN enumeration](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/possible-spn-enumeration.md) - [Possible TGT reuse from different hosts (pass the ticket)](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/possible-tgt-reuse-from-different-hosts-pass-the-ticket.md) - [Possible use of a networking driver for network sniffing](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/possible-use-of-a-networking-driver-for-network-sniffing.md) - [Possible use of IPFS was detected](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/possible-use-of-ipfs-was-detected.md) - [Possible webshell file written by a web server process](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/possible-webshell-file-written-by-a-web-server-process.md) - [Potential creation of persistent cloud credentials](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/potential-creation-of-persistent-cloud-credentials.md) - [Potential DCSync by an unusual user](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/potential-dcsync-by-an-unusual-user.md) - [Potential denial of wallet abusing AI services](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/potential-denial-of-wallet-abusing-ai-services.md) - [Potential extraction of NAA Account Credentials in Microsoft Configuration Manager](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/potential-extraction-of-naa-account-credentials-in-microsoft-configuration-manager.md) - [Potential kubelet impersonation attempt](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/potential-kubelet-impersonation-attempt.md) - [Potential NTLM Relay Attack against a Microsoft Configuration Manager Site Server](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/potential-ntlm-relay-attack-against-a-microsoft-configuration-manager-site-server.md) - [Potential NTLM Relay Attack](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/potential-ntlm-relay-attack.md) - [Potential Okta access limit breach](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/potential-okta-access-limit-breach.md) - [Potential Phishing has been detected](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/potential-phishing-has-been-detected.md) - [Potential SCCM credential harvesting using WMI detected](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/potential-sccm-credential-harvesting-using-wmi-detected.md) - [Potential spoofing of internal domain spotted](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/potential-spoofing-of-internal-domain-spotted.md) - [PowerShell Initiates a Network Connection to GitHub](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/powershell-initiates-a-network-connection-to-github.md) - [PowerShell pfx certificate extraction](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/powershell-pfx-certificate-extraction.md) - [PowerShell running with download in the command line](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/powershell-running-with-download-in-the-command-line.md) - [PowerShell runs suspicious base64-encoded commands](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/powershell-runs-suspicious-base64-encoded-commands.md) - [PowerShell script executed from a temporary directory](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/powershell-script-executed-from-a-temporary-directory.md) - [PowerShell suspicious flags](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/powershell-suspicious-flags.md) - [PowerShell used to export mailbox contents](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/powershell-used-to-export-mailbox-contents.md) - [PowerShell used to remove mailbox export request logs](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/powershell-used-to-remove-mailbox-export-request-logs.md) - [Privileged certificate request via certificate template](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/privileged-certificate-request-via-certificate-template.md) - [Privileged role used by Azure application](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/privileged-role-used-by-azure-application.md) - [Procdump executed from an atypical directory](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/procdump-executed-from-an-atypical-directory.md) - [PsExec was executed with a suspicious command line](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/psexec-was-executed-with-a-suspicious-command-line.md) - [Punycode characters detected in URL(s)](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/punycode-characters-detected-in-url-s.md) - [Python HTTP server started](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/python-http-server-started.md) - [Quarantined email released to recipients](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/quarantined-email-released-to-recipients.md) - [Random-Looking Domain Names](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/random-looking-domain-names.md) - [Rare access to known advertising domains](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/rare-access-to-known-advertising-domains.md) - [Rare AppID usage to a rare destination](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/rare-appid-usage-to-a-rare-destination.md) - [Rare binary connected to a rare cloud resource](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/rare-binary-connected-to-a-rare-cloud-resource.md) - [Rare binary connected to a rare external host](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/rare-binary-connected-to-a-rare-external-host.md) - [Rare communication over email ports to external email server by unsigned process](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/rare-communication-over-email-ports-to-external-email-server-by-unsigned-process.md) - [Rare connection to external IP address or host by an application using RMI-IIOP or LDAP protocol](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/rare-connection-to-external-ip-address-or-host-by-an-application-using-rmi-iiop-or-ldap-protocol.md) - [Rare DCOM RPC activity](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/rare-dcom-rpc-activity.md) - [Rare DLP rule match by user](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/rare-dlp-rule-match-by-user.md) - [Rare file transfer over SMB protocol](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/rare-file-transfer-over-smb-protocol.md) - [Rare LDAP enumeration](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/rare-ldap-enumeration.md) - [Rare LOLBIN Process Execution by User](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/rare-lolbin-process-execution-by-user.md) - [Rare machine account creation](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/rare-machine-account-creation.md) - [Rare MS-Update Server was detected](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/rare-ms-update-server-was-detected.md) - [Rare MS-Update traffic over HTTP](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/rare-ms-update-traffic-over-http.md) - [Rare NTLM Access By User To Host](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/rare-ntlm-access-by-user-to-host.md) - [Rare NTLM Usage by User](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/rare-ntlm-usage-by-user.md) - [Rare process accessed a Keychain file](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/rare-process-accessed-a-keychain-file.md) - [Rare process created an SSH session to an uncommon cloud resource](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/rare-process-created-an-ssh-session-to-an-uncommon-cloud-resource.md) - [Rare process created an SSH session to an uncommon external host](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/rare-process-created-an-ssh-session-to-an-uncommon-external-host.md) - [Rare process executed by an AppleScript](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/rare-process-executed-by-an-applescript.md) - [Rare process execution by user](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/rare-process-execution-by-user.md) - [Rare process execution in organization](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/rare-process-execution-in-organization.md) - [Rare process spawned by srvany.exe](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/rare-process-spawned-by-srvany-exe.md) - [Rare process with VNC server capabilities started](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/rare-process-with-vnc-server-capabilities-started.md) - [Rare RDP session to a remote host](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/rare-rdp-session-to-a-remote-host.md) - [Rare Remote Service (SVCCTL) RPC activity](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/rare-remote-service-svcctl-rpc-activity.md) - [Rare scheduled task created](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/rare-scheduled-task-created.md) - [Rare Scheduled Task RPC activity from a rarely seen host](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/rare-scheduled-task-rpc-activity-from-a-rarely-seen-host.md) - [Rare Scheduled Task RPC activity](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/rare-scheduled-task-rpc-activity.md) - [Rare security product signed executable executed in the network](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/rare-security-product-signed-executable-executed-in-the-network.md) - [Rare service DLL was added to the registry](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/rare-service-dll-was-added-to-the-registry.md) - [Rare signature signed executable executed in the network](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/rare-signature-signed-executable-executed-in-the-network.md) - [Rare SMB session to a remote host](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/rare-smb-session-to-a-remote-host.md) - [Rare SMTP/S Session](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/rare-smtp-s-session.md) - [Rare SSH Session](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/rare-ssh-session.md) - [Rare Unix process divided files by size](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/rare-unix-process-divided-files-by-size.md) - [Rare unsigned process execution by scheduled task](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/rare-unsigned-process-execution-by-scheduled-task.md) - [Rare Unsigned Process Spawned by Office Process Under Suspicious Directory](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/rare-unsigned-process-spawned-by-office-process-under-suspicious-directory.md) - [Rare Windows Remote Management (WinRM) HTTP Activity](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/rare-windows-remote-management-winrm-http-activity.md) - [Rare WinRM Session](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/rare-winrm-session.md) - [Rarely seen sender address in the organization](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/rarely-seen-sender-address-in-the-organization.md) - [Rarely seen sender domain in the organization](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/rarely-seen-sender-domain-in-the-organization.md) - [RDP Connection to localhost](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/rdp-connection-to-localhost.md) - [RDP connections enabled remotely via Registry](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/rdp-connections-enabled-remotely-via-registry.md) - [RDP from an unmanaged endpoint in a typically managed subnet](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/rdp-from-an-unmanaged-endpoint-in-a-typically-managed-subnet.md) - [Reading bash command history file](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/reading-bash-command-history-file.md) - [Recurring access to rare domain](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/recurring-access-to-rare-domain.md) - [Recurring access to rare IP](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/recurring-access-to-rare-ip.md) - [Recurring rare domain access from an unsigned process](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/recurring-rare-domain-access-from-an-unsigned-process.md) - [Recurring rare domain access to dynamic DNS domain](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/recurring-rare-domain-access-to-dynamic-dns-domain.md) - [Registration of Uncommon .NET Services and/or Assemblies](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/registration-of-uncommon-net-services-and-or-assemblies.md) - [Registry credentials extraction](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/registry-credentials-extraction.md) - [Remote account enumeration](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/remote-account-enumeration.md) - [Remote code execution into Kubernetes Pod](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/remote-code-execution-into-kubernetes-pod.md) - [Remote command execution via wmic.exe](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/remote-command-execution-via-wmic-exe.md) - [Remote DCOM command execution](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/remote-dcom-command-execution.md) - [Remote PsExec-like command execution](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/remote-psexec-like-command-execution.md) - [Remote service command execution from an uncommon source](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/remote-service-command-execution-from-an-uncommon-source.md) - [Remote service start from an uncommon source](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/remote-service-start-from-an-uncommon-source.md) - [Remote usage of an App engine Service Account token](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/remote-usage-of-an-app-engine-service-account-token.md) - [Remote usage of an AWS service token](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/remote-usage-of-an-aws-service-token.md) - [Remote usage of an Azure Managed Identity token](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/remote-usage-of-an-azure-managed-identity-token.md) - [Remote usage of an Azure Service Principal token](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/remote-usage-of-an-azure-service-principal-token.md) - [Remote usage of AWS Lambda's role](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/remote-usage-of-aws-lambda-s-role.md) - [Remote usage of EC2 token](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/remote-usage-of-ec2-token.md) - [Remote usage of VM Service Account token](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/remote-usage-of-vm-service-account-token.md) - [Remote WMI process execution](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/remote-wmi-process-execution.md) - [Removal of an Azure Owner from an Application or Service Principal](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/removal-of-an-azure-owner-from-an-application-or-service-principal.md) - [Retrieval of cloud compute EC2 instance user data](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/retrieval-of-cloud-compute-ec2-instance-user-data.md) - [Retrieval of kubelet credentials](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/retrieval-of-kubelet-credentials.md) - [Run downloaded script using pipe](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/run-downloaded-script-using-pipe.md) - [Rundll32.exe executes a rare unsigned module](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/rundll32-exe-executes-a-rare-unsigned-module.md) - [Rundll32.exe running with no command-line arguments](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/rundll32-exe-running-with-no-command-line-arguments.md) - [Rundll32.exe spawns conhost.exe](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/rundll32-exe-spawns-conhost-exe.md) - [S3 configuration deletion](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/s3-configuration-deletion.md) - [S3 public exposure followed by data access](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/s3-public-exposure-followed-by-data-access.md) - [SAAS - Email was reported by the user or administrator as a phishing attempt](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/saas-email-was-reported-by-the-user-or-administrator-as-a-phishing-attempt.md) - [SaaS suspicious external domain user activity](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/saas-suspicious-external-domain-user-activity.md) - [SCCM log files enumeration](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/sccm-log-files-enumeration.md) - [Scheduled Task hidden by registry modification](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/scheduled-task-hidden-by-registry-modification.md) - [Scrcons.exe Rare Child Process](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/scrcons-exe-rare-child-process.md) - [Screensaver process executed from Users or temporary folder](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/screensaver-process-executed-from-users-or-temporary-folder.md) - [Script file added to startup-related Registry keys](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/script-file-added-to-startup-related-registry-keys.md) - [Scripting engine connected to a rare external host](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/scripting-engine-connected-to-a-rare-external-host.md) - [SecureBoot was disabled](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/secureboot-was-disabled.md) - [Security object deletion in Google Workspace Admin Console](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/security-object-deletion-in-google-workspace-admin-console.md) - [Security tools detection attempt](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/security-tools-detection-attempt.md) - [Sender name used by multiple addresses across multiple domains](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/sender-name-used-by-multiple-addresses-across-multiple-domains.md) - [Sending unusual file(s) to an external address](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/sending-unusual-file-s-to-an-external-address.md) - [Sensitive account password reset attempt](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/sensitive-account-password-reset-attempt.md) - [Sensitive browser credential files accessed by a rare non browser process](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/sensitive-browser-credential-files-accessed-by-a-rare-non-browser-process.md) - [Sensitive Exchange mail sent to external users](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/sensitive-exchange-mail-sent-to-external-users.md) - [Serial console access was enabled in AWS account](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/serial-console-access-was-enabled-in-aws-account.md) - [Service execution via sc.exe](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/service-execution-via-sc-exe.md) - [Service ticket request with a spoofed sAMAccountName](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/service-ticket-request-with-a-spoofed-samaccountname.md) - [SES Production Access Requested](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/ses-production-access-requested.md) - [Setting Windows Auto Logon by uncommon process](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/setting-windows-auto-logon-by-uncommon-process.md) - [Setuid and Setgid file bit manipulation](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/setuid-and-setgid-file-bit-manipulation.md) - [SharePoint Site Collection admin group addition](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/sharepoint-site-collection-admin-group-addition.md) - [Short-lived Azure AD user account](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/short-lived-azure-ad-user-account.md) - [Short-lived user account](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/short-lived-user-account.md) - [Signed process creates a scheduled task via file access](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/signed-process-creates-a-scheduled-task-via-file-access.md) - [Signed process performed an unpopular DLL injection](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/signed-process-performed-an-unpopular-dll-injection.md) - [Signed process performed an unpopular injection](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/signed-process-performed-an-unpopular-injection.md) - [Single account excessively locked out](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/single-account-excessively-locked-out.md) - [Single IP accessed mail items of multiple users](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/single-ip-accessed-mail-items-of-multiple-users.md) - [SMB Traffic from Non-Standard Process](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/smb-traffic-from-non-standard-process.md) - [Soft delete of cloud storage configuration was disabled](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/soft-delete-of-cloud-storage-configuration-was-disabled.md) - [Space after filename](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/space-after-filename.md) - [Spam Bot Traffic](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/spam-bot-traffic.md) - [SPNs cleared from a machine account](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/spns-cleared-from-a-machine-account.md) - [SSH authentication brute force attempts](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/ssh-authentication-brute-force-attempts.md) - [SSO authentication attempt by a honey user](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/sso-authentication-attempt-by-a-honey-user.md) - [SSO authentication by a machine account](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/sso-authentication-by-a-machine-account.md) - [SSO authentication by a service account](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/sso-authentication-by-a-service-account.md) - [SSO Brute Force](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/sso-brute-force.md) - [SSO Password Spray](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/sso-password-spray.md) - [SSO with abnormal operating system](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/sso-with-abnormal-operating-system.md) - [SSO with abnormal user agent](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/sso-with-abnormal-user-agent.md) - [SSO with new operating system](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/sso-with-new-operating-system.md) - [Storage enumeration activity](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/storage-enumeration-activity.md) - [Stored credentials exported using credwiz.exe](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/stored-credentials-exported-using-credwiz-exe.md) - [Subdomain Fuzzing](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/subdomain-fuzzing.md) - [Successful unusual guest user invitation](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/successful-unusual-guest-user-invitation.md) - [Sudden spike in outbound email volume](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/sudden-spike-in-outbound-email-volume.md) - [Sudoedit Brute force attempt](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/sudoedit-brute-force-attempt.md) - [SUID/GUID permission discovery](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/suid-guid-permission-discovery.md) - [Suspicious access of the System Management Container](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/suspicious-access-of-the-system-management-container.md) - [Suspicious access to cloud credential files](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/suspicious-access-to-cloud-credential-files.md) - [Suspicious access to Kubernetes API with kubelet credentials](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/suspicious-access-to-kubernetes-api-with-kubelet-credentials.md) - [Suspicious access to shadow file](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/suspicious-access-to-shadow-file.md) - [Suspicious account attribute modification that matches that of another account](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/suspicious-account-attribute-modification-that-matches-that-of-another-account.md) - [Suspicious active setup registered](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/suspicious-active-setup-registered.md) - [Suspicious activity indicating a potential abuse of a cloud-native email service](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/suspicious-activity-indicating-a-potential-abuse-of-a-cloud-native-email-service.md) - [Suspicious activity on logging bucket](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/suspicious-activity-on-logging-bucket.md) - [Suspicious AI Dataset Download](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/suspicious-ai-dataset-download.md) - [Suspicious AI Dataset Label Modification](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/suspicious-ai-dataset-label-modification.md) - [Suspicious AI model usage from a Tor exit node](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/suspicious-ai-model-usage-from-a-tor-exit-node.md) - [Suspicious AMSI decode attempt](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/suspicious-amsi-decode-attempt.md) - [Suspicious API call from a Tor exit node](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/suspicious-api-call-from-a-tor-exit-node.md) - [Suspicious authentication package registered](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/suspicious-authentication-package-registered.md) - [Suspicious authentication with Azure Password Hash Sync user](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/suspicious-authentication-with-azure-password-hash-sync-user.md) - [Suspicious AWS SSM parameters retrieval activity](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/suspicious-aws-ssm-parameters-retrieval-activity.md) - [Suspicious Azure AD interactive sign-in using PowerShell](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/suspicious-azure-ad-interactive-sign-in-using-powershell.md) - [Suspicious Azure enumeration activity](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/suspicious-azure-enumeration-activity.md) - [Suspicious brand affiliation detected](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/suspicious-brand-affiliation-detected.md) - [Suspicious certificate template modification](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/suspicious-certificate-template-modification.md) - [Suspicious Certutil AD CS contact](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/suspicious-certutil-ad-cs-contact.md) - [Suspicious certutil command line](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/suspicious-certutil-command-line.md) - [Suspicious cloud compute instance SSH keys modification attempt](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/suspicious-cloud-compute-instance-ssh-keys-modification-attempt.md) - [Suspicious cloud user data modification attempt followed by VM restart](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/suspicious-cloud-user-data-modification-attempt-followed-by-vm-restart.md) - [Suspicious container orchestration job](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/suspicious-container-orchestration-job.md) - [Suspicious container reconnaissance activity in a Kubernetes pod](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/suspicious-container-reconnaissance-activity-in-a-kubernetes-pod.md) - [Suspicious container runtime connection from within a Kubernetes Pod](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/suspicious-container-runtime-connection-from-within-a-kubernetes-pod.md) - [Suspicious curl user agent](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/suspicious-curl-user-agent.md) - [Suspicious data encryption](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/suspicious-data-encryption.md) - [Suspicious disablement of the Windows Firewall using PowerShell commands](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/suspicious-disablement-of-the-windows-firewall-using-powershell-commands.md) - [Suspicious disablement of the Windows Firewall](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/suspicious-disablement-of-the-windows-firewall.md) - [Suspicious DKIM Result](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/suspicious-dkim-result.md) - [Suspicious DMARC result](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/suspicious-dmarc-result.md) - [Suspicious DNS traffic](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/suspicious-dns-traffic.md) - [Suspicious dNSHostName attribute change to DC name](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/suspicious-dnshostname-attribute-change-to-dc-name.md) - [Suspicious docker image download from an unusual repository](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/suspicious-docker-image-download-from-an-unusual-repository.md) - [Suspicious domain user account creation](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/suspicious-domain-user-account-creation.md) - [Suspicious DotNet log file created](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/suspicious-dotnet-log-file-created.md) - [Suspicious dump of ntds.dit using Shadow Copy with ntdsutil/vssadmin](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/suspicious-dump-of-ntds-dit-using-shadow-copy-with-ntdsutil-vssadmin.md) - [Suspicious EBS snapshots deletion](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/suspicious-ebs-snapshots-deletion.md) - [Suspicious Encrypting File System Remote call (EFSRPC) to domain controller](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/suspicious-encrypting-file-system-remote-call-efsrpc-to-domain-controller.md) - [Suspicious Entra ID Device Code Authentication Flow](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/suspicious-entra-id-device-code-authentication-flow.md) - [Suspicious External RDP Login](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/suspicious-external-rdp-login.md) - [Suspicious failed HTTP request - potential Spring4Shell exploit](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/suspicious-failed-http-request-potential-spring4shell-exploit.md) - [Suspicious heavy allocation of compute resources - possible mining activity](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/suspicious-heavy-allocation-of-compute-resources-possible-mining-activity.md) - [Suspicious hidden user created](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/suspicious-hidden-user-created.md) - [Suspicious HTTP parameters detected](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/suspicious-http-parameters-detected.md) - [Suspicious ICMP packet](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/suspicious-icmp-packet.md) - [Suspicious ICMP traffic that resembles smurf attack](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/suspicious-icmp-traffic-that-resembles-smurf-attack.md) - [Suspicious identity downloaded multiple objects from a bucket](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/suspicious-identity-downloaded-multiple-objects-from-a-bucket.md) - [Suspicious Kerberos Pre-Auth Failures by Host](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/suspicious-kerberos-pre-auth-failures-by-host.md) - [Suspicious Kubernetes pod token access](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/suspicious-kubernetes-pod-token-access.md) - [Suspicious LDAP queries followed by shared folder access](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/suspicious-ldap-queries-followed-by-shared-folder-access.md) - [Suspicious LDAP search query executed](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/suspicious-ldap-search-query-executed.md) - [Suspicious MFA request reported by user in Entra ID](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/suspicious-mfa-request-reported-by-user-in-entra-id.md) - [Suspicious ML Model Download](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/suspicious-ml-model-download.md) - [Suspicious modification of the AdminSDHolder's ACL](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/suspicious-modification-of-the-adminsdholder-s-acl.md) - [Suspicious module load using direct syscall](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/suspicious-module-load-using-direct-syscall.md) - [Suspicious .NET process loads an MSBuild DLL](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/suspicious-net-process-loads-an-msbuild-dll.md) - [Suspicious Network Connection Originating from AWS SSM Agent](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/suspicious-network-connection-originating-from-aws-ssm-agent.md) - [Suspicious NTLM authentication with machine account](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/suspicious-ntlm-authentication-with-machine-account.md) - [Suspicious OAuth application was authorized in Google Workspace](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/suspicious-oauth-application-was-authorized-in-google-workspace.md) - [Suspicious objects encryption in an AWS bucket](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/suspicious-objects-encryption-in-an-aws-bucket.md) - [Suspicious PowerShell Command Line](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/suspicious-powershell-command-line.md) - [Suspicious PowerShell Enumeration of Running Processes](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/suspicious-powershell-enumeration-of-running-processes.md) - [Suspicious PowerSploit's recon module (PowerView) net function was executed](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/suspicious-powersploit-s-recon-module-powerview-net-function-was-executed.md) - [Suspicious PowerSploit's recon module (PowerView) used to search for exposed hosts](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/suspicious-powersploit-s-recon-module-powerview-used-to-search-for-exposed-hosts.md) - [Suspicious print processor registered](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/suspicious-print-processor-registered.md) - [Suspicious Print System Remote Protocol usage by a process](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/suspicious-print-system-remote-protocol-usage-by-a-process.md) - [Suspicious process accessed a site masquerading as Google](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/suspicious-process-accessed-a-site-masquerading-as-google.md) - [Suspicious process accessed certificate files](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/suspicious-process-accessed-certificate-files.md) - [Suspicious process executed with a high integrity level](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/suspicious-process-executed-with-a-high-integrity-level.md) - [Suspicious process execution from tmp folder](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/suspicious-process-execution-from-tmp-folder.md) - [Suspicious process execution in a privileged container](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/suspicious-process-execution-in-a-privileged-container.md) - [Suspicious process loads a known PowerShell module](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/suspicious-process-loads-a-known-powershell-module.md) - [Suspicious process modified RC script file](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/suspicious-process-modified-rc-script-file.md) - [Suspicious Process Spawned by Adobe Reader](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/suspicious-process-spawned-by-adobe-reader.md) - [Suspicious Process Spawned by wininit.exe](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/suspicious-process-spawned-by-wininit-exe.md) - [Suspicious proxy environment variable setting](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/suspicious-proxy-environment-variable-setting.md) - [Suspicious reconnaissance using LDAP](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/suspicious-reconnaissance-using-ldap.md) - [Suspicious runonce.exe parent process](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/suspicious-runonce-exe-parent-process.md) - [Suspicious RunOnce Parent Process](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/suspicious-runonce-parent-process.md) - [Suspicious SaaS API call from a Tor exit node](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/suspicious-saas-api-call-from-a-tor-exit-node.md) - [Suspicious sAMAccountName change](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/suspicious-samaccountname-change.md) - [Suspicious SearchProtocolHost.exe parent process](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/suspicious-searchprotocolhost-exe-parent-process.md) - [Suspicious secrets dump activity](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/suspicious-secrets-dump-activity.md) - [Suspicious sender exhibiting automated sending patterns](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/suspicious-sender-exhibiting-automated-sending-patterns.md) - [Suspicious sending domain with sender address randomization](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/suspicious-sending-domain-with-sender-address-randomization.md) - [Suspicious setspn.exe execution](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/suspicious-setspn-exe-execution.md) - [Suspicious SMB connection from domain controller](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/suspicious-smb-connection-from-domain-controller.md) - [Suspicious SPF Result](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/suspicious-spf-result.md) - [Suspicious SSH Downgrade](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/suspicious-ssh-downgrade.md) - [Suspicious sshpass command execution](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/suspicious-sshpass-command-execution.md) - [Suspicious SSO access from ASN](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/suspicious-sso-access-from-asn.md) - [Suspicious SSO authentication](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/suspicious-sso-authentication.md) - [Suspicious successful RDP connection to localhost](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/suspicious-successful-rdp-connection-to-localhost.md) - [Suspicious systemd timer activity](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/suspicious-systemd-timer-activity.md) - [Suspicious theme and sentiment in email](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/suspicious-theme-and-sentiment-in-email.md) - [Suspicious time provider registered](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/suspicious-time-provider-registered.md) - [Suspicious Udev driver rule execution manipulation](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/suspicious-udev-driver-rule-execution-manipulation.md) - [Suspicious Unicode character detected in email](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/suspicious-unicode-character-detected-in-email.md) - [Suspicious usage of File Server Remote VSS Protocol (FSRVP)](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/suspicious-usage-of-file-server-remote-vss-protocol-fsrvp.md) - [Suspicious usage of Microsoft's Active Directory PowerShell module remote discovery cmdlet](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/suspicious-usage-of-microsoft-s-active-directory-powershell-module-remote-discovery-cmdlet.md) - [Svchost.exe loads a rare unsigned module](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/svchost-exe-loads-a-rare-unsigned-module.md) - [System information discovery via psinfo.exe](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/system-information-discovery-via-psinfo-exe.md) - [System profiling WMI query execution](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/system-profiling-wmi-query-execution.md) - [System shutdown or reboot](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/system-shutdown-or-reboot.md) - [Tampering with Internet Explorer Protected Mode configuration](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/tampering-with-internet-explorer-protected-mode-configuration.md) - [Tampering with the Windows User Account Controls (UAC) configuration](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/tampering-with-the-windows-user-account-controls-uac-configuration.md) - [TGT request with a spoofed sAMAccountName - Event log](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/tgt-request-with-a-spoofed-samaccountname-event-log.md) - [TGT request with a spoofed sAMAccountName - Network](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/tgt-request-with-a-spoofed-samaccountname-network.md) - [The CA policy EditFlags was queried](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/the-ca-policy-editflags-was-queried.md) - [The Linux system firewall was disabled](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/the-linux-system-firewall-was-disabled.md) - [Training simulation email detected](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/training-simulation-email-detected.md) - [Uncommon access to cloud platforms' sensitive files by a scripting engine](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/uncommon-access-to-cloud-platforms-sensitive-files-by-a-scripting-engine.md) - [Uncommon access to /etc/passwd](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/uncommon-access-to-etc-passwd.md) - [Uncommon access to Microsoft Teams cookies files](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/uncommon-access-to-microsoft-teams-cookies-files.md) - [Uncommon access to Microsoft Teams credential files](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/uncommon-access-to-microsoft-teams-credential-files.md) - [Uncommon AppleScript containing a potential obfuscation technique was executed](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/uncommon-applescript-containing-a-potential-obfuscation-technique-was-executed.md) - [Uncommon AppleScript containing a potential persistence command was executed via the command line](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/uncommon-applescript-containing-a-potential-persistence-command-was-executed-via-the-command-line.md) - [Uncommon AppleScript designed to access credential files was executed via the command line](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/uncommon-applescript-designed-to-access-credential-files-was-executed-via-the-command-line.md) - [Uncommon AppleScript designed to access cryptocurrency wallet data was executed via the command line](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/uncommon-applescript-designed-to-access-cryptocurrency-wallet-data-was-executed-via-the-command-line.md) - [Uncommon AppleScript designed to access sensitive application data was executed via the command line](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/uncommon-applescript-designed-to-access-sensitive-application-data-was-executed-via-the-command-line.md) - [Uncommon AppleScript designed to capture screen or clipboard data was executed via the command line](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/uncommon-applescript-designed-to-capture-screen-or-clipboard-data-was-executed-via-the-command-line.md) - [Uncommon AppleScript potentially utilizes credential-grabbing techniques to steal user passwords](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/uncommon-applescript-potentially-utilizes-credential-grabbing-techniques-to-steal-user-passwords.md) - [Uncommon AppleScript was executed via the command line to contact an external server](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/uncommon-applescript-was-executed-via-the-command-line-to-contact-an-external-server.md) - [Uncommon AppleScript with a potential defense-evasion command was executed via the command line](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/uncommon-applescript-with-a-potential-defense-evasion-command-was-executed-via-the-command-line.md) - [Uncommon AppleScript with a potential discovery command was executed via the command line](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/uncommon-applescript-with-a-potential-discovery-command-was-executed-via-the-command-line.md) - [Uncommon ARP cache listing via arp.exe](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/uncommon-arp-cache-listing-via-arp-exe.md) - [Uncommon AT task-job creation by user](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/uncommon-at-task-job-creation-by-user.md) - [Uncommon attempt at discovering a sensitive file](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/uncommon-attempt-at-discovering-a-sensitive-file.md) - [Uncommon attempt at grabbing credentials from a sensitive file](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/uncommon-attempt-at-grabbing-credentials-from-a-sensitive-file.md) - [Uncommon attempt to clear shell history](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/uncommon-attempt-to-clear-shell-history.md) - [Uncommon Azure Cosmos DB master key read by identity](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/uncommon-azure-cosmos-db-master-key-read-by-identity.md) - [Uncommon browser extension loaded](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/uncommon-browser-extension-loaded.md) - [Uncommon cloud CLI tool usage](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/uncommon-cloud-cli-tool-usage.md) - [Uncommon command was executed on a device](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/uncommon-command-was-executed-on-a-device.md) - [Uncommon communication to an instant messaging server](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/uncommon-communication-to-an-instant-messaging-server.md) - [Uncommon creation or access operation of sensitive shadow copy](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/uncommon-creation-or-access-operation-of-sensitive-shadow-copy.md) - [Uncommon DLL-sideloading from a logical CD-ROM (ISO) device](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/uncommon-dll-sideloading-from-a-logical-cd-rom-iso-device.md) - [Uncommon DotNet module load relationship](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/uncommon-dotnet-module-load-relationship.md) - [Uncommon driver loaded](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/uncommon-driver-loaded.md) - [Uncommon execution of ODBCConf](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/uncommon-execution-of-odbcconf.md) - [Uncommon file access over WebDAV](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/uncommon-file-access-over-webdav.md) - [Uncommon GetClipboardData API function invocation of a possible information stealer](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/uncommon-getclipboarddata-api-function-invocation-of-a-possible-information-stealer.md) - [Uncommon increase in Azure Microsoft Graph API request sizes](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/uncommon-increase-in-azure-microsoft-graph-api-request-sizes.md) - [Uncommon IP Configuration Listing via ipconfig.exe](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/uncommon-ip-configuration-listing-via-ipconfig-exe.md) - [Uncommon jsp file write by a Java process](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/uncommon-jsp-file-write-by-a-java-process.md) - [Uncommon kernel module load](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/uncommon-kernel-module-load.md) - [Uncommon Launch Agent persistency was registered or modified](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/uncommon-launch-agent-persistency-was-registered-or-modified.md) - [Uncommon Launch Daemon persistency was registered or modified](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/uncommon-launch-daemon-persistency-was-registered-or-modified.md) - [Uncommon Linux process communication to a rare external host](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/uncommon-linux-process-communication-to-a-rare-external-host.md) - [Uncommon Linux remote shell command execution](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/uncommon-linux-remote-shell-command-execution.md) - [Uncommon Linux shell command execution](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/uncommon-linux-shell-command-execution.md) - [Uncommon local scheduled task creation via schtasks.exe](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/uncommon-local-scheduled-task-creation-via-schtasks-exe.md) - [Uncommon login item persistency was registered or modified](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/uncommon-login-item-persistency-was-registered-or-modified.md) - [Uncommon macOS process communication to a rare external host](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/uncommon-macos-process-communication-to-a-rare-external-host.md) - [Uncommon macOS shell command execution](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/uncommon-macos-shell-command-execution.md) - [Uncommon Managed Object Format (MOF) compiler usage](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/uncommon-managed-object-format-mof-compiler-usage.md) - [Uncommon msiexec execution of an arbitrary file from a remote location](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/uncommon-msiexec-execution-of-an-arbitrary-file-from-a-remote-location.md) - [Uncommon net group command execution](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/uncommon-net-group-command-execution.md) - [Uncommon net localgroup command execution](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/uncommon-net-localgroup-command-execution.md) - [Uncommon network connection under an untrusted and newly created causality actor](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/uncommon-network-connection-under-an-untrusted-and-newly-created-causality-actor.md) - [Uncommon network connection under an untrusted causality actor](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/uncommon-network-connection-under-an-untrusted-causality-actor.md) - [Uncommon network tunnel creation](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/uncommon-network-tunnel-creation.md) - [Uncommon Node.js package initiated communication to an external host](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/uncommon-node-js-package-initiated-communication-to-an-external-host.md) - [Uncommon NtWriteVirtualMemoryRemote API invocation with a PE header buffer](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/uncommon-ntwritevirtualmemoryremote-api-invocation-with-a-pe-header-buffer.md) - [Uncommon PowerShell commands used to create or alter scheduled task parameters](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/uncommon-powershell-commands-used-to-create-or-alter-scheduled-task-parameters.md) - [Uncommon RDP connection](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/uncommon-rdp-connection.md) - [Uncommon recurring rare external host access](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/uncommon-recurring-rare-external-host-access.md) - [Uncommon remote monitoring and management tool](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/uncommon-remote-monitoring-and-management-tool.md) - [Uncommon remote scheduled task creation](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/uncommon-remote-scheduled-task-creation.md) - [Uncommon remote service start via sc.exe](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/uncommon-remote-service-start-via-sc-exe.md) - [Uncommon reverse SSH tunnel to external domain/ip](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/uncommon-reverse-ssh-tunnel-to-external-domain-ip.md) - [Uncommon routing table listing via route.exe](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/uncommon-routing-table-listing-via-route-exe.md) - [Uncommon Security Support Provider (SSP) registered via a registry key](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/uncommon-security-support-provider-ssp-registered-via-a-registry-key.md) - [Uncommon sensitive filesystem registry hive access](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/uncommon-sensitive-filesystem-registry-hive-access.md) - [Uncommon sensitive registry hive dump](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/uncommon-sensitive-registry-hive-dump.md) - [Uncommon Service Create/Config](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/uncommon-service-create-config.md) - [Uncommon service stop operation](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/uncommon-service-stop-operation.md) - [Uncommon SetWindowsHookEx API invocation of a possible keylogger](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/uncommon-setwindowshookex-api-invocation-of-a-possible-keylogger.md) - [Uncommon signed process execution by scheduled task](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/uncommon-signed-process-execution-by-scheduled-task.md) - [Uncommon SQL like command line](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/uncommon-sql-like-command-line.md) - [Uncommon SSH session was established](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/uncommon-ssh-session-was-established.md) - [Uncommon URL domain(s) in your organization detected in email](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/uncommon-url-domain-s-in-your-organization-detected-in-email.md) - [Uncommon user management via net command](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/uncommon-user-management-via-net-command.md) - [Uncommon VNC server communication](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/uncommon-vnc-server-communication.md) - [Uncommon WPAD queries](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/uncommon-wpad-queries.md) - [Unicode RTL Override Character](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/unicode-rtl-override-character.md) - [Unique client computer model was detected via MS-Update protocol](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/unique-client-computer-model-was-detected-via-ms-update-protocol.md) - [Unknown DLL was added to the AD FS Global Assembly Cache path](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/unknown-dll-was-added-to-the-ad-fs-global-assembly-cache-path.md) - [Unpopular rsync process execution](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/unpopular-rsync-process-execution.md) - [Unprivileged process opened a registry hive](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/unprivileged-process-opened-a-registry-hive.md) - [Unrecognized internal address (AAD mismatch)](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/unrecognized-internal-address-aad-mismatch.md) - [Unsigned and unpopular process performed a DLL injection](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/unsigned-and-unpopular-process-performed-a-dll-injection.md) - [Unsigned and unpopular process performed an injection](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/unsigned-and-unpopular-process-performed-an-injection.md) - [Unsigned DLL Hijack into a Microsoft process](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/unsigned-dll-hijack-into-a-microsoft-process.md) - [Unsigned DLL Side-Loading](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/unsigned-dll-side-loading.md) - [Unsigned process creates a scheduled task via file access](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/unsigned-process-creates-a-scheduled-task-via-file-access.md) - [Unsigned process injecting into a Windows system binary with no command line](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/unsigned-process-injecting-into-a-windows-system-binary-with-no-command-line.md) - [Unsigned process running from a temporary directory](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/unsigned-process-running-from-a-temporary-directory.md) - [Untrusted process contacted LLM API](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/untrusted-process-contacted-llm-api.md) - [Unusual access to Microsoft 365 storage services](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/unusual-access-to-microsoft-365-storage-services.md) - [Unusual access to the AD Sync credential files](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/unusual-access-to-the-ad-sync-credential-files.md) - [Unusual access to the Windows Internal Database on an ADFS server](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/unusual-access-to-the-windows-internal-database-on-an-adfs-server.md) - [Unusual ADConnect database file access](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/unusual-adconnect-database-file-access.md) - [Unusual ADFS Remote Synchronization network connections from non-ADFS server](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/unusual-adfs-remote-synchronization-network-connections-from-non-adfs-server.md) - [Unusual AI dataset modification](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/unusual-ai-dataset-modification.md) - [Unusual AI Knowledge Base Modification](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/unusual-ai-knowledge-base-modification.md) - [Unusual AI model invocation](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/unusual-ai-model-invocation.md) - [Unusual AI RAG Knowledge Base Modification](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/unusual-ai-rag-knowledge-base-modification.md) - [Unusual attachment volume in outbound emails](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/unusual-attachment-volume-in-outbound-emails.md) - [Unusual AWS Bedrock model access request](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/unusual-aws-bedrock-model-access-request.md) - [Unusual AWS CLI/SDK activity](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/unusual-aws-cli-sdk-activity.md) - [Unusual AWS credentials creation](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/unusual-aws-credentials-creation.md) - [Unusual AWS S3 objects deletion](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/unusual-aws-s3-objects-deletion.md) - [Unusual AWS SageMaker notebook access](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/unusual-aws-sagemaker-notebook-access.md) - [Unusual AWS systems manager activity](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/unusual-aws-systems-manager-activity.md) - [Unusual AWS user added to group](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/unusual-aws-user-added-to-group.md) - [Unusual Azure AD sync module load](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/unusual-azure-ad-sync-module-load.md) - [Unusual certificate management activity](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/unusual-certificate-management-activity.md) - [Unusual CertLog Remote File Write](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/unusual-certlog-remote-file-write.md) - [Unusual CIM repository file access](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/unusual-cim-repository-file-access.md) - [Unusual cloud identity impersonation](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/unusual-cloud-identity-impersonation.md) - [Unusual cloud Instance Metadata Service (IMDS) access](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/unusual-cloud-instance-metadata-service-imds-access.md) - [Unusual compressed file password protection](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/unusual-compressed-file-password-protection.md) - [Unusual Conditional Access operation for an identity](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/unusual-conditional-access-operation-for-an-identity.md) - [Unusual cross projects activity](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/unusual-cross-projects-activity.md) - [Unusual DB process spawning a shell](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/unusual-db-process-spawning-a-shell.md) - [Unusual display name in From header](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/unusual-display-name-in-from-header.md) - [Unusual Encrypting File System Remote call (EFSRPC) to domain controller](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/unusual-encrypting-file-system-remote-call-efsrpc-to-domain-controller.md) - [Unusual exec into a Kubernetes Pod](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/unusual-exec-into-a-kubernetes-pod.md) - [Unusual file-sharing links for mailbox owner](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/unusual-file-sharing-links-for-mailbox-owner.md) - [Unusual hostname for the sending mail server in the email headers](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/unusual-hostname-for-the-sending-mail-server-in-the-email-headers.md) - [Unusual IAM enumeration activity by a non-user Identity](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/unusual-iam-enumeration-activity-by-a-non-user-identity.md) - [Unusual Identity and Access Management (IAM) activity](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/unusual-identity-and-access-management-iam-activity.md) - [Unusual internal access to network device management interface](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/unusual-internal-access-to-network-device-management-interface.md) - [Unusual key management activity](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/unusual-key-management-activity.md) - [Unusual Kubernetes dashboard communication from a pod](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/unusual-kubernetes-dashboard-communication-from-a-pod.md) - [Unusual Kubernetes secret access](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/unusual-kubernetes-secret-access.md) - [Unusual Kubernetes service account file read](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/unusual-kubernetes-service-account-file-read.md) - [Unusual Lolbins Process Spawned by InstallUtil.exe](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/unusual-lolbins-process-spawned-by-installutil-exe.md) - [Unusual multi-region AWS Resource Explorer searches](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/unusual-multi-region-aws-resource-explorer-searches.md) - [Unusual Netsh PortProxy rule](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/unusual-netsh-portproxy-rule.md) - [Unusual process access to ld.so.preload file](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/unusual-process-access-to-ld-so-preload-file.md) - [Unusual process accessed a crypto wallet's files](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/unusual-process-accessed-a-crypto-wallet-s-files.md) - [Unusual process accessed a macOS notes DB file](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/unusual-process-accessed-a-macos-notes-db-file.md) - [Unusual process accessed a messaging app's files](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/unusual-process-accessed-a-messaging-app-s-files.md) - [Unusual process accessed a web browser history file](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/unusual-process-accessed-a-web-browser-history-file.md) - [Unusual process accessed FTP Client credentials](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/unusual-process-accessed-ftp-client-credentials.md) - [Unusual process accessed the PowerShell history file](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/unusual-process-accessed-the-powershell-history-file.md) - [Unusual process accessed web browser cookies](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/unusual-process-accessed-web-browser-cookies.md) - [Unusual process accessed web browser credentials](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/unusual-process-accessed-web-browser-credentials.md) - [Unusual process executed by AWS Systems Manager](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/unusual-process-executed-by-aws-systems-manager.md) - [Unusual Process Spawned by Nginx in Ingress-Nginx pod](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/unusual-process-spawned-by-nginx-in-ingress-nginx-pod.md) - [Unusual resource access by Azure application](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/unusual-resource-access-by-azure-application.md) - [Unusual resource modification by newly seen IAM user](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/unusual-resource-modification-by-newly-seen-iam-user.md) - [Unusual secret management activity](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/unusual-secret-management-activity.md) - [Unusual sender IP subnet](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/unusual-sender-ip-subnet.md) - [Unusual SSH activity that resembles SSH proxy](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/unusual-ssh-activity-that-resembles-ssh-proxy.md) - [Unusual SSH Activity](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/unusual-ssh-activity.md) - [Unusual URL(s) sent by a brand were observed in the email](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/unusual-url-s-sent-by-a-brand-were-observed-in-the-email.md) - [Unusual use of a 'SysInternals' tool](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/unusual-use-of-a-sysinternals-tool.md) - [Unusual user account enablement](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/unusual-user-account-enablement.md) - [Unusual user account unlock](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/unusual-user-account-unlock.md) - [Unusual user-agent for a cloud identity](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/unusual-user-agent-for-a-cloud-identity.md) - [Unusual weak authentication by user](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/unusual-weak-authentication-by-user.md) - [Unverified domain added to Azure AD](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/unverified-domain-added-to-azure-ad.md) - [Upload pattern that resembles Peer to Peer traffic](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/upload-pattern-that-resembles-peer-to-peer-traffic.md) - [Usage of homograph characters detected in an email attachment(s) name](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/usage-of-homograph-characters-detected-in-an-email-attachment-s-name.md) - [Usage of homograph characters detected in an email's from header](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/usage-of-homograph-characters-detected-in-an-email-s-from-header.md) - [Usage of homograph characters detected in an email](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/usage-of-homograph-characters-detected-in-an-email.md) - [User accessed multiple O365 AIP sensitive files](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/user-accessed-multiple-o365-aip-sensitive-files.md) - [User accessed SaaS resource via anonymous link](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/user-accessed-saas-resource-via-anonymous-link.md) - [User account delegation change](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/user-account-delegation-change.md) - [User added a new device to Okta Verify instance](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/user-added-a-new-device-to-okta-verify-instance.md) - [User added SID History to an account](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/user-added-sid-history-to-an-account.md) - [User added to a group and removed](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/user-added-to-a-group-and-removed.md) - [User added to the SMS Admins local group](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/user-added-to-the-sms-admins-local-group.md) - [User and Group Enumeration via SAMR](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/user-and-group-enumeration-via-samr.md) - [User attempted to connect from a suspicious country](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/user-attempted-to-connect-from-a-suspicious-country.md) - [User collected remote shared files in an archive](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/user-collected-remote-shared-files-in-an-archive.md) - [User discovery via WMI query execution](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/user-discovery-via-wmi-query-execution.md) - [User exported multiple messages in Microsoft Teams via Graph API](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/user-exported-multiple-messages-in-microsoft-teams-via-graph-api.md) - [User installed an application in Microsoft Teams via Graph API](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/user-installed-an-application-in-microsoft-teams-via-graph-api.md) - [User mail items accessed from multiple IPs in the same subnet](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/user-mail-items-accessed-from-multiple-ips-in-the-same-subnet.md) - [User moved Exchange sent messages to deleted items](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/user-moved-exchange-sent-messages-to-deleted-items.md) - [User sent messages in Microsoft Teams to multiple conversations via Graph API](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/user-sent-messages-in-microsoft-teams-to-multiple-conversations-via-graph-api.md) - [User set insecure CA registry setting for global SANs](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/user-set-insecure-ca-registry-setting-for-global-sans.md) - [User signed in to an application via Power Automate for the first time](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/user-signed-in-to-an-application-via-power-automate-for-the-first-time.md) - [VM Detection attempt on Linux](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/vm-detection-attempt-on-linux.md) - [VM Detection attempt](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/vm-detection-attempt.md) - [VPN access with an abnormal operating system](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/vpn-access-with-an-abnormal-operating-system.md) - [VPN login attempt by a honey user](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/vpn-login-attempt-by-a-honey-user.md) - [VPN login Brute-Force attempt](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/vpn-login-brute-force-attempt.md) - [VPN login by a dormant user](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/vpn-login-by-a-dormant-user.md) - [VPN login by a service account](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/vpn-login-by-a-service-account.md) - [VPN Login Password Spray](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/vpn-login-password-spray.md) - [VPN login with a machine account](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/vpn-login-with-a-machine-account.md) - [Vulnerable certificate template loaded](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/vulnerable-certificate-template-loaded.md) - [Wbadmin deleted files in quiet mode](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/wbadmin-deleted-files-in-quiet-mode.md) - [Weakly-Encrypted Kerberos TGT Response](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/weakly-encrypted-kerberos-tgt-response.md) - [Weakly-Encrypted Kerberos Ticket Requested](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/weakly-encrypted-kerberos-ticket-requested.md) - [Web server CGO executed a process following a potential Webshell dropped](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/web-server-cgo-executed-a-process-following-a-potential-webshell-dropped.md) - [Web server CGO executed an uncommon process](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/web-server-cgo-executed-an-uncommon-process.md) - [WebDAV drive mounted from net.exe over HTTPS](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/webdav-drive-mounted-from-net-exe-over-https.md) - [Well-known brand in sender headers with header inconsistencies](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/well-known-brand-in-sender-headers-with-header-inconsistencies.md) - [Windows CGO, actor and action processes with anomalous characteristics](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/windows-cgo-actor-and-action-processes-with-anomalous-characteristics.md) - [Windows CGO, actor process and action module with anomalous characteristics](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/windows-cgo-actor-process-and-action-module-with-anomalous-characteristics.md) - [Windows Event Log was cleared using wevtutil.exe](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/windows-event-log-was-cleared-using-wevtutil-exe.md) - [Windows event logs were cleared with PowerShell](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/windows-event-logs-were-cleared-with-powershell.md) - [Windows Installer exploitation for local privilege escalation](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/windows-installer-exploitation-for-local-privilege-escalation.md) - [Windows LOLBIN executable connected to a rare external host](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/windows-lolbin-executable-connected-to-a-rare-external-host.md) - [WmiPrvSe.exe Rare Child Command Line](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/wmiprvse-exe-rare-child-command-line.md) - [Wscript/Cscript loads .NET DLLs](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/wscript-cscript-loads-net-dlls.md) - [Wsmprovhost.exe Rare Child Process](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/wsmprovhost-exe-rare-child-process.md) - [X-Forefront-Antispam-Report has flagged this email as a potential threat](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/x-forefront-antispam-report-has-flagged-this-email-as-a-potential-threat.md) - [Alerts by data source](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-data-source.md) - [AWS Audit Log](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-data-source/aws-audit-log.md) - [Azure Audit Log](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-data-source/azure-audit-log.md) - [Azure SignIn Log](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-data-source/azure-signin-log.md) - [AzureAD Audit Log](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-data-source/azuread-audit-log.md) - [AzureAD](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-data-source/azuread.md) - [Box Audit Log](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-data-source/box-audit-log.md) - [DropBox](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-data-source/dropbox.md) - [Duo](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-data-source/duo.md) - [Gcp Audit Log](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-data-source/gcp-audit-log.md) - [Google Workspace](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-data-source/google-workspace.md) - [Health Monitoring Data](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-data-source/health-monitoring-data.md) - [Idira](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-data-source/idira.md) - [Kubernetes Audit Logs](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-data-source/kubernetes-audit-logs.md) - [Microsoft 365 Emails](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-data-source/microsoft-365-emails.md) - [Microsoft Graph Logs](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-data-source/microsoft-graph-logs.md) - [Office 365 Audit](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-data-source/office-365-audit.md) - [Okta Audit Log](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-data-source/okta-audit-log.md) - [Okta](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-data-source/okta.md) - [OneLogin](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-data-source/onelogin.md) - [Palo Alto Networks Firewall EAL Logs](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-data-source/palo-alto-networks-firewall-eal-logs.md) - [Palo Alto Networks Firewall threat Logs](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-data-source/palo-alto-networks-firewall-threat-logs.md) - [Palo Alto Networks Firewall traffic Logs](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-data-source/palo-alto-networks-firewall-traffic-logs.md) - [Palo Alto Networks Global Protect](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-data-source/palo-alto-networks-global-protect.md) - [Palo Alto Networks Platform Alerts](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-data-source/palo-alto-networks-platform-alerts.md) - [Palo Alto Networks Url Logs](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-data-source/palo-alto-networks-url-logs.md) - [PingOne](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-data-source/pingone.md) - [Third-Party Alerts](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-data-source/third-party-alerts.md) - [Third-Party Firewalls](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-data-source/third-party-firewalls.md) - [Third-Party VPNs](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-data-source/third-party-vpns.md) - [VMware virtualization servers syslogs](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-data-source/vmware-virtualization-servers-syslogs.md) - [Windows Event Collector](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-data-source/windows-event-collector.md) - [XDR Agent with eXtended Threat Hunting (XTH)](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-data-source/xdr-agent-with-extended-threat-hunting-xth.md) - [XDR Agent](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-data-source/xdr-agent.md) ## AppSec Rules - [AppSec Rules](https://cortex-docs.paloaltonetworks.com/appsec-rules/readme.md) - [IaC Security](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security.md) - [AI And Machine Learning](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/ai-and-machine-learning.md) - [AWS SageMaker notebook instance not configured with data encryption at rest using KMS key misconfigu](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/ai-and-machine-learning/appsec-aws-22.md) - [AWS SageMaker endpoint data encryption at rest not configured misconfiguration detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/ai-and-machine-learning/appsec-aws-98.md) - [AWS SageMaker notebook instance configured with direct internet access feature misconfiguration dete](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/ai-and-machine-learning/appsec-aws-122.md) - [AWS Sagemaker domain not encrypted using Customer Managed Key misconfiguration detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/ai-and-machine-learning/appsec-aws-187.md) - [AWS Kendra index Server side encryption does not use Customer Managed Keys (CMKs) misconfiguration d](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/ai-and-machine-learning/appsec-aws-262.md) - [AWS SageMaker notebook instance with root access enabled misconfiguration detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/ai-and-machine-learning/appsec-aws-307.md) - [AWS Sagemaker data quality job not encrypting model artifacts with KMS misconfiguration detected in](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/ai-and-machine-learning/appsec-aws-367.md) - [AWS Sagemaker data quality job not using KMS to encrypt data on attached storage volume misconfigura](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/ai-and-machine-learning/appsec-aws-368.md) - [AWS Sagemaker data quality job not encrypting communications between instances used for monitoring j](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/ai-and-machine-learning/appsec-aws-369.md) - [AWS SageMaker model does not use network isolation misconfiguration detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/ai-and-machine-learning/appsec-aws-370.md) - [AWS SageMaker notebook instance allows for IMDSv1 misconfiguration detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/ai-and-machine-learning/appsec-aws-371.md) - [AWS SageMaker Flow Definition does not use KMS for output configurations misconfiguration detected i](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/ai-and-machine-learning/appsec-aws-372.md) - [AWS Bedrock agent is not associated with Bedrock guardrails misconfiguration detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/ai-and-machine-learning/appsec-aws-383.md) - [Azure Synapse Workspaces do not enable managed virtual networks misconfiguration detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/ai-and-machine-learning/appsec-azure-58.md) - [Azure Cognitive Services account configured with public network access misconfiguration detected in](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/ai-and-machine-learning/appsec-azure-134.md) - [Azure Machine Learning Compute Cluster Local Authentication is enabled misconfiguration detected in](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/ai-and-machine-learning/appsec-azure-142.md) - [Azure Machine Learning Workspace is publicly accessible misconfiguration detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/ai-and-machine-learning/appsec-azure-144.md) - [Azure Machine Learning Compute Cluster Minimum Nodes is not set to 0 misconfiguration detected in co](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/ai-and-machine-learning/appsec-azure-150.md) - [Azure Data exfiltration protection for Azure Synapse workspace is disabled misconfiguration detected](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/ai-and-machine-learning/appsec-azure-157.md) - [Azure Databricks workspace is public misconfiguration detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/ai-and-machine-learning/appsec-azure-158.md) - [Azure Cognitive Services account configured with local authentication misconfiguration detected in c](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/ai-and-machine-learning/appsec-azure-236.md) - [Azure Cognitive Services account is not configured with managed identity misconfiguration detected i](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/ai-and-machine-learning/appsec-azure-238.md) - [Azure Synapse workspace administrator login password exposed misconfiguration detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/ai-and-machine-learning/appsec-azure-239.md) - [Azure Synapse Workspace not encrypted with a Customer Managed Key (CMK) misconfiguration detected in](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/ai-and-machine-learning/appsec-azure-240.md) - [Azure Synapse SQL pool not encrypted misconfiguration detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/ai-and-machine-learning/appsec-azure-241.md) - [Azure Synapse Spark Pool not using isolated compute misconfiguration detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/ai-and-machine-learning/appsec-azure-242.md) - [Azure Machine learning workspace is not configured with private endpoint misconfiguration detected i](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/ai-and-machine-learning/appsec-azure-243.md) - [Azure Cognitive Services account hosted with OpenAI is not configured with data loss prevention misc](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/ai-and-machine-learning/appsec-azure-247.md) - [GCP Vertex AI datasets do not use a Customer Manager Key (CMK) misconfiguration detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/ai-and-machine-learning/appsec-gcp-92.md) - [GCP Vertex AI Metadata Store does not use a Customer Manager Key (CMK) misconfiguration detected in](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/ai-and-machine-learning/appsec-gcp-96.md) - [GCP Dataproc Clusters have public IPs misconfiguration detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/ai-and-machine-learning/appsec-gcp-103.md) - [GCP DataFusion does not have stack driver logging enabled misconfiguration detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/ai-and-machine-learning/appsec-gcp-104.md) - [GCP DataFusion does not have stack driver monitoring enabled misconfiguration detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/ai-and-machine-learning/appsec-gcp-105.md) - [GCP Vertex AI Workbench user-managed notebook has vTPM disabled misconfiguration detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/ai-and-machine-learning/appsec-gcp-126.md) - [GCP Vertex AI Workbench user-managed notebook has Integrity monitoring disabled misconfiguration det](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/ai-and-machine-learning/appsec-gcp-127.md) - [AWS SageMaker notebook instance IAM policy is overly permissive misconfiguration detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/ai-and-machine-learning/appsec2-aws-68.md) - [Azure Synapse workspaces have IP firewall rules attached misconfiguration detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/ai-and-machine-learning/appsec2-azure-19.md) - [Azure Cognitive Services does not Customer Managed Keys (CMKs) for encryption misconfiguration detec](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/ai-and-machine-learning/appsec2-azure-22.md) - [Azure Synapse Workspace vulnerability assessment is disabled misconfiguration detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/ai-and-machine-learning/appsec2-azure-46.md) - [Azure Databricks Workspaces not using customer-managed key for root DBFS encryption misconfiguration](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/ai-and-machine-learning/appsec2-azure-48.md) - [Azure Machine learning workspace configured with overly permissive network access misconfiguration d](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/ai-and-machine-learning/appsec2-azure-49.md) - [Azure Storage Account storing Machine Learning workspace high business impact data is publicly acces](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/ai-and-machine-learning/appsec2-azure-50.md) - [Azure Synapse SQL Pool does not have a security alert policy misconfiguration detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/ai-and-machine-learning/appsec2-azure-51.md) - [Azure Synapse SQL Pool vulnerability assessment disabled misconfiguration detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/ai-and-machine-learning/appsec2-azure-52.md) - [Azure Synapse Workspace does not have extended audit logs misconfiguration detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/ai-and-machine-learning/appsec2-azure-53.md) - [Log monitoring disabled for Azure Synapse SQL Pool misconfiguration detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/ai-and-machine-learning/appsec2-azure-54.md) - [Vertex AI endpoint is not using a Customer Managed Key (CMK) misconfiguration detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/ai-and-machine-learning/appsec2-gcp-24.md) - [Vertex AI featurestore is not configured to use a Customer Managed Key (CMK) misconfiguration detect](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/ai-and-machine-learning/appsec2-gcp-25.md) - [Vertex AI tensorboard does not use a Customer Managed Key (CMK) misconfiguration detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/ai-and-machine-learning/appsec2-gcp-26.md) - [Vertex AI endpoint is public misconfiguration detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/ai-and-machine-learning/appsec2-gcp-33.md) - [Vertex AI index endpoint is public misconfiguration detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/ai-and-machine-learning/appsec2-gcp-34.md) - [Vertex AI runtime is not encrypted with a Customer Managed Key (CMK) misconfiguration detected in co](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/ai-and-machine-learning/appsec2-gcp-35.md) - [Vertex AI runtime is public misconfiguration detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/ai-and-machine-learning/appsec2-gcp-36.md) - [Compute](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/compute.md) - [Alibaba Cloud RDS instance is not set to perform auto upgrades for minor versions misconfiguration d](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/compute/appsec-ali-30.md) - [Disabled Ansible URI certificate validation misconfiguration detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/compute/appsec-ansible-1.md) - [Certificate validation disabled with Ansible get\_url module misconfiguration detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/compute/appsec-ansible-2.md) - [SSL certificate validation disabled with Ansible Yum misconfiguration detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/compute/appsec-ansible-3.md) - [SSL validation is disabled with yum misconfiguration detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/compute/appsec-ansible-4.md) - [Usage of packages with unauthenticated or missing signatures allowed misconfiguration detected in co](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/compute/appsec-ansible-5.md) - [Usage of the force parameter disabling signature validation allowed misconfiguration detected in cod](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/compute/appsec-ansible-6.md) - [AWS Lambda functions with tracing not enabled misconfiguration detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/compute/appsec-aws-50.md) - [API Gateway does not have X-Ray tracing enabled misconfiguration detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/compute/appsec-aws-73.md) - [AWS EC2 instance not configured with Instance Metadata Service v2 (IMDSv2) misconfiguration detected](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/compute/appsec-aws-79.md) - [AWS EMR cluster is not configured with Kerberos Authentication misconfiguration detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/compute/appsec-aws-114.md) - [AWS Lambda function is not configured for function-level concurrent execution Limit misconfiguration](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/compute/appsec-aws-115.md) - [AWS Lambda function is not configured for a DLQ misconfiguration detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/compute/appsec-aws-116.md) - [AWS Lambda Function is not assigned to access within VPC misconfiguration detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/compute/appsec-aws-117.md) - [AWS API Gateway caching is disabled misconfiguration detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/compute/appsec-aws-120.md) - [Autoscaling groups did not supply tags to launch configurations misconfiguration detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/compute/appsec-aws-153.md) - [ECR image scan on push is not enabled misconfiguration detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/compute/appsec-aws-163.md) - [AWS MQBroker's minor version updates are disabled misconfiguration detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/compute/appsec-aws-207.md) - [AWS MQBroker version is not up to date misconfiguration detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/compute/appsec-aws-208.md) - [AWS Batch Job is defined as a privileged container misconfiguration detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/compute/appsec-aws-210.md) - [AWS API deployments do not enable Create before Destroy misconfiguration detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/compute/appsec-aws-217.md) - [AWS DMS replication instance automatic version upgrade disabled misconfiguration detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/compute/appsec-aws-222.md) - [AWS API Gateway method settings do not enable caching misconfiguration detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/compute/appsec-aws-225.md) - [AWS DB instance does not get all minor upgrades automatically misconfiguration detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/compute/appsec-aws-226.md) - [AWS ACM certificate does not enable Create before Destroy misconfiguration detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/compute/appsec-aws-233.md) - [Ensure AWS API gateway enables Create before Destroy misconfiguration detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/compute/appsec-aws-237.md) - [AWS HTTP and HTTPS target groups do not define health check misconfiguration detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/compute/appsec-aws-261.md) - [AWS Lambda function is not configured to validate code-signing misconfiguration detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/compute/appsec-aws-272.md) - [API Gateway method setting is not set to encrypted caching misconfiguration detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/compute/appsec-aws-308.md) - [RDS cluster is not configured to copy tags to snapshots misconfiguration detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/compute/appsec-aws-313.md) - [EC2 Auto Scaling groups are not utilizing EC2 launch templates misconfiguration detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/compute/appsec-aws-315.md) - [AWS CodeBuild project environment privileged mode is enabled misconfiguration detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/compute/appsec-aws-316.md) - [Elasticsearch domains are not configured with a minimum of three dedicated master nodes misconfigura](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/compute/appsec-aws-318.md) - [Redshift clusters are not using the default database name. misconfiguration detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/compute/appsec-aws-320.md) - [Redshift clusters are not using enhanced VPC routing misconfiguration detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/compute/appsec-aws-321.md) - [AWS ElastiCache Redis cluster automatic version upgrade disabled misconfiguration detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/compute/appsec-aws-322.md) - [ECS Fargate services are not ensured to run on the latest Fargate platform version misconfiguration](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/compute/appsec-aws-332.md) - [AWS ECS task definition elevated privileges enabled misconfiguration detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/compute/appsec-aws-334.md) - [ECS task definitions have their own unique process namespace or share the host's process namespace m](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/compute/appsec-aws-335.md) - [AWS ECS task definition is not configured with read-only access to container root filesystems miscon](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/compute/appsec-aws-336.md) - [AWS Elastic Beanstalk environment managed platform updates are not enabled misconfiguration detected](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/compute/appsec-aws-340.md) - [AWS Auto Scaling group launch configuration configured with Instance Metadata Service hop count grea](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/compute/appsec-aws-341.md) - [Runtime of Lambda is deprecated misconfiguration detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/compute/appsec-aws-363.md) - [Hard-coded secrets found in Parameter Store values misconfiguration detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/compute/appsec-aws-384.md) - [Potential WhoAMI name confusion attack exposure misconfiguration detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/compute/appsec-aws-386.md) - [AWS SQS queue access policy is overly permissive misconfiguration detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/compute/appsec-aws-387.md) - [Secrets are exposed in Azure VM customData misconfiguration detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/compute/appsec-azure-45.md) - [Azure Linux scale set does not use an SSH key misconfiguration detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/compute/appsec-azure-49.md) - [Virtual Machine extensions are installed misconfiguration detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/compute/appsec-azure-50.md) - [Azure App Service Web app doesn't use latest .Net framework version misconfiguration detected in cod](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/compute/appsec-azure-80.md) - [Azure App Service Web app does not use latest PHP version misconfiguration detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/compute/appsec-azure-81.md) - [Azure App Service Web app does not use latest Python version misconfiguration detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/compute/appsec-azure-82.md) - [Azure App Service Web app does not use latest Java version misconfiguration detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/compute/appsec-azure-83.md) - [Azure Linux and Windows Virtual Machines does not utilize Managed Disks misconfiguration detected in](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/compute/appsec-azure-92.md) - [Automatic OS image patching is disabled for Virtual Machine scale sets misconfiguration detected in](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/compute/appsec-azure-95.md) - [Azure Data Factory does not use Git repository for source control misconfiguration detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/compute/appsec-azure-103.md) - [Azure Service Fabric cluster not configured with cluster protection level security misconfiguration](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/compute/appsec-azure-126.md) - [Azure Container Registry (ACR) Isn't Configured to Use Signed/Trusted Images misconfiguration detect](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/compute/appsec-azure-164.md) - [Azure Kubernetes Cluster (AKS) Nodes Don't Limit the Maximum Pods to Greater than 50 misconfiguratio](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/compute/appsec-azure-168.md) - [Azure Kubernetes Cluster (AKS) Nodes Do Not Use Scale Sets misconfiguration detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/compute/appsec-azure-169.md) - [AKS Doesn't Use the Paid SKU for its SLA misconfiguration detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/compute/appsec-azure-170.md) - [AKS Cluster Without Upgrade Channel misconfiguration detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/compute/appsec-azure-171.md) - [Windows VM Without Automatic Updates misconfiguration detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/compute/appsec-azure-177.md) - [VM Without Azure VM Agent Installed misconfiguration detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/compute/appsec-azure-179.md) - [App Configuration Not Using Standard SKU misconfiguration detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/compute/appsec-azure-188.md) - [Azure App Service Plan is Not Suitable for Production misconfiguration detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/compute/appsec-azure-211.md) - [Azure App Service Not Always On misconfiguration detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/compute/appsec-azure-214.md) - [Operating system disks are not ephemeral disks misconfiguration detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/compute/appsec-azure-226.md) - [Non-Critical System Pods Run on System Nodes misconfiguration detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/compute/appsec-azure-232.md) - [Healthcheck instructions have not been added to container images misconfiguration detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/compute/appsec-docker-2.md) - [A user for the container has not been created misconfiguration detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/compute/appsec-docker-3.md) - [Copy is not used instead of Add in Dockerfiles misconfiguration detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/compute/appsec-docker-4.md) - [Update instructions are used alone in a Dockerfile misconfiguration detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/compute/appsec-docker-5.md) - [LABEL maintainer is used instead of MAINTAINER (deprecated) misconfiguration detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/compute/appsec-docker-6.md) - [Base image uses a latest version tag misconfiguration detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/compute/appsec-docker-7.md) - [Last USER is root misconfiguration detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/compute/appsec-docker-8.md) - [Docker APT is used misconfiguration detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/compute/appsec-docker-9.md) - [Docker WORKDIR values are not absolute paths misconfiguration detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/compute/appsec-docker-10.md) - [Docker From alias is not unique for multistage builds misconfiguration detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/compute/appsec-docker-11.md) - [GCP Kubernetes Engine Clusters not using Container-Optimized OS for Node image misconfiguration dete](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/compute/appsec-gcp-22.md) - [GCP Kubernetes Engine Clusters have legacy compute engine metadata endpoints enabled misconfiguratio](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/compute/appsec-gcp-67.md) - [GCP Kubernetes cluster shielded GKE node with Secure Boot disabled misconfiguration detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/compute/appsec-gcp-68.md) - [GCP Kubernetes cluster Shielded GKE Nodes feature disabled misconfiguration detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/compute/appsec-gcp-71.md) - [GCP SQL database does not use the latest Major version misconfiguration detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/compute/appsec-gcp-79.md) - [GKE NodePool configuration managed at cluster level misconfiguration detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/compute/appsec-gcp-123.md) - [Containers wishing to share host process ID namespace admitted misconfiguration detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/compute/appsec-k8s-1.md) - [Privileged containers are admitted misconfiguration detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/compute/appsec-k8s-2.md) - [Containers wishing to share host IPC namespace admitted misconfiguration detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/compute/appsec-k8s-3.md) - [Root containers admitted misconfiguration detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/compute/appsec-k8s-6.md) - [Containers with NET\_RAW capability admitted misconfiguration detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/compute/appsec-k8s-7.md) - [CPU request is not set misconfiguration detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/compute/appsec-k8s-10.md) - [CPU limits are not set misconfiguration detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/compute/appsec-k8s-11.md) - [Memory requests are not set misconfiguration detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/compute/appsec-k8s-12.md) - [Memory limits are not set misconfiguration detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/compute/appsec-k8s-13.md) - [Image tag is not set to Fixed misconfiguration detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/compute/appsec-k8s-14.md) - [Image pull policy is not set to Always misconfiguration detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/compute/appsec-k8s-15.md) - [Container is privileged misconfiguration detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/compute/appsec-k8s-16.md) - [Containers share host process ID namespace misconfiguration detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/compute/appsec-k8s-17.md) - [Containers share host IPC namespace misconfiguration detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/compute/appsec-k8s-18.md) - [Containers run with AllowPrivilegeEscalation misconfiguration detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/compute/appsec-k8s-20.md) - [Default namespace is used misconfiguration detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/compute/appsec-k8s-21.md) - [Read-Only filesystem for containers is not used misconfiguration detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/compute/appsec-k8s-22.md) - [Admission of root containers not minimized misconfiguration detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/compute/appsec-k8s-23.md) - [Containers with added capability are allowed misconfiguration detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/compute/appsec-k8s-24.md) - [Admission of containers with added capability is not minimized misconfiguration detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/compute/appsec-k8s-25.md) - [Mounting Docker socket daemon in a container is not limited misconfiguration detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/compute/appsec-k8s-27.md) - [Admission of containers with NET\_RAW capability is not minimized misconfiguration detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/compute/appsec-k8s-28.md) - [securityContext is not applied to pods and containers misconfiguration detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/compute/appsec-k8s-29.md) - [securityContext is not applied to pods and containers in container context misconfiguration detected](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/compute/appsec-k8s-30.md) - [seccomp is not set to Docker/Default or Runtime/Default misconfiguration detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/compute/appsec-k8s-31.md) - [seccomp profile is not set to Docker/Default or Runtime/Default misconfiguration detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/compute/appsec-k8s-32.md) - [Kubernetes dashboard is deployed misconfiguration detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/compute/appsec-k8s-33.md) - [Tiller (Helm V2) is deployed misconfiguration detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/compute/appsec-k8s-34.md) - [Admission of containers with capabilities assigned is not minimised misconfiguration detected in cod](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/compute/appsec-k8s-36.md) - [Admission of containers with capabilities assigned is not limited misconfiguration detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/compute/appsec-k8s-37.md) - [CAP\_SYS\_ADMIN Linux capability is used misconfiguration detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/compute/appsec-k8s-39.md) - [Containers do not run with a high UID misconfiguration detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/compute/appsec-k8s-40.md) - [Images are not selected using a digest misconfiguration detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/compute/appsec-k8s-43.md) - [Tiller (Helm v2) service is not deleted misconfiguration detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/compute/appsec-k8s-44.md) - [The admission control plugin EventRateLimit is not set misconfiguration detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/compute/appsec-k8s-78.md) - [The admission control plugin AlwaysAdmit is set misconfiguration detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/compute/appsec-k8s-79.md) - [The admission control plugin AlwaysPullImages is not set misconfiguration detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/compute/appsec-k8s-80.md) - [The admission control plugin NamespaceLifecycle is not set misconfiguration detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/compute/appsec-k8s-83.md) - [The --terminated-pod-gc-threshold argument for controller managers is not set appropriately misconfi](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/compute/appsec-k8s-106.md) - [The --streaming-connection-idle-timeout argument is set to 0 misconfiguration detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/compute/appsec-k8s-143.md) - [The --protect-kernel-defaults argument is not set to True misconfiguration detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/compute/appsec-k8s-144.md) - [The --hostname-override argument is set misconfiguration detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/compute/appsec-k8s-146.md) - [OCI Compute Instance boot volume has in-transit data encryption is disabled misconfiguration detecte](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/compute/appsec-oci-4.md) - [OCI Compute Instance has Legacy MetaData service endpoint enabled misconfiguration detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/compute/appsec-oci-5.md) - [Operation objects do not have the 'produces' field defined for GET operations misconfiguration detec](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/compute/appsec-openapi-16.md) - [Operation objects for PUT, POST, and PATCH operations do not have a 'consumes' field defined misconf](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/compute/appsec-openapi-17.md) - [Array does not have a maximum number of items misconfiguration detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/compute/appsec-openapi-21.md) - [DNF usage of packages with untrusted or missing GPG signatures allowed misconfiguration detected in](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/compute/appsec2-ansible-4.md) - [SSL validation disabled within Ansible DNF module misconfiguration detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/compute/appsec2-ansible-5.md) - [Certificate validation disabled within Ansible DNF module misconfiguration detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/compute/appsec2-ansible-6.md) - [AWS Elasticsearch domain has Dedicated master set to disabled misconfiguration detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/compute/appsec2-aws-59.md) - [Azure Virtual Machines does not utilise Managed Disks misconfiguration detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/compute/appsec2-azure-9.md) - [Microsoft Antimalware is not configured to automatically update Virtual Machines misconfiguration de](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/compute/appsec2-azure-10.md) - [Dockerfile contains the use of 'sudo' misconfiguration detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/compute/appsec2-docker-1.md) - [Dockerfile certificate validation is disabled with curl misconfiguration detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/compute/appsec2-docker-2.md) - [Dockerfile certificate validation is disabled with wget misconfiguration detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/compute/appsec2-docker-3.md) - [Dockerfile certificate validation is disabled with the pip '--trusted-host' option misconfiguration](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/compute/appsec2-docker-4.md) - [Dockerfile certificate validation is disabled with the PYTHONHTTPSVERIFY environment variable miscon](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/compute/appsec2-docker-5.md) - [Dockerfile Node.js certificate validation is disabled with the NODE\_TLS\_REJECT\_UNAUTHORIZED environm](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/compute/appsec2-docker-6.md) - [Dockerfile APK package manager is configured to allow untrusted repositories misconfiguration detect](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/compute/appsec2-docker-7.md) - [Dockerfile APT package manager is configured to allow unauthenticated packages misconfiguration dete](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/compute/appsec2-docker-8.md) - [Dockerfile YUM package manager is configured to skip GPG signature checks misconfiguration detected](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/compute/appsec2-docker-9.md) - [Dockerfile RPM package manager is configured to skip package signature checks misconfiguration detec](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/compute/appsec2-docker-10.md) - [Dockerfile APT package manager is configured to force package installations without prompts or verif](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/compute/appsec2-docker-11.md) - [Dockerfile configuration disables strict SSL for NPM misconfiguration detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/compute/appsec2-docker-12.md) - [Dockerfile sets NPM configuration to disable strict SSL misconfiguration detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/compute/appsec2-docker-13.md) - [Dockerfile configures GIT to disable SSL verification misconfiguration detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/compute/appsec2-docker-14.md) - [Dockerfile sets YUM configuration to disable SSL verification misconfiguration detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/compute/appsec2-docker-15.md) - [Dockerfile uses a trusted host with pip misconfiguration detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/compute/appsec2-docker-16.md) - [GCP Kubernetes Engine Clusters have Alpha cluster feature enabled misconfiguration detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/compute/appsec2-gcp-19.md) - [IAM](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/iam.md) - [Alibaba Cloud RAM password policy does not have a minimum of 14 characters misconfiguration detected](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/iam/appsec-ali-13.md) - [Alibaba Cloud RAM password policy does not have a number misconfiguration detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/iam/appsec-ali-14.md) - [Alibaba Cloud RAM password policy does not have a symbol misconfiguration detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/iam/appsec-ali-15.md) - [Alibaba Cloud RAM password policy does not expire in 90 days misconfiguration detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/iam/appsec-ali-16.md) - [Alibaba Cloud RAM password policy does not have a lowercase character misconfiguration detected in c](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/iam/appsec-ali-17.md) - [Alibaba Cloud RAM password policy does not prevent password reuse misconfiguration detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/iam/appsec-ali-18.md) - [Alibaba Cloud RAM password policy does not have an uppercase character misconfiguration detected in](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/iam/appsec-ali-19.md) - [Alibaba Cloud RAM password policy maximal login attempts is more than 4 misconfiguration detected in](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/iam/appsec-ali-23.md) - [Alibaba Cloud RAM does not enforce MFA misconfiguration detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/iam/appsec-ali-24.md) - [Alibaba Cloud KMS Key Rotation is disabled misconfiguration detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/iam/appsec-ali-27.md) - [Alibaba Cloud KMS Key is disabled misconfiguration detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/iam/appsec-ali-28.md) - [AWS IAM policies that allow full administrative privileges are created misconfiguration detected in](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/iam/appsec-aws-1.md) - [AWS Customer Master Key (CMK) rotation is not enabled misconfiguration detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/iam/appsec-aws-7.md) - [AWS IAM password policy does not expire in 90 days misconfiguration detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/iam/appsec-aws-9.md) - [AWS IAM password policy does not have a minimum of 14 characters misconfiguration detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/iam/appsec-aws-10.md) - [AWS IAM password policy does not have a lowercase character misconfiguration detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/iam/appsec-aws-11.md) - [AWS IAM password policy does not have a number misconfiguration detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/iam/appsec-aws-12.md) - [AWS IAM password policy does allow password reuse misconfiguration detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/iam/appsec-aws-13.md) - [AWS IAM password policy does not have a symbol misconfiguration detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/iam/appsec-aws-14.md) - [AWS IAM password policy does not have an uppercase character misconfiguration detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/iam/appsec-aws-15.md) - [AWS Private ECR repository policy is overly permissive misconfiguration detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/iam/appsec-aws-32.md) - [AWS KMS Key policy overly permissive misconfiguration detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/iam/appsec-aws-33.md) - [AWS IAM policy attached to users misconfiguration detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/iam/appsec-aws-40.md) - [AWS IAM policy documents do not allow \* (asterisk) as a statement's action misconfiguration detected](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/iam/appsec-aws-49.md) - [AWS IAM role allows all services or principals to be assumed misconfiguration detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/iam/appsec-aws-60.md) - [AWS IAM policy allows all principals used by any AWS service from target account to assume role misc](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/iam/appsec-aws-61.md) - [AWS IAM policies that allow full "-" administrative privileges are created misconfiguration detected](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/iam/appsec-aws-62.md) - [AWS IAM policy documents allow \* (asterisk) as a statement's action misconfiguration detected in cod](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/iam/appsec-aws-63.md) - [SQS policy allows all actions misconfiguration detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/iam/appsec-aws-72.md) - [Credentials exposure actions return credentials in an API response misconfiguration detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/iam/appsec-aws-107.md) - [Data exfiltration allowed without resource constraints misconfiguration detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/iam/appsec-aws-108.md) - [Resource exposure allows modification of policies and exposes resources misconfiguration detected in](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/iam/appsec-aws-109.md) - [IAM policies allow privilege escalation misconfiguration detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/iam/appsec-aws-110.md) - [Write access allowed without constraint misconfiguration detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/iam/appsec-aws-111.md) - [Respective logs of Amazon RDS are disabled misconfiguration detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/iam/appsec-aws-129.md) - [RDS database does not have IAM authentication enabled misconfiguration detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/iam/appsec-aws-161.md) - [AWS RDS cluster not configured with IAM authentication misconfiguration detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/iam/appsec-aws-162.md) - [Glacier Vault access policy is public and not restricted to specific services or principals misconfi](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/iam/appsec-aws-167.md) - [SQS queue policy is public and access is not restricted to specific services or principals misconfig](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/iam/appsec-aws-168.md) - [SNS topic policy is public and access is not restricted to specific services or principals misconfig](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/iam/appsec-aws-169.md) - [AWS AMI launch permissions are not limited misconfiguration detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/iam/appsec-aws-205.md) - [AWS Key Management Service (KMS) key is disabled misconfiguration detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/iam/appsec-aws-227.md) - [AWS Execution Role ARN and Task Role ARN are different in ECS Task definitions misconfiguration dete](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/iam/appsec-aws-249.md) - [AWS Codecommit branch changes has less than 2 approvals misconfiguration detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/iam/appsec-aws-257.md) - [AWS Lambda function URL AuthType set to NONE misconfiguration detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/iam/appsec-aws-258.md) - [Access is not controlled through Single Sign-On (SSO) misconfiguration detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/iam/appsec-aws-273.md) - [AWS AdministratorAccess policy is used by IAM roles, users, or groups misconfiguration detected in c](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/iam/appsec-aws-274.md) - [IAM policy uses the AWS AdministratorAccess policy misconfiguration detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/iam/appsec-aws-275.md) - [IAM Policy Document Allows All or Any AWS Principal Permissions to Resources misconfiguration detect](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/iam/appsec-aws-283.md) - [AWS IAM Policy permission may cause privilege escalation misconfiguration detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/iam/appsec-aws-286.md) - [IAM policies allow exposure of credentials misconfiguration detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/iam/appsec-aws-287.md) - [IAM policies allow data exfiltration misconfiguration detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/iam/appsec-aws-288.md) - [IAM policies allow permissions management or resource exposure without constraints misconfiguration](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/iam/appsec-aws-289.md) - [IAM policies allow write access without constraints misconfiguration detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/iam/appsec-aws-290.md) - [AWS Lambda Function resource-based policy is overly permissive misconfiguration detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/iam/appsec-aws-301.md) - [Authorization type for API GatewayV2 routes is not specified misconfiguration detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/iam/appsec-aws-309.md) - [AWS Access key enabled on root account misconfiguration detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/iam/appsec-aws-348.md) - [IAM policy document allows all resources with restricted actions misconfiguration detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/iam/appsec-aws-355.md) - [Data source IAM policy document allows all resources with restricted actions misconfiguration detect](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/iam/appsec-aws-356.md) - [AWS GitHub Actions OIDC authorization policies allow for unsafe claims or claim order misconfigurati](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/iam/appsec-aws-358.md) - [AWS Neptune Cluster not configured with IAM authentication misconfiguration detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/iam/appsec-aws-359.md) - [Permissions delegated to AWS services for AWS Lambda functions are not limited by SourceArn or Sourc](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/iam/appsec-aws-364.md) - [AWS Cognito identity pool allows unauthenticated guest access misconfiguration detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/iam/appsec-aws-366.md) - [AWS Security Group allows unrestricted egress traffic misconfiguration detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/iam/appsec-aws-382.md) - [AWS GitHub Actions OIDC authorization policies allow for unsafe claims or claim order on IAM role mi](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/iam/appsec-aws-393.md) - [Azure AKS enable role-based access control (RBAC) not enforced misconfiguration detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/iam/appsec-azure-5.md) - [Azure AKS cluster configured with overly permissive API server access misconfiguration detected in c](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/iam/appsec-azure-6.md) - [Azure App Service Web app authentication is off misconfiguration detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/iam/appsec-azure-13.md) - [App Service is not registered with an Azure Active Directory account misconfiguration detected in co](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/iam/appsec-azure-16.md) - [Azure subscriptions with custom roles does not have minimum permissions misconfiguration detected in](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/iam/appsec-azure-39.md) - [Azure Function App authentication is off misconfiguration detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/iam/appsec-azure-56.md) - [Azure App Service Web app doesn't have a Managed Service Identity misconfiguration detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/iam/appsec-azure-71.md) - [AKS does not use Azure policies add-on misconfiguration detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/iam/appsec-azure-116.md) - [Active Directory is not used for authentication for Service Fabric misconfiguration detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/iam/appsec-azure-125.md) - [Azure ACR admin account is enabled misconfiguration detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/iam/appsec-azure-137.md) - [Azure ACR enables anonymous image pulling misconfiguration detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/iam/appsec-azure-138.md) - [Azure CosmosDB does not have Local Authentication disabled misconfiguration detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/iam/appsec-azure-140.md) - [Azure Kubernetes Service (AKS) local admin account is enabled misconfiguration detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/iam/appsec-azure-141.md) - [Azure SQL on Virtual Machine (Linux) with basic authentication misconfiguration detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/iam/appsec-azure-149.md) - [Web PubSub Without Managed Identities misconfiguration detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/iam/appsec-azure-176.md) - [Linux VM Without SSH Key misconfiguration detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/iam/appsec-azure-178.md) - [Data Explorer Not Using Managed Identities misconfiguration detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/iam/appsec-azure-181.md) - [App Configuration Using Local Authentication misconfiguration detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/iam/appsec-azure-184.md) - [Azure Event Grid Topic Managed Identity Provider misconfiguration detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/iam/appsec-azure-191.md) - [Azure Event Grid Topic Local Authentication Enabled misconfiguration detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/iam/appsec-azure-192.md) - [Azure Event Grid Domain Managed Identity Provider is Disabled misconfiguration detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/iam/appsec-azure-194.md) - [Azure Event Grid Domain Local Authentication Enabled misconfiguration detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/iam/appsec-azure-195.md) - [Azure Service Bus Without Managed Identity Provider misconfiguration detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/iam/appsec-azure-202.md) - [Azure Service Bus with Local Authentication Enabled misconfiguration detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/iam/appsec-azure-203.md) - [Azure Cognitive Search Without Managed Identities misconfiguration detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/iam/appsec-azure-207.md) - [Local users used for Azure Storage misconfiguration detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/iam/appsec-azure-244.md) - [Azure GitHub Actions OIDC trust policy is insecurely configured misconfiguration detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/iam/appsec-azure-249.md) - [GCP Kubernetes Engine Clusters have Legacy Authorization enabled misconfiguration detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/iam/appsec-gcp-7.md) - [GCP Kubernetes engine clusters have client certificate disabled misconfiguration detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/iam/appsec-gcp-13.md) - [GCP Kubernetes Engine Clusters have pod security policy disabled misconfiguration detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/iam/appsec-gcp-24.md) - [GCP VM instance configured with default service account misconfiguration detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/iam/appsec-gcp-30.md) - [GCP VM instance using a default service account with Cloud Platform access scope misconfiguration de](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/iam/appsec-gcp-31.md) - [GCP IAM user are assigned Service Account User or Service Account Token creator roles at project lev](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/iam/appsec-gcp-41.md) - [GCP IAM Service account does have admin privileges misconfiguration detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/iam/appsec-gcp-42.md) - [Roles impersonate or manage Service Accounts used at folder level misconfiguration detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/iam/appsec-gcp-44.md) - [Roles impersonate or manage Service Accounts used at organizational level misconfiguration detected](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/iam/appsec-gcp-45.md) - [Default Service Account is used at project level misconfiguration detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/iam/appsec-gcp-46.md) - [Default Service Account is used at organization level misconfiguration detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/iam/appsec-gcp-47.md) - [Default Service Account is used at folder level misconfiguration detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/iam/appsec-gcp-48.md) - [GCP IAM primitive roles are in use misconfiguration detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/iam/appsec-gcp-49.md) - [Kubernetes RBAC users are not managed with Google Groups for GKE misconfiguration detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/iam/appsec-gcp-65.md) - [GCP Kubernetes Engine Clusters have binary authorization disabled misconfiguration detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/iam/appsec-gcp-66.md) - [GCP Memorystore for Redis has AUTH disabled misconfiguration detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/iam/appsec-gcp-95.md) - [KMS policy allows public access misconfiguration detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/iam/appsec-gcp-112.md) - [IAM policy defines public access misconfiguration detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/iam/appsec-gcp-113.md) - [Basic roles utilized at the organization level misconfiguration detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/iam/appsec-gcp-115.md) - [Basic roles used at the folder level misconfiguration detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/iam/appsec-gcp-116.md) - [Project level utilization of basic roles misconfiguration detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/iam/appsec-gcp-117.md) - [IAM workload identity pool provider is not restricted misconfiguration detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/iam/appsec-gcp-118.md) - [GCP GitHub Actions OIDC trust policy is insecurely configured misconfiguration detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/iam/appsec-gcp-125.md) - [GitHub pull request configurations defined in Terraform have less than 2 approvals misconfiguration](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/iam/appsec-git-5.md) - [GitHub repository defined in Terraform does not have GPG signatures for all commits misconfiguration](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/iam/appsec-git-6.md) - [Gitlab project defined in Terraform requires fewer than 2 approvals misconfiguration detected in cod](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/iam/appsec-glb-1.md) - [Gitlab branch protection rules defined in Terraform allow force push misconfiguration detected in co](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/iam/appsec-glb-2.md) - [Gitlab project defined in Terraform does not require signed commits misconfiguration detected in cod](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/iam/appsec-glb-4.md) - [Containers run with AllowPrivilegeEscalation based on Pod Security Policy setting misconfiguration d](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/iam/appsec-k8s-5.md) - [Secrets used as environment variables misconfiguration detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/iam/appsec-k8s-35.md) - [Service account tokens are not mounted where necessary misconfiguration detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/iam/appsec-k8s-38.md) - [Default service accounts are actively used misconfiguration detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/iam/appsec-k8s-41.md) - [Default Kubernetes service accounts are actively used by bounding to a role or cluster role misconfi](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/iam/appsec-k8s-42.md) - [Wildcard use is not minimized in Roles and ClusterRoles misconfiguration detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/iam/appsec-k8s-49.md) - [The --anonymous-auth argument is not set to False for API server misconfiguration detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/iam/appsec-k8s-68.md) - [The --basic-auth-file argument is Set misconfiguration detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/iam/appsec-k8s-69.md) - [The --token-auth-file argument is Set misconfiguration detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/iam/appsec-k8s-70.md) - [The --kubelet-client-certificate and --kubelet-client-key arguments are not set appropriately miscon](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/iam/appsec-k8s-72.md) - [The --kubelet-certificate-authority argument is not set appropriately misconfiguration detected in c](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/iam/appsec-k8s-73.md) - [The --authorization-mode argument is set to AlwaysAllow for Kubelet misconfiguration detected in cod](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/iam/appsec-k8s-74.md) - [The --authorization-mode argument does not include node misconfiguration detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/iam/appsec-k8s-75.md) - [The --authorization-mode argument does not include RBAC misconfiguration detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/iam/appsec-k8s-77.md) - [The admission control plugin SecurityContextDeny is set if PodSecurityPolicy is used misconfiguratio](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/iam/appsec-k8s-81.md) - [The admission control plugin ServiceAccount is not set misconfiguration detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/iam/appsec-k8s-82.md) - [The admission control plugin PodSecurityPolicy is not set misconfiguration detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/iam/appsec-k8s-84.md) - [The admission control plugin NodeRestriction is not set misconfiguration detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/iam/appsec-k8s-85.md) - [The --service-account-lookup argument is not set to true misconfiguration detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/iam/appsec-k8s-96.md) - [The --service-account-key-file argument is not set appropriately misconfiguration detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/iam/appsec-k8s-97.md) - [The --etcd-cafile argument is not set appropriately misconfiguration detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/iam/appsec-k8s-102.md) - [The --use-service-account-credentials argument for controller managers is not set to True misconfigu](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/iam/appsec-k8s-108.md) - [The --service-account-private-key-file argument for controller managers is not set appropriately mis](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/iam/appsec-k8s-110.md) - [The --root-ca-file argument for controller managers is not set appropriately misconfiguration detect](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/iam/appsec-k8s-111.md) - [The RotateKubeletServerCertificate argument for controller managers is not set to True misconfigurat](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/iam/appsec-k8s-112.md) - [The --client-cert-auth argument is not set to True misconfiguration detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/iam/appsec-k8s-117.md) - [The --peer-client-cert-auth argument is not set to True misconfiguration detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/iam/appsec-k8s-121.md) - [The --anonymous-auth argument is not set to False for Kubelet misconfiguration detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/iam/appsec-k8s-138.md) - [The --authorization-mode argument is set to AlwaysAllow for API server misconfiguration detected in](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/iam/appsec-k8s-139.md) - [The --client-ca-file argument for API Servers is not set appropriately misconfiguration detected in](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/iam/appsec-k8s-140.md) - [The --rotate-certificates argument is set to false misconfiguration detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/iam/appsec-k8s-149.md) - [Kubernetes ClusterRoles that grant control over validating or mutating admission webhook configurati](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/iam/appsec-k8s-155.md) - [Kubernetes ClusterRoles that grant permissions to approve CertificateSigningRequests are not minimiz](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/iam/appsec-k8s-156.md) - [Kubernetes Roles and ClusterRoles that grant permissions to bind RoleBindings or ClusterRoleBindings](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/iam/appsec-k8s-157.md) - [Kubernetes Roles and ClusterRoles that grant permissions to escalate Roles or ClusterRole are not mi](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/iam/appsec-k8s-158.md) - [OCI private keys are hard coded in the provider misconfiguration detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/iam/appsec-oci-1.md) - [OCI IAM password policy for local (non-federated) users does not have a lowercase character misconfi](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/iam/appsec-oci-11.md) - [OCI IAM password policy for local (non-federated) users does not have a number misconfiguration dete](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/iam/appsec-oci-12.md) - [OCI IAM password policy for local (non-federated) users does not have a symbol misconfiguration dete](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/iam/appsec-oci-13.md) - [OCI IAM password policy for local (non-federated) users does not have an uppercase character misconf](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/iam/appsec-oci-14.md) - [OCI IAM password policy for local (non-federated) users does not have minimum 14 characters misconfi](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/iam/appsec-oci-18.md) - [OpenAPI Security object needs to have defined rules in its array and rules should be defined in the](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/iam/appsec-openapi-4.md) - [OpenAPI Security object for operations, if defined, must define a security scheme, otherwise it shou](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/iam/appsec-openapi-5.md) - [OpenAPI Security requirement not defined in the security definitions misconfiguration detected in co](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/iam/appsec-openapi-6.md) - [API spec includes a 'password' flow in OAuth2 authentication misconfiguration detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/iam/appsec-openapi-8.md) - [Security scopes of operations are not defined in securityDefinition misconfiguration detected in cod](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/iam/appsec-openapi-9.md) - [OAuth2 security definitions includes password flow in OpenAPI 2.0 file misconfiguration detected in](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/iam/appsec-openapi-10.md) - [OAuth2 password flow in security definitions for OpenAPI 2.0 file misconfiguration detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/iam/appsec-openapi-11.md) - [Security definition uses the deprecated implicit flow on OAuth2 misconfiguration detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/iam/appsec-openapi-12.md) - [Security definitions uses basic auth misconfiguration detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/iam/appsec-openapi-13.md) - [Operation Objects Uses 'Implicit' Flow misconfiguration detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/iam/appsec-openapi-14.md) - [Operation Objects Uses Basic Auth misconfiguration detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/iam/appsec-openapi-15.md) - [The global security scope is not defined in the securityDefinitions misconfiguration detected in cod](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/iam/appsec-openapi-19.md) - [OpenStack hard coded password, token, or application\_credential\_secret exists in provider misconfigu](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/iam/appsec-openstack-1.md) - [OpenStack instance use basic credentials misconfiguration detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/iam/appsec-openstack-4.md) - [AWS IAM group not in use misconfiguration detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/iam/appsec2-aws-14.md) - [Not all IAM users are members of at least one IAM group misconfiguration detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/iam/appsec2-aws-21.md) - [IAM User has access to the console misconfiguration detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/iam/appsec2-aws-22.md) - [AWS IAM policy allows full administrative privileges misconfiguration detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/iam/appsec2-aws-40.md) - [AWS EC2 Instance IAM Role not enabled misconfiguration detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/iam/appsec2-aws-41.md) - [AWS S3 buckets are accessible to any authenticated user misconfiguration detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/iam/appsec2-aws-43.md) - [AWS Cloudfront Distribution with S3 have Origin Access set to disabled misconfiguration detected in](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/iam/appsec2-aws-46.md) - [AWS OpenSearch Fine-grained access control is disabled misconfiguration detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/iam/appsec2-aws-52.md) - [The AWS Managed IAMFullAccess IAM policy should not be used misconfiguration detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/iam/appsec2-aws-56.md) - [A Policy is not Defined for KMS Key misconfiguration detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/iam/appsec2-aws-64.md) - [AWS API Gateway method lacking authorization or API keys misconfiguration detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/iam/appsec2-aws-70.md) - [Azure SQL servers which doesn't have Azure Active Directory admin configured misconfiguration detect](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/iam/appsec2-azure-7.md) - [Azure SQL server not configured with Active Directory admin authentication misconfiguration detected](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/iam/appsec2-azure-27.md) - [Azure Container Instance not configured with the managed identity misconfiguration detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/iam/appsec2-azure-30.md) - [Azure Recovery Services vault is not configured with managed identity misconfiguration detected in c](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/iam/appsec2-azure-35.md) - [Azure Automation account is not configured with managed identity misconfiguration detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/iam/appsec2-azure-36.md) - [Azure Storage account configured with Shared Key authorization misconfiguration detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/iam/appsec2-azure-40.md) - [Azure Storage account not configured with SAS expiration policy misconfiguration detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/iam/appsec2-azure-41.md) - [Anonymous blob access configured in Azure storage account misconfiguration detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/iam/appsec2-azure-47.md) - ['chpasswd' is used to set or remove passwords misconfiguration detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/iam/appsec2-docker-17.md) - [GCP Kubernetes Engine Cluster Nodes have default Service account for Project access misconfiguration](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/iam/appsec2-gcp-1.md) - [There are not only GCP-managed service account keys for each service account misconfiguration detect](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/iam/appsec2-gcp-3.md) - [A MySQL database instance allows anyone to connect with administrative privileges misconfiguration d](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/iam/appsec2-gcp-7.md) - [IBM Cloud API key creation is not restricted in account settings in Terraform misconfiguration detec](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/iam/appsec2-ibm-3.md) - [IBM Cloud Multi-Factor Authentication (MFA) not enabled at the account level in Terraform misconfigu](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/iam/appsec2-ibm-4.md) - [IBM Cloud Service ID creation is not restricted in account settings in Terraform misconfiguration de](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/iam/appsec2-ibm-5.md) - [RoleBinding should not allow privilege escalation to a ServiceAccount or Node on other RoleBinding m](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/iam/appsec2-k8s-1.md) - [Granting create permissions to nodes/proxy or pods/exec sub resources allows potential privilege esc](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/iam/appsec2-k8s-2.md) - [No ServiceAccount/Node should have impersonate permissions for groups/users/service-accounts misconf](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/iam/appsec2-k8s-3.md) - [ServiceAccounts and nodes that can modify services/status may set the status.loadBalancer.ingress.ip](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/iam/appsec2-k8s-4.md) - [No ServiceAccount/Node should be able to read all secrets misconfiguration detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/iam/appsec2-k8s-5.md) - [OCI tenancy administrator users are associated with API keys misconfiguration detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/iam/appsec2-oci-1.md) - [Logging](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/logging.md) - [Alibaba Cloud Action Trail Logging is not enabled for all regions misconfiguration detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/logging/appsec-ali-4.md) - [Alibaba Cloud Action Trail Logging is not enabled for all events misconfiguration detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/logging/appsec-ali-5.md) - [Alibaba Cloud OSS bucket has access logging enabled misconfiguration detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/logging/appsec-ali-12.md) - [Alibaba Cloud RDS Instance SQL Collector Retention Period is less than 180 misconfiguration detected](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/logging/appsec-ali-25.md) - [Alibaba Cloud RDS instance does not have log\_duration enabled misconfiguration detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/logging/appsec-ali-35.md) - [Alibaba Cloud RDS instance has log\_disconnections disabled misconfiguration detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/logging/appsec-ali-36.md) - [Alibaba Cloud RDS log audit is disabled misconfiguration detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/logging/appsec-ali-38.md) - [AWS CloudTrail log validation is not enabled in all regions misconfiguration detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/logging/appsec-aws-36.md) - [AWS EKS control plane logging disabled misconfiguration detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/logging/appsec-aws-37.md) - [Amazon MQ Broker logging is not enabled misconfiguration detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/logging/appsec-aws-48.md) - [AWS CloudWatch Log groups not configured with definite retention days misconfiguration detected in c](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/logging/appsec-aws-66.md) - [AWS CloudTrail is not enabled with multi trail and not capturing all management events misconfigurat](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/logging/appsec-aws-67.md) - [AWS Redshift database does not have audit logging enabled misconfiguration detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/logging/appsec-aws-71.md) - [Global Accelerator does not have Flow logs enabled misconfiguration detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/logging/appsec-aws-75.md) - [API Gateway does not have access logging enabled misconfiguration detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/logging/appsec-aws-76.md) - [Amazon MSK cluster logging is not enabled misconfiguration detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/logging/appsec-aws-80.md) - [AWS Elasticsearch domain logging is not enabled misconfiguration detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/logging/appsec-aws-84.md) - [AWS DocumentDB logging is not enabled misconfiguration detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/logging/appsec-aws-85.md) - [AWS CloudFront distribution with access logging disabled misconfiguration detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/logging/appsec-aws-86.md) - [AWS Elastic Load Balancer v2 (ELBv2) with access log disabled misconfiguration detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/logging/appsec-aws-91.md) - [AWS Elastic Load Balancer (Classic) with access log disabled misconfiguration detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/logging/appsec-aws-92.md) - [AWS API Gateway V2 has Access Logging is disabled misconfiguration detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/logging/appsec-aws-95.md) - [Neptune logging is not enabled misconfiguration detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/logging/appsec-aws-101.md) - [AWS config is not enabled in all regions misconfiguration detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/logging/appsec-aws-121.md) - [AWS CloudWatch Log groups encrypted using default encryption key instead of KMS CMK misconfiguration](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/logging/appsec-aws-158.md) - [AWS WAF Web Access Control Lists logging is disabled misconfiguration detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/logging/appsec-aws-176.md) - [AWS AppSync's logging is disabled misconfiguration detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/logging/appsec-aws-193.md) - [AWS AppSync has field-level logging disabled misconfiguration detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/logging/appsec-aws-194.md) - [AWS MQBroker audit logging is disabled misconfiguration detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/logging/appsec-aws-197.md) - [AWS ECS Cluster does not enable logging of ECS Exec misconfiguration detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/logging/appsec-aws-223.md) - [AWS cluster logging is not enabled or client to container communication not encrypted using a Custom](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/logging/appsec-aws-224.md) - [AWS ACM certificates does not have logging preference misconfiguration detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/logging/appsec-aws-234.md) - [AWS MWAA environment has scheduler logs disabled misconfiguration detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/logging/appsec-aws-242.md) - [AWS MWAA environment has worker logs disabled misconfiguration detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/logging/appsec-aws-243.md) - [AWS MWAA environment has webserver logs disabled misconfiguration detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/logging/appsec-aws-244.md) - [AWS CloudTrail logging is disabled misconfiguration detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/logging/appsec-aws-251.md) - [AWS CloudTrail does not define an SNS Topic misconfiguration detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/logging/appsec-aws-252.md) - [Data Trace is not enabled in the API Gateway Method Settings misconfiguration detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/logging/appsec-aws-276.md) - [State machine does not have X-ray tracing enabled misconfiguration detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/logging/appsec-aws-284.md) - [Execution history logging is not enabled on the State Machine misconfiguration detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/logging/appsec-aws-285.md) - [AWS CodeBuild project not configured with logging configuration misconfiguration detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/logging/appsec-aws-314.md) - [Elasticsearch Domain Audit Logging is disabled misconfiguration detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/logging/appsec-aws-317.md) - [RDS Cluster log capture is disabled misconfiguration detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/logging/appsec-aws-324.md) - [RDS Cluster audit logging for MySQL engine is disabled misconfiguration detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/logging/appsec-aws-325.md) - [AWS ECS services have automatic public IP address assignment enabled misconfiguration detected in co](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/logging/appsec-aws-333.md) - [AWS CloudWatch log groups retention set to less than 365 days misconfiguration detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/logging/appsec-aws-338.md) - [RDS instances have performance insights disabled misconfiguration detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/logging/appsec-aws-353.md) - [Azure Network Watcher Network Security Group (NSG) flow logs retention is less than 90 days misconfi](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/logging/appsec-azure-12.md) - [Azure SQL Server auditing policy is disabled misconfiguration detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/logging/appsec-azure-23.md) - [Azure SQL Server audit log retention is not greater than 90 days misconfiguration detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/logging/appsec-azure-24.md) - [Azure SQL server send alerts to field value is not set misconfiguration detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/logging/appsec-azure-26.md) - [Azure storage account logging for queues is disabled misconfiguration detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/logging/appsec-azure-33.md) - [Azure Activity Log retention should not be set to less than 365 days misconfiguration detected in co](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/logging/appsec-azure-37.md) - [Azure Monitor log profile does not capture all activities misconfiguration detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/logging/appsec-azure-38.md) - [Azure App service HTTP logging is disabled misconfiguration detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/logging/appsec-azure-63.md) - [App service disables detailed error messages misconfiguration detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/logging/appsec-azure-65.md) - [App service does not enable failed request tracing misconfiguration detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/logging/appsec-azure-66.md) - [Server Parameter 'log\_retention' is Set to 'OFF' for PostgreSQL Database Server misconfiguration det](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/logging/appsec-azure-146.md) - [Azure SQL Server does not have default auditing policy configured misconfiguration detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/logging/appsec-azure-156.md) - [Azure Built-in logging for Azure function app is disabled misconfiguration detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/logging/appsec-azure-159.md) - [Ledger feature is disabled on the database misconfiguration detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/logging/appsec-azure-224.md) - [GCP Kubernetes Engine Clusters have Cloud Logging disabled misconfiguration detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/logging/appsec-gcp-1.md) - [GCP VPC Flow logs for the subnet is set to Off misconfiguration detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/logging/appsec-gcp-26.md) - [GCP PostgreSQL instance with log\_checkpoints database flag is disabled misconfiguration detected in](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/logging/appsec-gcp-51.md) - [GCP PostgreSQL instance database flag log\_connections is disabled misconfiguration detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/logging/appsec-gcp-52.md) - [GCP PostgreSQL instance database flag log\_disconnections is disabled misconfiguration detected in co](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/logging/appsec-gcp-53.md) - [GCP PostgreSQL instance database flag log\_lock\_waits is disabled misconfiguration detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/logging/appsec-gcp-54.md) - [GCP PostgreSQL instance database flag log\_min\_messages is not set misconfiguration detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/logging/appsec-gcp-55.md) - [GCP PostgreSQL instance database flag log\_temp\_files is not set to 0 misconfiguration detected in co](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/logging/appsec-gcp-56.md) - [GCP PostgreSQL instance database flag log\_min\_duration\_statement is not set to -1 misconfiguration d](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/logging/appsec-gcp-57.md) - [GCP PostgreSQL instance database flag log\_hostname is not set to off misconfiguration detected in co](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/logging/appsec-gcp-108.md) - [Log levels of the GCP PostgreSQL database are not set to ERROR or lower misconfiguration detected in](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/logging/appsec-gcp-109.md) - [pgAudit is disabled for your GCP PostgreSQL database misconfiguration detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/logging/appsec-gcp-110.md) - [SQL statements of GCP PostgreSQL are not logged misconfiguration detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/logging/appsec-gcp-111.md) - [The --audit-log-path argument is not set misconfiguration detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/logging/appsec-k8s-91.md) - [The --audit-log-maxage argument is not set appropriately misconfiguration detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/logging/appsec-k8s-92.md) - [The --audit-log-maxbackup argument is not set appropriately misconfiguration detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/logging/appsec-k8s-93.md) - [The --audit-log-maxsize argument is not set appropriately misconfiguration detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/logging/appsec-k8s-94.md) - [Security policies missing descriptions in Palo Alto Networks devices misconfiguration detected in co](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/logging/appsec-pan-8.md) - [Log Forwarding Profile not selected for a Palo Alto Networks device security policy rule misconfigur](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/logging/appsec-pan-9.md) - [End-of-session logging disabled on Palo Alto Networks security policies misconfiguration detected in](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/logging/appsec-pan-10.md) - [Logging at session start enabled on Palo Alto Networks devices misconfiguration detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/logging/appsec-pan-16.md) - [API Gateway stage does not have logging level defined appropriately misconfiguration detected in cod](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/logging/appsec2-aws-4.md) - [AWS CloudTrail trail logs is not integrated with CloudWatch Log misconfiguration detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/logging/appsec2-aws-10.md) - [AWS VPC Flow Logs not enabled misconfiguration detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/logging/appsec2-aws-11.md) - [AWS RDS Postgres Cluster does not have query logging enabled misconfiguration detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/logging/appsec2-aws-27.md) - [AWS Postgres RDS have Query Logging disabled misconfiguration detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/logging/appsec2-aws-30.md) - [AWS WAF2 does not have a Logging Configuration misconfiguration detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/logging/appsec2-aws-31.md) - [AWS Codecommit is not associated with an approval rule misconfiguration detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/logging/appsec2-aws-37.md) - [Domain Name System (DNS) query logging is not enabled for Amazon Route 53 hosted zones misconfigurat](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/logging/appsec2-aws-39.md) - [AWS Config Recording is disabled misconfiguration detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/logging/appsec2-aws-45.md) - [AWS Config must record all possible resources misconfiguration detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/logging/appsec2-aws-48.md) - [An S3 bucket must have a lifecycle configuration misconfiguration detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/logging/appsec2-aws-61.md) - [S3 buckets do not have event notifications enabled misconfiguration detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/logging/appsec2-aws-62.md) - [AWS Network Firewall is not configured with logging configuration misconfiguration detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/logging/appsec2-aws-63.md) - [Azure storage account logging setting for tables is disabled misconfiguration detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/logging/appsec2-azure-20.md) - [Azure storage account logging setting for blobs is disabled misconfiguration detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/logging/appsec2-azure-21.md) - [GCP Log bucket retention policy is not configured using bucket lock misconfiguration detected in cod](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/logging/appsec2-gcp-4.md) - [GCP Project audit logging is not configured properly across all services and all users in a project](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/logging/appsec2-gcp-5.md) - [GCP PostgreSQL instance database flag log\_duration is not set to on misconfiguration detected in cod](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/logging/appsec2-gcp-13.md) - [GCP PostgreSQL instance database flag log\_executor\_stats is not set to off misconfiguration detected](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/logging/appsec2-gcp-14.md) - [GCP PostgreSQL instance database flag log\_parser\_stats is not set to off misconfiguration detected i](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/logging/appsec2-gcp-15.md) - [GCP PostgreSQL instance database flag log\_planner\_stats is not set to off misconfiguration detected](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/logging/appsec2-gcp-16.md) - [GCP PostgreSQL instance database flag log\_statement\_stats is not set to off misconfiguration detecte](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/logging/appsec2-gcp-17.md) - [Logging is disabled for Dialogflow agents misconfiguration detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/logging/appsec2-gcp-29.md) - [Logging for Dialogflow CX agents is disabled misconfiguration detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/logging/appsec2-gcp-30.md) - [Logging for Dialogflow CX webhooks is disabled misconfiguration detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/logging/appsec2-gcp-31.md) - [Monitoring](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/monitoring.md) - [Alibaba Cloud Kubernetes node pools are not set to auto repair misconfiguration detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/monitoring/appsec-ali-31.md) - [Alibaba RDS instance has log\_connections disabled misconfiguration detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/monitoring/appsec-ali-37.md) - [AWS ECS cluster with container insights feature disabled misconfiguration detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/monitoring/appsec-aws-65.md) - [AWS Amazon RDS instances Enhanced Monitoring is disabled misconfiguration detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/monitoring/appsec-aws-118.md) - [AWS CloudFormation stack configured without SNS topic misconfiguration detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/monitoring/appsec-aws-124.md) - [AWS EC2 instance detailed monitoring disabled misconfiguration detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/monitoring/appsec-aws-126.md) - [AWS WAF does not have associated rules misconfiguration detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/monitoring/appsec-aws-175.md) - [AWS GuardDuty detector is not enabled misconfiguration detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/monitoring/appsec-aws-238.md) - [Elastic Beanstalk environments do not have enhanced health reporting enabled misconfiguration detect](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/monitoring/appsec-aws-312.md) - [CloudWatch alarm actions are not enabled misconfiguration detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/monitoring/appsec-aws-319.md) - [EKS clusters are not running on a supported Kubernetes version misconfiguration detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/monitoring/appsec-aws-339.md) - [AWS resources that support tags do not have Tags misconfiguration detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/monitoring/appsec-aws-custom-1.md) - [Azure AKS cluster monitoring not enabled misconfiguration detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/monitoring/appsec-azure-4.md) - [Azure Microsoft Defender for Cloud Defender plans is set to Off misconfiguration detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/monitoring/appsec-azure-19.md) - [Azure Microsoft Defender for Cloud security contact phone number is not set misconfiguration detecte](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/monitoring/appsec-azure-20.md) - [Azure Microsoft Defender for Cloud security alert email notification is not set misconfiguration det](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/monitoring/appsec-azure-21.md) - [Azure Microsoft Defender for Cloud email notification for subscription owner is not set misconfigura](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/monitoring/appsec-azure-22.md) - [Azure SQL Server threat detection alerts are not enabled for all threat types misconfiguration detec](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/monitoring/appsec-azure-25.md) - [Azure SQL Databases with disabled Email service and co-administrators for Threat Detection misconfig](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/monitoring/appsec-azure-27.md) - [Azure Microsoft Defender for Cloud is set to Off for Servers misconfiguration detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/monitoring/appsec-azure-55.md) - [Azure Microsoft Defender for Cloud is set to Off for App Service misconfiguration detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/monitoring/appsec-azure-61.md) - [Azure Microsoft Defender for Cloud is set to Off for Azure SQL Databases misconfiguration detected i](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/monitoring/appsec-azure-69.md) - [Azure Microsoft Defender for Cloud is set to Off for SQL servers on machines misconfiguration detect](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/monitoring/appsec-azure-79.md) - [Azure Microsoft Defender for Cloud is set to Off for Storage misconfiguration detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/monitoring/appsec-azure-84.md) - [Azure Security Center Defender set to Off for Kubernetes misconfiguration detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/monitoring/appsec-azure-85.md) - [Azure Microsoft Defender for Cloud is set to Off for Container Registries misconfiguration detected](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/monitoring/appsec-azure-86.md) - [Azure Microsoft Defender for Cloud is set to Off for Key Vault misconfiguration detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/monitoring/appsec-azure-87.md) - [My SQL server does not enable Threat Detection policy misconfiguration detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/monitoring/appsec-azure-127.md) - [PostgreSQL server does not enable Threat Detection policy misconfiguration detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/monitoring/appsec-azure-128.md) - [Azure Microsoft Defender for Cloud security alert email notifications is not set misconfiguration de](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/monitoring/appsec-azure-131.md) - [Vulnerability Scanning not enabled for Azure Container Registry misconfiguration detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/monitoring/appsec-azure-163.md) - [Azure App Service Health Check Missing misconfiguration detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/monitoring/appsec-azure-213.md) - [Azure Microsoft Defender for Cloud set to Off for Resource Manager misconfiguration detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/monitoring/appsec-azure-234.md) - [Azure resources that support tags do not have tags misconfiguration detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/monitoring/appsec-azure-custom-1.md) - [GCP Kubernetes Engine Clusters have Cloud Monitoring disabled misconfiguration detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/monitoring/appsec-gcp-8.md) - [GCP Kubernetes cluster node auto-repair configuration disabled misconfiguration detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/monitoring/appsec-gcp-9.md) - [GCP Kubernetes cluster node auto-upgrade configuration disabled misconfiguration detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/monitoring/appsec-gcp-10.md) - [GCP Kubernetes Engine Clusters without any label information misconfiguration detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/monitoring/appsec-gcp-21.md) - [The GKE metadata server is disabled misconfiguration detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/monitoring/appsec-gcp-69.md) - [GCP Kubernetes Engine cluster not using Release Channel for version management misconfiguration dete](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/monitoring/appsec-gcp-70.md) - [GCP Kubernetes cluster shielded GKE node with integrity monitoring disabled misconfiguration detecte](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/monitoring/appsec-gcp-72.md) - [GCP Cloud Armor policy not configured with cve-canary rule misconfiguration detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/monitoring/appsec-gcp-73.md) - [GCP resources that support labels do not have labels misconfiguration detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/monitoring/appsec-gcp-custom-1.md) - [GitHub Repository defined in Terraform doesn't have vulnerability alerts enabled misconfiguration de](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/monitoring/appsec-git-3.md) - [Liveness probe is not configured misconfiguration detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/monitoring/appsec-k8s-8.md) - [Readiness probe is not configured misconfiguration detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/monitoring/appsec-k8s-9.md) - [The --profiling argument is not set to false for API server misconfiguration detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/monitoring/appsec-k8s-90.md) - [The --request-timeout argument is not set appropriately misconfiguration detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/monitoring/appsec-k8s-95.md) - [The --profiling argument for controller managers is not set to False misconfiguration detected in co](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/monitoring/appsec-k8s-107.md) - [The --profiling argument is not set to False for scheduler misconfiguration detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/monitoring/appsec-k8s-114.md) - [The --event-qps argument is not set to a level that ensures appropriate event capture misconfigurati](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/monitoring/appsec-k8s-147.md) - [OCI Compute Instance has monitoring disabled misconfiguration detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/monitoring/appsec-oci-6.md) - [Terraform module sources do not use a git url with a commit hash revision misconfiguration detected](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/monitoring/appsec-tf-1.md) - [Terraform module sources do not use a git url with a tag or commit hash revision misconfiguration de](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/monitoring/appsec-tf-2.md) - [GuardDuty is not enabled to specific org/region misconfiguration detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/monitoring/appsec2-aws-3.md) - [AWS CloudFront attached WAFv2 WebACL is not configured with AMR for Log4j Vulnerability misconfigura](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/monitoring/appsec2-aws-47.md) - [AWS RDS instance with copy tags to snapshots disabled misconfiguration detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/monitoring/appsec2-aws-60.md) - [Azure SQL Server ADS Vulnerability Assessment is disabled misconfiguration detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/monitoring/appsec2-azure-2.md) - [Azure SQL Server ADS Vulnerability Assessment (VA) Periodic recurring scans is disabled misconfigura](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/monitoring/appsec2-azure-3.md) - [Azure SQL Server ADS Vulnerability Assessment (VA) 'Send scan reports to' is not configured misconfi](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/monitoring/appsec2-azure-4.md) - [Azure SQL Server ADS Vulnerability Assessment (VA) 'Also send email notifications to admins and subs](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/monitoring/appsec2-azure-5.md) - [Azure SQL server Defender setting is set to Off misconfiguration detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/monitoring/appsec2-azure-13.md) - [GCP GCR Container Vulnerability Scanning is disabled misconfiguration detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/monitoring/appsec2-gcp-11.md) - [Networking](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/networking.md) - [Alibaba Cloud Kubernetes does not install plugin Terway or Flannel to support standard policies misc](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/networking/appsec-ali-26.md) - [Alibaba Cloud Cypher Policy is not secured misconfiguration detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/networking/appsec-ali-33.md) - [Alibaba Cloud MongoDB is not deployed inside a VPC misconfiguration detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/networking/appsec-ali-41.md) - [AWS EKS cluster security group overly permissive to all traffic misconfiguration detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/networking/appsec-aws-38.md) - [AWS CloudFront web distribution with AWS Web Application Firewall (AWS WAF) service disabled misconf](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/networking/appsec-aws-68.md) - [AWS EKS node group have implicit SSH access from 0.0.0.0/0 misconfiguration detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/networking/appsec-aws-100.md) - [Deletion protection disabled for load balancer misconfiguration detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/networking/appsec-aws-113.md) - [VPC endpoint service is not configured for manual acceptance misconfiguration detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/networking/appsec-aws-123.md) - [Elastic load balancers do not use SSL Certificates provided by AWS Certificate Manager misconfigurat](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/networking/appsec-aws-127.md) - [ALB does not drop HTTP headers misconfiguration detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/networking/appsec-aws-131.md) - [AWS Elastic Load Balancer (Classic) with cross-zone load balancing disabled misconfiguration detecte](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/networking/appsec-aws-138.md) - [Default VPC is planned to be provisioned misconfiguration detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/networking/appsec-aws-148.md) - [AWS Elastic Load Balancer v2 with deletion protection feature disabled misconfiguration detected in](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/networking/appsec-aws-150.md) - [AWS Elastic Load Balancer v2 (ELBv2) with cross-zone load balancing disabled misconfiguration detect](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/networking/appsec-aws-152.md) - [WAF enables message lookup in Log4j2 misconfiguration detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/networking/appsec-aws-192.md) - [AWS RDS security groups are not defined misconfiguration detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/networking/appsec-aws-198.md) - [AWS ELB Policy uses some unsecure protocols misconfiguration detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/networking/appsec-aws-213.md) - [AWS Cloudfront distribution is disabled misconfiguration detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/networking/appsec-aws-216.md) - [AWS Elasticsearch uses the default security group misconfiguration detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/networking/appsec-aws-248.md) - [ALB is not configured with the defensive or strictest desync mitigation mode misconfiguration detect](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/networking/appsec-aws-328.md) - [Network firewalls do not have deletion protection enabled misconfiguration detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/networking/appsec-aws-344.md) - [Transfer server does not force secure protocols. misconfiguration detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/networking/appsec-aws-357.md) - [AWS CloudFront web distribution with geo restriction disabled misconfiguration detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/networking/appsec-aws-374.md) - [Route 53 domains do not have transfer lock protection misconfiguration detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/networking/appsec-aws-377.md) - [Azure AKS cluster network policies are not enforced misconfiguration detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/networking/appsec-azure-7.md) - [Azure RDP Internet access is not restricted misconfiguration detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/networking/appsec-azure-9.md) - [CORS allows resources to access function apps misconfiguration detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/networking/appsec-azure-62.md) - [Azure Function App doesn't use HTTP 2.0 misconfiguration detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/networking/appsec-azure-67.md) - [Azure App Services Remote debugging is enabled misconfiguration detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/networking/appsec-azure-72.md) - [Azure container container group is not deployed into a virtual network misconfiguration detected in](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/networking/appsec-azure-98.md) - [API management services do not use virtual networks misconfiguration detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/networking/appsec-azure-107.md) - [Key vault does not allow firewall rules settings misconfiguration detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/networking/appsec-azure-109.md) - [AKS is not enabled for private clusters misconfiguration detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/networking/appsec-azure-115.md) - [Azure application gateway does not have WAF enabled misconfiguration detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/networking/appsec-azure-120.md) - [Azure Front Door does not have the Azure Web application firewall (WAF) enabled misconfiguration det](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/networking/appsec-azure-121.md) - [Application gateway does not use WAF in Detection or Prevention modes misconfiguration detected in c](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/networking/appsec-azure-122.md) - [Azure front door does not use WAF in Detection or Prevention modes misconfiguration detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/networking/appsec-azure-123.md) - [Azure Front Door Web application firewall (WAF) policy rule for Remote Command Execution is disabled](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/networking/appsec-azure-133.md) - [Azure Application Gateway Web application firewall (WAF) policy rule for Remote Command Execution is](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/networking/appsec-azure-135.md) - [Firewall policy does not have IDPS mode set to deny misconfiguration detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/networking/appsec-azure-220.md) - [Azure Container Registry dedicated data endpoint is disabled misconfiguration detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/networking/appsec-azure-237.md) - [Azure Batch Account configured with overly permissive network access misconfiguration detected in co](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/networking/appsec-azure-248.md) - [Azure Storage Sync Service configured with overly permissive network access misconfiguration detecte](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/networking/appsec-azure-250.md) - [Azure VM disk configured with public network access misconfiguration detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/networking/appsec-azure-251.md) - [GCP Kubernetes Engine Clusters have Network policy disabled misconfiguration detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/networking/appsec-gcp-12.md) - [GCP Kubernetes Engine Clusters have Master authorized networks disabled misconfiguration detected in](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/networking/appsec-gcp-20.md) - [GCP Kubernetes Engine Clusters have Alias IP disabled misconfiguration detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/networking/appsec-gcp-23.md) - [GCP Kubernetes Engine private cluster has private endpoint disabled misconfiguration detected in cod](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/networking/appsec-gcp-25.md) - [GCP Kubernetes cluster intra-node visibility disabled misconfiguration detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/networking/appsec-gcp-61.md) - [GCP Kubernetes Engine Clusters not configured with private nodes feature misconfiguration detected i](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/networking/appsec-gcp-64.md) - [Containers wishing to share host network namespace admitted misconfiguration detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/networking/appsec-k8s-4.md) - [Containers share the host network namespace misconfiguration detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/networking/appsec-k8s-19.md) - [hostPort is specified misconfiguration detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/networking/appsec-k8s-26.md) - [The --kubelet-https argument is not set to True misconfiguration detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/networking/appsec-k8s-71.md) - [The API server does not make use of strong cryptographic ciphers misconfiguration detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/networking/appsec-k8s-105.md) - [The --bind-address argument for controller managers is not set to 127.0.0.1 misconfiguration detecte](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/networking/appsec-k8s-113.md) - [The --bind-address argument is not set to 127.0.0.1 misconfiguration detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/networking/appsec-k8s-115.md) - [The --auto-tls argument is set to True misconfiguration detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/networking/appsec-k8s-118.md) - [The --make-iptables-util-chains argument is not set to True misconfiguration detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/networking/appsec-k8s-145.md) - [The --tls-cert-file and --tls-private-key-file arguments for Kubelet are not set appropriately misco](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/networking/appsec-k8s-148.md) - [Kubelet does not use strong cryptographic ciphers misconfiguration detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/networking/appsec-k8s-151.md) - [NGINX Ingress annotation snippets contains LUA code execution misconfiguration detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/networking/appsec-k8s-152.md) - [NGINX Ingress has annotation snippets misconfiguration detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/networking/appsec-k8s-153.md) - [NGINX Ingress has annotation snippets which contain alias statements misconfiguration detected in co](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/networking/appsec-k8s-154.md) - [OCI Network Security Groups (NSG) has stateful security rules misconfiguration detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/networking/appsec-oci-21.md) - [OCI Data Catalog configured with overly permissive network access misconfiguration detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/networking/appsec-oci-23.md) - [OpenStack firewall rule does not have destination IP configured misconfiguration detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/networking/appsec-openstack-5.md) - [Plain-text management HTTP enabled for Interface Management Profile in Palo Alto Networks devices mi](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/networking/appsec-pan-2.md) - [Plain-text management Telnet enabled for Interface Management Profile in Palo Alto Networks devices](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/networking/appsec-pan-3.md) - [Disable Server Response Inspection (DSRI) enabled in security policies for Palo Alto Networks device](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/networking/appsec-pan-4.md) - [Security rule allows any application on Palo Alto Networks devices misconfiguration detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/networking/appsec-pan-5.md) - [Security rule permits any service on Palo Alto Networks devices misconfiguration detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/networking/appsec-pan-6.md) - [Security Rule in Palo Alto Networks devices with overly broad Source and Destination IPs misconfigur](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/networking/appsec-pan-7.md) - [IPsec profile uses insecure authentication algorithms on Palo Alto Networks devices misconfiguration](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/networking/appsec-pan-12.md) - [IPsec profile uses insecure authentication protocols on Palo Alto Networks devices misconfiguration](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/networking/appsec-pan-13.md) - [Security zone on Palo Alto Networks devices does not have an associated Zone Protection Profile misc](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/networking/appsec-pan-14.md) - [Include ACL (Access Control List) not defined for a security zone in Palo Alto Networks devices with](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/networking/appsec-pan-15.md) - [Security rules apply to all zones on Palo Alto Networks devices misconfiguration detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/networking/appsec-pan-17.md) - [AWS AppSync is not protected by WAF misconfiguration detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/networking/appsec2-aws-33.md) - [AWS NAT Gateways are not utilized for the default route misconfiguration detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/networking/appsec2-aws-35.md) - [AWS ACM Certificate with wildcard domain name misconfiguration detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/networking/appsec2-aws-71.md) - [AWS Load Balancers do not use strong ciphers misconfiguration detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/networking/appsec2-aws-74.md) - [AWS Lambda function URL having overly permissive cross-origin resource sharing permissions misconfig](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/networking/appsec2-aws-75.md) - [Azure Automation account configured with overly permissive network access misconfiguration detected](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/networking/appsec2-azure-24.md) - [Azure MySQL Flexible Server not configured with private endpoint misconfiguration detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/networking/appsec2-azure-56.md) - [PostgreSQL Flexible Server not configured with private endpoint misconfiguration detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/networking/appsec2-azure-57.md) - [GCP project is configured with legacy network misconfiguration detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/networking/appsec2-gcp-2.md) - [Vertex AI workbench instances are not private misconfiguration detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/networking/appsec2-gcp-28.md) - [GCP public-facing (external) regional load balancer using HTTP protocol misconfiguration detected in](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/networking/appsec2-gcp-37.md) - [GCP public-facing (external) global load balancer using HTTP protocol misconfiguration detected in c](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/networking/appsec2-gcp-38.md) - [IBM Cloud Virtual Private Cloud (VPC) classic access is enabled in Terraform misconfiguration detect](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/networking/appsec2-ibm-2.md) - [Public Exposure](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/public-exposure.md) - [Alibaba Cloud OSS bucket accessible to public misconfiguration detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/public-exposure/appsec-ali-1.md) - [Alibaba Cloud Security group allow internet traffic to SSH port (22) misconfiguration detected in co](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/public-exposure/appsec-ali-2.md) - [Alibaba Cloud Security group allow internet traffic to RDP port (3389) misconfiguration detected in](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/public-exposure/appsec-ali-3.md) - [Alibaba Cloud database instance accessible to public misconfiguration detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/public-exposure/appsec-ali-9.md) - [Alibaba Cloud RDS instance does not use SSL misconfiguration detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/public-exposure/appsec-ali-20.md) - [Alibaba Cloud API Gateway API Protocol does not use HTTPS misconfiguration detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/public-exposure/appsec-ali-21.md) - [Alibaba cloud ALB ACL does not restrict public access misconfiguration detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/public-exposure/appsec-ali-29.md) - [Alibaba Cloud Mongodb instance does not use SSL misconfiguration detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/public-exposure/appsec-ali-42.md) - [Alibaba Cloud MongoDB instance is public misconfiguration detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/public-exposure/appsec-ali-43.md) - [AWS Elastic Load Balancer v2 (ELBv2) listener that allow connection requests over HTTP misconfigurat](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/public-exposure/appsec-aws-2.md) - [AWS Elasticsearch does not have node-to-node encryption enabled misconfiguration detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/public-exposure/appsec-aws-6.md) - [AWS RDS database instance is publicly accessible misconfiguration detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/public-exposure/appsec-aws-17.md) - [Not every Security Group rule has a description misconfiguration detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/public-exposure/appsec-aws-23.md) - [AWS Security Group allows all traffic on SSH port (22) misconfiguration detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/public-exposure/appsec-aws-24.md) - [AWS Security Group allows all traffic on RDP port (3389) misconfiguration detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/public-exposure/appsec-aws-25.md) - [AWS ElastiCache Redis cluster with in-transit encryption disabled (Replication group) misconfigurati](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/public-exposure/appsec-aws-30.md) - [AWS ElastiCache Redis cluster with Redis AUTH feature disabled misconfiguration detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/public-exposure/appsec-aws-31.md) - [AWS CloudFront viewer protocol policy is not configured with HTTPS misconfiguration detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/public-exposure/appsec-aws-34.md) - [AWS EKS cluster endpoint access publicly enabled misconfiguration detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/public-exposure/appsec-aws-39.md) - [AWS access keys and secrets are hard coded in infrastructure misconfiguration detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/public-exposure/appsec-aws-41.md) - [Lambda function's environment variables expose secrets misconfiguration detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/public-exposure/appsec-aws-45.md) - [EC2 user data exposes secrets misconfiguration detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/public-exposure/appsec-aws-46.md) - [AWS API gateway methods are publicly accessible misconfiguration detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/public-exposure/appsec-aws-59.md) - [AWS MQ is publicly accessible misconfiguration detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/public-exposure/appsec-aws-69.md) - [AWS Elasticsearch domain is not configured with HTTPS misconfiguration detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/public-exposure/appsec-aws-83.md) - [AWS Redshift cluster instance with public access setting enabled misconfiguration detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/public-exposure/appsec-aws-87.md) - [AWS EC2 instances with public IP and associated with security groups have Internet access misconfigu](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/public-exposure/appsec-aws-88.md) - [AWS DMS replication instance is publicly accessible misconfiguration detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/public-exposure/appsec-aws-89.md) - [Neptune cluster instance is publicly available misconfiguration detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/public-exposure/appsec-aws-102.md) - [AWS Load Balancer is not using TLS 1.2 misconfiguration detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/public-exposure/appsec-aws-103.md) - [AWS VPC subnets should not allow automatic public IP assignment misconfiguration detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/public-exposure/appsec-aws-130.md) - [AWS Elasticsearch is not configured inside a VPC misconfiguration detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/public-exposure/appsec-aws-137.md) - [Redshift is deployed outside of a VPC misconfiguration detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/public-exposure/appsec-aws-154.md) - [AWS Transfer Server is publicly exposed misconfiguration detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/public-exposure/appsec-aws-164.md) - [AWS CloudFront web distribution using insecure TLS version misconfiguration detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/public-exposure/appsec-aws-174.md) - [AWS Elasticache security groups are not defined misconfiguration detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/public-exposure/appsec-aws-196.md) - [AWS API Gateway Domain does not use a modern security policy misconfiguration detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/public-exposure/appsec-aws-206.md) - [AWS Cloudsearch does not use the latest (Transport Layer Security) TLS misconfiguration detected in](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/public-exposure/appsec-aws-218.md) - [AWS Cloudsearch does not use HTTPs misconfiguration detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/public-exposure/appsec-aws-220.md) - [AWS Elasticsearch domain does not use an updated TLS policy misconfiguration detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/public-exposure/appsec-aws-228.md) - [AWS NACL allows ingress from 0.0.0.0/0 to port 21 misconfiguration detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/public-exposure/appsec-aws-229.md) - [AWS NACL allows ingress from 0.0.0.0/0 to port 20 misconfiguration detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/public-exposure/appsec-aws-230.md) - [AWS NACL allows ingress from 0.0.0.0/0 to port 3389 misconfiguration detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/public-exposure/appsec-aws-231.md) - [AWS NACL allows ingress from 0.0.0.0/0 to port 22 misconfiguration detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/public-exposure/appsec-aws-232.md) - [AWS DAX cluster endpoint does not use TLS (Transport Layer Security) misconfiguration detected in co](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/public-exposure/appsec-aws-239.md) - [AWS CloudFront response header policy does not enforce Strict Transport Security misconfiguration de](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/public-exposure/appsec-aws-259.md) - [AWS security groups allow ingress from 0.0.0.0/0 to port 80 misconfiguration detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/public-exposure/appsec-aws-260.md) - [AWS Security Group allows all traffic on all ports misconfiguration detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/public-exposure/appsec-aws-277.md) - [MSK nodes are not private misconfiguration detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/public-exposure/appsec-aws-291.md) - [AWS RDS snapshots are accessible to public misconfiguration detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/public-exposure/appsec-aws-302.md) - [AWS SSM documents are public misconfiguration detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/public-exposure/appsec-aws-303.md) - [AWS CloudFront distributions does not have a default root object configured misconfiguration detecte](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/public-exposure/appsec-aws-305.md) - [AWS SageMaker notebook instance is not placed in VPC misconfiguration detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/public-exposure/appsec-aws-306.md) - [CloudFront distributions do not have origin failover configured misconfiguration detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/public-exposure/appsec-aws-310.md) - [ElastiCache cluster is using the default subnet group misconfiguration detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/public-exposure/appsec-aws-323.md) - [AWS Transit Gateway auto accept vpc attachment is enabled misconfiguration detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/public-exposure/appsec-aws-331.md) - [WAF rule does not have any actions misconfiguration detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/public-exposure/appsec-aws-342.md) - [NACL ingress allows all ports misconfiguration detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/public-exposure/appsec-aws-352.md) - [TLS not enforced in SES configuration set misconfiguration detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/public-exposure/appsec-aws-365.md) - [AWS Elastic Load Balancer with listener TLS/SSL is not configured misconfiguration detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/public-exposure/appsec-aws-376.md) - [AWS Load Balancer uses HTTP protocol misconfiguration detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/public-exposure/appsec-aws-378.md) - [AWS S3 bucket not configured with secure data transport policy misconfiguration detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/public-exposure/appsec-aws-379.md) - [AWS Transfer Server not using latest Security Policy misconfiguration detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/public-exposure/appsec-aws-380.md) - [Azure Virtual Machine (Linux) does not authenticate using SSH keys misconfiguration detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/public-exposure/appsec-azure-1.md) - [Kubernetes dashboard is not disabled misconfiguration detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/public-exposure/appsec-azure-8.md) - [Azure Network Security Group allows all traffic on SSH port 22 misconfiguration detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/public-exposure/appsec-azure-10.md) - [Azure SQL Servers Firewall rule allow ingress access from 0.0.0.0/0 misconfiguration detected in cod](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/public-exposure/appsec-azure-11.md) - [Azure App Service Web app doesn't redirect HTTP to HTTPS misconfiguration detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/public-exposure/appsec-azure-14.md) - [Azure App Service Web app doesn't use latest TLS version misconfiguration detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/public-exposure/appsec-azure-15.md) - [Azure App Service Web app client certificate is disabled misconfiguration detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/public-exposure/appsec-azure-17.md) - [Azure App Service Web app doesn't use HTTP 2.0 misconfiguration detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/public-exposure/appsec-azure-18.md) - [Azure MySQL Database Server SSL connection is disabled misconfiguration detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/public-exposure/appsec-azure-28.md) - [Azure PostgreSQL database server with SSL connection disabled misconfiguration detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/public-exposure/appsec-azure-29.md) - [Azure storage account has a blob container that is publicly accessible misconfiguration detected in](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/public-exposure/appsec-azure-34.md) - [Azure Storage Account default network access is set to 'Allow' misconfiguration detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/public-exposure/appsec-azure-35.md) - [Azure MariaDB database server with SSL connection disabled misconfiguration detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/public-exposure/appsec-azure-47.md) - [MariaDB servers do not have public network access enabled set to False misconfiguration detected in](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/public-exposure/appsec-azure-48.md) - ['public network access enabled' is not set to 'False' for mySQL servers misconfiguration detected in](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/public-exposure/appsec-azure-53.md) - [MySQL is not using the latest version of TLS encryption misconfiguration detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/public-exposure/appsec-azure-54.md) - [CORS allows resource to access app services misconfiguration detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/public-exposure/appsec-azure-57.md) - [Azure storage account does allow public access misconfiguration detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/public-exposure/appsec-azure-59.md) - [Azure file sync enables public network access misconfiguration detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/public-exposure/appsec-azure-64.md) - [PostgreSQL server does not disable public network access misconfiguration detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/public-exposure/appsec-azure-68.md) - [Azure Function App doesn't redirect HTTP to HTTPS misconfiguration detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/public-exposure/appsec-azure-70.md) - [Azure Network Security Group having Inbound rule overly permissive to all traffic on UDP protocol mi](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/public-exposure/appsec-azure-77.md) - [Azure App Services FTP deployment is All allowed misconfiguration detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/public-exposure/appsec-azure-78.md) - [Azure cache for Redis has public network access enabled misconfiguration detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/public-exposure/appsec-azure-89.md) - [Cosmos DB accounts do not have restricted access misconfiguration detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/public-exposure/appsec-azure-99.md) - [Azure Cosmos DB enables public network access misconfiguration detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/public-exposure/appsec-azure-101.md) - [Azure Data Factory (V2) configured with overly permissive network access misconfiguration detected i](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/public-exposure/appsec-azure-104.md) - [Azure Event Grid domain public network access is enabled misconfiguration detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/public-exposure/appsec-azure-106.md) - [Azure IoT Hub enables public network access misconfiguration detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/public-exposure/appsec-azure-108.md) - [SQL Server is enabled for public network access misconfiguration detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/public-exposure/appsec-azure-113.md) - [Azure Virtual machine NIC has IP forwarding enabled misconfiguration detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/public-exposure/appsec-azure-118.md) - [Network interfaces use public IPs misconfiguration detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/public-exposure/appsec-azure-119.md) - [Azure cognitive search does not disable public network access misconfiguration detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/public-exposure/appsec-azure-124.md) - [Azure Container registries Public access to All networks is enabled misconfiguration detected in cod](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/public-exposure/appsec-azure-139.md) - [Azure AKS cluster nodes have public IP addresses misconfiguration detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/public-exposure/appsec-azure-143.md) - [Azure Function App doesn't use latest TLS version misconfiguration detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/public-exposure/appsec-azure-145.md) - [Azure Redis Cache does not use the latest version of TLS encryption misconfiguration detected in cod](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/public-exposure/appsec-azure-148.md) - [Azure Client Certificates are not enforced for API management misconfiguration detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/public-exposure/appsec-azure-152.md) - [Azure web app does not redirect all HTTP traffic to HTTPS in Azure App Service Slot misconfiguration](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/public-exposure/appsec-azure-153.md) - [Azure App's service slot does not use the latest version of TLS encryption misconfiguration detected](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/public-exposure/appsec-azure-154.md) - [Azure App service slot does not have debugging disabled misconfiguration detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/public-exposure/appsec-azure-155.md) - [Azure HTTP (port 80) access from the internet is not restricted misconfiguration detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/public-exposure/appsec-azure-160.md) - [Azure Spring Cloud API Portal is not enabled for HTTPS misconfiguration detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/public-exposure/appsec-azure-161.md) - [Azure Spring Cloud API Portal Public Access Is Enabled misconfiguration detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/public-exposure/appsec-azure-162.md) - [API Management Without Minimum TLS 1.2 misconfiguration detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/public-exposure/appsec-azure-173.md) - [API Management with Public Access misconfiguration detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/public-exposure/appsec-azure-174.md) - [Web PubSub Without SLA SKU misconfiguration detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/public-exposure/appsec-azure-175.md) - [VNET With Only One DNS Endpoint misconfiguration detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/public-exposure/appsec-azure-182.md) - [VNET Using External DNS Addresses misconfiguration detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/public-exposure/appsec-azure-183.md) - [App Configuration Public Access Enabled misconfiguration detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/public-exposure/appsec-azure-185.md) - [Azure Key Vault Public Network Access Control misconfiguration detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/public-exposure/appsec-azure-189.md) - [Azure storage account has a blob container with public access misconfiguration detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/public-exposure/appsec-azure-190.md) - [Azure Event Grid Topic Public Network Access misconfiguration detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/public-exposure/appsec-azure-193.md) - [Azure SignalR Service not Using Paid SKU for its SLA misconfiguration detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/public-exposure/appsec-azure-196.md) - [Azure CDN Doesn't Disable HTTP Endpoint misconfiguration detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/public-exposure/appsec-azure-197.md) - [Azure CDN Endpoint Custom domains is not configured with HTTPS misconfiguration detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/public-exposure/appsec-azure-198.md) - [Azure CDN Using Outdated TLS Encryption misconfiguration detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/public-exposure/appsec-azure-200.md) - [Azure Service Bus with Public Network Access Enabled misconfiguration detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/public-exposure/appsec-azure-204.md) - [Azure Service Bus Without Latest TLS Encryption misconfiguration detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/public-exposure/appsec-azure-205.md) - [Azure Cognitive Search With Global IP Allowance misconfiguration detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/public-exposure/appsec-azure-210.md) - [Azure App Service Instance Lacks Redundancy misconfiguration detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/public-exposure/appsec-azure-212.md) - [Backend of the API management system does not utilize HTTPS misconfiguration detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/public-exposure/appsec-azure-215.md) - [DenyIntelMode for Azure Firewalls is not set to Deny misconfiguration detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/public-exposure/appsec-azure-216.md) - [Azure Application gateways listener that allow connection requests over HTTP misconfiguration detect](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/public-exposure/appsec-azure-217.md) - [Azure Application Gateway is configured with SSL policy having TLS version 1.1 or lower misconfigura](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/public-exposure/appsec-azure-218.md) - [Azure Firewall does not define a firewall policy misconfiguration detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/public-exposure/appsec-azure-219.md) - [Azure Function app configured with public network access misconfiguration detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/public-exposure/appsec-azure-221.md) - [Azure App Service web apps with public network access misconfiguration detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/public-exposure/appsec-azure-222.md) - [Event Hub Namespace not using TLS 1.2 or greater misconfiguration detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/public-exposure/appsec-azure-223.md) - [Azure Container Instance environment variable with regular value type misconfiguration detected in c](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/public-exposure/appsec-azure-235.md) - [Azure Container Instance is not configured with virtual network misconfiguration detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/public-exposure/appsec-azure-245.md) - [Azure AKS cluster HTTP application routing enabled misconfiguration detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/public-exposure/appsec-azure-246.md) - [Port 22 is exposed misconfiguration detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/public-exposure/appsec-docker-1.md) - [GCP Firewall rule allows all traffic on SSH port (22) misconfiguration detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/public-exposure/appsec-gcp-2.md) - [GCP Firewall rule allows all traffic on RDP port (3389) misconfiguration detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/public-exposure/appsec-gcp-3.md) - [GCP HTTPS Load balancer is set with SSL policy having TLS version 1.1 or lower misconfiguration dete](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/public-exposure/appsec-gcp-4.md) - [GCP SQL Instances do not have SSL configured for incoming connections misconfiguration detected in c](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/public-exposure/appsec-gcp-6.md) - [GCP SQL database is publicly accessible misconfiguration detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/public-exposure/appsec-gcp-11.md) - [GCP BigQuery dataset is publicly accessible misconfiguration detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/public-exposure/appsec-gcp-15.md) - [GCP Cloud DNS has DNSSEC disabled misconfiguration detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/public-exposure/appsec-gcp-16.md) - [RSASHA1 is used for Zone-Signing and Key-Signing Keys in Cloud DNS DNSSEC misconfiguration detected](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/public-exposure/appsec-gcp-17.md) - [GKE control plane is public misconfiguration detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/public-exposure/appsec-gcp-18.md) - [GCP project is using the default network misconfiguration detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/public-exposure/appsec-gcp-27.md) - [GCP Storage bucket is anonymously or publicly accessible misconfiguration detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/public-exposure/appsec-gcp-28.md) - [GCP VM instances do have block project-wide SSH keys feature disabled misconfiguration detected in c](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/public-exposure/appsec-gcp-32.md) - [GCP Projects do have OS Login disabled misconfiguration detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/public-exposure/appsec-gcp-33.md) - [GCP Projects have OS Login disabled misconfiguration detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/public-exposure/appsec-gcp-34.md) - [GCP VM instances have serial port access enabled misconfiguration detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/public-exposure/appsec-gcp-35.md) - [GCP VM instances have IP Forwarding enabled misconfiguration detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/public-exposure/appsec-gcp-36.md) - [GCP VM instance with Shielded VM features disabled misconfiguration detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/public-exposure/appsec-gcp-39.md) - [GCP VM instance with the external IP address misconfiguration detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/public-exposure/appsec-gcp-40.md) - [GCP Cloud SQL database instances have public IPs misconfiguration detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/public-exposure/appsec-gcp-60.md) - [GCP VPC Network subnets have Private Google access disabled misconfiguration detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/public-exposure/appsec-gcp-74.md) - [GCP Firewall rule allows all traffic on FTP port (21) misconfiguration detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/public-exposure/appsec-gcp-75.md) - [GCP VPC Network subnets have Private Google access for IPv6 disabled misconfiguration detected in co](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/public-exposure/appsec-gcp-76.md) - [GCP Google compute firewall ingress allow FTP port (20) access misconfiguration detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/public-exposure/appsec-gcp-77.md) - [GCP cloud build workers are not private misconfiguration detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/public-exposure/appsec-gcp-86.md) - [GCP data fusion instances are not private misconfiguration detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/public-exposure/appsec-gcp-87.md) - [GCP Firewall rule allows all traffic on MySQL DB port (3306) misconfiguration detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/public-exposure/appsec-gcp-88.md) - [GCP Vertex AI instances are not private misconfiguration detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/public-exposure/appsec-gcp-89.md) - [GCP Dataflow jobs are not private misconfiguration detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/public-exposure/appsec-gcp-94.md) - [GCP Dataproc clusters are anonymously or publicly accessible misconfiguration detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/public-exposure/appsec-gcp-98.md) - [GCP Pub/Sub Topics are anonymously or publicly accessible misconfiguration detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/public-exposure/appsec-gcp-99.md) - [GCP BigQuery Tables are anonymously or publicly accessible misconfiguration detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/public-exposure/appsec-gcp-100.md) - [GCP Artifact Registry repositories are anonymously or publicly accessible misconfiguration detected](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/public-exposure/appsec-gcp-101.md) - [GCP Cloud Run services are anonymously or publicly accessible misconfiguration detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/public-exposure/appsec-gcp-102.md) - [GCP Firewall rule allows all traffic on HTTP port (80) misconfiguration detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/public-exposure/appsec-gcp-106.md) - [GCP Cloud Function is publicly accessible misconfiguration detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/public-exposure/appsec-gcp-107.md) - [GCP Storage buckets are publicly accessible to all users misconfiguration detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/public-exposure/appsec-gcp-114.md) - [GCP Cloud Function configured with overly permissive Ingress setting misconfiguration detected in co](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/public-exposure/appsec-gcp-124.md) - [GitHub repository webhook defined in Terraform does not use a secure SSL misconfiguration detected i](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/public-exposure/appsec-git-2.md) - [Tiller (Helm V2) deployment is accessible from within the cluster misconfiguration detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/public-exposure/appsec-k8s-45.md) - [The --insecure-bind-address argument is set misconfiguration detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/public-exposure/appsec-k8s-86.md) - [The --insecure-port argument is not set to 0 misconfiguration detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/public-exposure/appsec-k8s-88.md) - [The --secure-port argument is set to 0 misconfiguration detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/public-exposure/appsec-k8s-89.md) - [The --tls-cert-file and --tls-private-key-file arguments for API server are not set appropriately mi](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/public-exposure/appsec-k8s-100.md) - [The --read-only-port argument is not set to 0 misconfiguration detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/public-exposure/appsec-k8s-141.md) - [OCI VCN has no inbound security list misconfiguration detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/public-exposure/appsec-oci-16.md) - [OCI VCN Security list has stateful security rules misconfiguration detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/public-exposure/appsec-oci-17.md) - [OCI Security List allows all traffic on SSH port (22) misconfiguration detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/public-exposure/appsec-oci-19.md) - [OCI security lists allows unrestricted ingress access to port 3389 misconfiguration detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/public-exposure/appsec-oci-20.md) - [OCI security group allows unrestricted ingress access to port 22 misconfiguration detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/public-exposure/appsec-oci-22.md) - [OpenAPI Security Definitions Object should be set and not empty misconfiguration detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/public-exposure/appsec-openapi-1.md) - [OpenAPI If the security scheme is not of type 'oauth2', the array value must be empty misconfigurati](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/public-exposure/appsec-openapi-2.md) - [Cleartext credentials over unencrypted channel should not be accepted for the operation misconfigura](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/public-exposure/appsec-openapi-3.md) - [The path scheme is supports unencrypted HTTP connections misconfiguration detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/public-exposure/appsec-openapi-7.md) - [Global schemes use 'httpa' protocol instead of 'https' misconfiguration detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/public-exposure/appsec-openapi-18.md) - [API keys transmitted over cleartext misconfiguration detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/public-exposure/appsec-openapi-20.md) - [OpenStack Security groups allow ingress from 0.0.0.0:0 to port 22 (tcp / udp) misconfiguration detec](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/public-exposure/appsec-openstack-2.md) - [OpenStack Security groups allow ingress from 0.0.0.0:0 to port 3389 (tcp / udp) misconfiguration det](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/public-exposure/appsec-openstack-3.md) - [HTTPS url not used with Ansible uri misconfiguration detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/public-exposure/appsec2-ansible-1.md) - [HTTPS url not used with Ansible get\_url module misconfiguration detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/public-exposure/appsec2-ansible-2.md) - [AWS Network ACL is not in use misconfiguration detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/public-exposure/appsec2-aws-1.md) - [Security Groups are not attached to EC2 instances or ENIs misconfiguration detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/public-exposure/appsec2-aws-5.md) - [S3 Bucket does not have public access blocks misconfiguration detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/public-exposure/appsec2-aws-6.md) - [Amazon EMR clusters' security groups are open to the world misconfiguration detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/public-exposure/appsec2-aws-7.md) - [AWS Default Security Group does not restrict all traffic misconfiguration detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/public-exposure/appsec2-aws-12.md) - [Auto scaling groups associated with a load balancer do not use elastic load balancing health checks](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/public-exposure/appsec2-aws-15.md) - [Not all EIP addresses allocated to a VPC are attached to EC2 instances misconfiguration detected in](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/public-exposure/appsec2-aws-19.md) - [ALB does not redirect HTTP requests into HTTPS ones misconfiguration detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/public-exposure/appsec2-aws-20.md) - [Route53 A Record does not have Attached Resource misconfiguration detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/public-exposure/appsec2-aws-23.md) - [AWS Application Load Balancer (ALB) not configured with AWS Web Application Firewall v2 (AWS WAFv2)](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/public-exposure/appsec2-aws-28.md) - [Public API gateway not configured with AWS Web Application Firewall v2 (AWS WAFv2) misconfiguration](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/public-exposure/appsec2-aws-29.md) - [AWS CloudFront distribution does not have a strict security headers policy attached misconfiguration](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/public-exposure/appsec2-aws-32.md) - [AWS Terraform sends SSM secrets to untrusted domains over HTTP misconfiguration detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/public-exposure/appsec2-aws-36.md) - [Domain Name System Security Extensions (DNSSEC) signing is not enabled for Amazon Route 53 public ho](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/public-exposure/appsec2-aws-38.md) - [AWS CloudFront web distribution with default SSL certificate misconfiguration detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/public-exposure/appsec2-aws-42.md) - [AWS route table with VPC peering overly permissive to all traffic misconfiguration detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/public-exposure/appsec2-aws-44.md) - [AWS Database Migration Service endpoint do not have SSL configured misconfiguration detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/public-exposure/appsec2-aws-49.md) - [AWS API Gateway endpoints without client certificate authentication misconfiguration detected in cod](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/public-exposure/appsec2-aws-51.md) - [AWS API gateway request parameter is not validated misconfiguration detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/public-exposure/appsec2-aws-53.md) - [AWS CloudFront distribution is using insecure SSL protocols for HTTPS communication misconfiguration](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/public-exposure/appsec2-aws-54.md) - [MWAA environment is publicly accessible misconfiguration detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/public-exposure/appsec2-aws-66.md) - [AWS CloudFront origin protocol policy does not enforce HTTPS-only misconfiguration detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/public-exposure/appsec2-aws-72.md) - [Azure PostgreSQL Database Server 'Allow access to Azure services' enabled misconfiguration detected](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/public-exposure/appsec2-azure-6.md) - [Azure Storage account container storing activity logs is publicly accessible misconfiguration detect](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/public-exposure/appsec2-azure-8.md) - [Azure Spring Cloud service is not configured with virtual network misconfiguration detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/public-exposure/appsec2-azure-23.md) - [Azure PostgreSQL database flexible server configured with overly permissive network access misconfig](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/public-exposure/appsec2-azure-26.md) - [Azure ACR HTTPS not enabled for webhook misconfiguration detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/public-exposure/appsec2-azure-28.md) - [Azure AKS cluster Azure CNI networking not enabled misconfiguration detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/public-exposure/appsec2-azure-29.md) - [Azure Virtual Network subnet is not configured with a Network Security Group misconfiguration detect](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/public-exposure/appsec2-azure-31.md) - [Azure Key vault Private endpoint connection is not configured misconfiguration detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/public-exposure/appsec2-azure-32.md) - [Azure Storage account is not configured with private endpoint connection misconfiguration detected i](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/public-exposure/appsec2-azure-33.md) - [Azure SQL Server allow access to any Azure internal resources misconfiguration detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/public-exposure/appsec2-azure-34.md) - [Azure Virtual machine configured with public IP and serial console access misconfiguration detected](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/public-exposure/appsec2-azure-39.md) - [Azure PostgreSQL servers not configured with private endpoint misconfiguration detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/public-exposure/appsec2-azure-42.md) - [Azure Database for MariaDB not configured with private endpoint misconfiguration detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/public-exposure/appsec2-azure-43.md) - [Azure Database for MySQL server not configured with private endpoint misconfiguration detected in co](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/public-exposure/appsec2-azure-44.md) - [Azure SQL Database server not configured with private endpoint misconfiguration detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/public-exposure/appsec2-azure-45.md) - [Azure Spring Cloud app end-to-end TLS is disabled misconfiguration detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/public-exposure/appsec2-azure-55.md) - [GCP KMS crypto key is anonymously accessible misconfiguration detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/public-exposure/appsec2-gcp-6.md) - [GCP Cloud KMS Key Rings are anonymously or publicly accessible misconfiguration detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/public-exposure/appsec2-gcp-8.md) - [GCP Container Registry repositories are anonymously or publicly accessible misconfiguration detected](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/public-exposure/appsec2-gcp-9.md) - [GCP Cloud Function HTTP trigger is not secured misconfiguration detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/public-exposure/appsec2-gcp-10.md) - [GCP Firewall with Inbound rule overly permissive to All Traffic misconfiguration detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/public-exposure/appsec2-gcp-12.md) - [Google Cloud Platform network is not ensured to define a firewall misconfiguration detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/public-exposure/appsec2-gcp-18.md) - [TPU v2 VM is public misconfiguration detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/public-exposure/appsec2-gcp-32.md) - [IBM Cloud Application Load Balancer for VPC has public access enabled in Terraform misconfiguration](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/public-exposure/appsec2-ibm-1.md) - [IBM Cloud Kubernetes clusters are accessible by using public endpoint in Terraform misconfiguration](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/public-exposure/appsec2-ibm-7.md) - [OCI Network Security Group allows all traffic on RDP port (3389) misconfiguration detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/public-exposure/appsec2-oci-2.md) - [OCI Kubernetes Engine Cluster endpoint is not configured with Network Security Groups misconfigurati](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/public-exposure/appsec2-oci-3.md) - [OCI Kubernetes Engine Cluster pod security policy not enforced misconfiguration detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/public-exposure/appsec2-oci-6.md) - [Storage](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/storage.md) - [Alibaba Cloud OSS bucket is not encrypted with Customer Master Key misconfiguration detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/storage/appsec-ali-6.md) - [Alibaba Cloud disk encryption is disabled misconfiguration detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/storage/appsec-ali-7.md) - [Alibaba Cloud Disk is not encrypted with Customer Master Key misconfiguration detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/storage/appsec-ali-8.md) - [Alibaba Cloud OSS bucket has versioning disabled misconfiguration detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/storage/appsec-ali-10.md) - [Alibaba Cloud OSS bucket has transfer Acceleration disabled misconfiguration detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/storage/appsec-ali-11.md) - [Alibaba Cloud Transparent Data Encryption is disabled on instance misconfiguration detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/storage/appsec-ali-22.md) - [Alibaba Cloud launch template data disks are not encrypted misconfiguration detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/storage/appsec-ali-32.md) - [Alibaba Cloud MongoDB does not have transparent data encryption enabled misconfiguration detected in](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/storage/appsec-ali-44.md) - [AWS EBS volumes are not encrypted misconfiguration detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/storage/appsec-aws-3.md) - [AWS Elasticsearch domain Encryption for data at rest is disabled misconfiguration detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/storage/appsec-aws-5.md) - [AWS EC2 Auto Scaling Launch Configuration is not using encrypted EBS volumes misconfiguration detect](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/storage/appsec-aws-8.md) - [AWS RDS DB cluster encryption is disabled misconfiguration detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/storage/appsec-aws-16.md) - [AWS Access logging not enabled on S3 buckets misconfiguration detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/storage/appsec-aws-18.md) - [AWS S3 buckets do not have server side encryption misconfiguration detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/storage/appsec-aws-19.md) - [AWS S3 bucket ACL grants READ permission to everyone misconfiguration detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/storage/appsec-aws-20.md) - [AWS S3 Object Versioning is disabled misconfiguration detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/storage/appsec-aws-21.md) - [AWS SNS topic has SSE disabled misconfiguration detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/storage/appsec-aws-26.md) - [AWS SQS Queue not configured with server side encryption misconfiguration detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/storage/appsec-aws-27.md) - [DynamoDB PITR is disabled misconfiguration detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/storage/appsec-aws-28.md) - [AWS ElastiCache Redis cluster with encryption for data at rest disabled misconfiguration detected in](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/storage/appsec-aws-29.md) - [AWS CloudTrail logs are not encrypted using Customer Master Keys (CMKs) misconfiguration detected in](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/storage/appsec-aws-35.md) - [AWS Elastic File System (EFS) with encryption for data at rest is disabled misconfiguration detected](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/storage/appsec-aws-42.md) - [AWS Kinesis streams are not encrypted using Server Side Encryption misconfiguration detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/storage/appsec-aws-43.md) - [Neptune storage is not securely encrypted misconfiguration detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/storage/appsec-aws-44.md) - [AWS DAX cluster not configured with encryption at rest misconfiguration detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/storage/appsec-aws-47.md) - [ECR image tags are not immutable misconfiguration detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/storage/appsec-aws-51.md) - [AWS S3 Bucket has the block public ACLs disabled misconfiguration detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/storage/appsec-aws-53.md) - [AWS S3 Bucket BlockPublicPolicy is not set to True misconfiguration detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/storage/appsec-aws-54.md) - [AWS S3 bucket IgnorePublicAcls is not set to True misconfiguration detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/storage/appsec-aws-55.md) - [AWS S3 bucket RestrictPublicBucket is not set to True misconfiguration detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/storage/appsec-aws-56.md) - [AWS S3 Bucket has an ACL defined which allows public WRITE access misconfiguration detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/storage/appsec-aws-57.md) - [AWS EKS cluster does not have secrets encryption enabled misconfiguration detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/storage/appsec-aws-58.md) - [AWS Redshift instances are not encrypted misconfiguration detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/storage/appsec-aws-64.md) - [AWS S3 bucket policy overly permissive to any principal misconfiguration detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/storage/appsec-aws-70.md) - [DocumentDB is not encrypted at rest misconfiguration detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/storage/appsec-aws-74.md) - [Athena Database is not encrypted at rest misconfiguration detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/storage/appsec-aws-77.md) - [CodeBuild project encryption is disabled misconfiguration detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/storage/appsec-aws-78.md) - [AWS MSK cluster encryption in transit is not enabled misconfiguration detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/storage/appsec-aws-81.md) - [Athena workgroup does not prevent disabling encryption misconfiguration detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/storage/appsec-aws-82.md) - [DocDB TLS is disabled misconfiguration detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/storage/appsec-aws-90.md) - [S3 bucket policy allows lockout all but root user misconfiguration detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/storage/appsec-aws-93.md) - [Glue Data Catalog encryption is not enabled misconfiguration detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/storage/appsec-aws-94.md) - [Not all data stored in Aurora is securely encrypted at rest misconfiguration detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/storage/appsec-aws-96.md) - [EFS volumes in ECS task definitions do not have encryption in transit enabled misconfiguration detec](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/storage/appsec-aws-97.md) - [AWS Glue security configuration encryption is not enabled misconfiguration detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/storage/appsec-aws-99.md) - [DocDB does not have audit logs enabled misconfiguration detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/storage/appsec-aws-104.md) - [AWS Redshift does not have require\_ssl configured misconfiguration detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/storage/appsec-aws-105.md) - [AWS EBS volume region with encryption is disabled misconfiguration detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/storage/appsec-aws-106.md) - [Session Manager data is not encrypted in transit misconfiguration detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/storage/appsec-aws-112.md) - [AWS DynamoDB encrypted using AWS owned CMK instead of AWS managed CMK misconfiguration detected in c](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/storage/appsec-aws-119.md) - [AWS RDS instance without Automatic Backup setting misconfiguration detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/storage/appsec-aws-133.md) - [AWS ElastiCache Redis cluster is not configured with automatic backup misconfiguration detected in c](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/storage/appsec-aws-134.md) - [EC2 EBS is not optimized misconfiguration detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/storage/appsec-aws-135.md) - [Unencrypted ECR repositories misconfiguration detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/storage/appsec-aws-136.md) - [AWS RDS cluster delete protection is disabled misconfiguration detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/storage/appsec-aws-139.md) - [Unencrypted RDS global clusters misconfiguration detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/storage/appsec-aws-140.md) - [Redshift clusters version upgrade is not default misconfiguration detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/storage/appsec-aws-141.md) - [AWS Redshift Cluster not encrypted using Customer Managed Key misconfiguration detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/storage/appsec-aws-142.md) - [S3 bucket lock configuration disabled misconfiguration detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/storage/appsec-aws-143.md) - [S3 bucket cross-region replication disabled misconfiguration detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/storage/appsec-aws-144.md) - [S3 buckets are not encrypted with KMS misconfiguration detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/storage/appsec-aws-145.md) - [AWS RDS DB snapshot is not encrypted misconfiguration detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/storage/appsec-aws-146.md) - [CodeBuild projects are not encrypted misconfiguration detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/storage/appsec-aws-147.md) - [AWS Secrets Manager secret not encrypted by Customer Managed Key (CMK) misconfiguration detected in](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/storage/appsec-aws-149.md) - [Workspace user volumes are not encrypted misconfiguration detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/storage/appsec-aws-155.md) - [Workspace root volumes are not encrypted misconfiguration detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/storage/appsec-aws-156.md) - [RDS instances do not have Multi-AZ enabled misconfiguration detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/storage/appsec-aws-157.md) - [Athena Workgroup is not encrypted misconfiguration detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/storage/appsec-aws-159.md) - [Timestream database is not encrypted with KMS CMK misconfiguration detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/storage/appsec-aws-160.md) - [Dynamodb point in time recovery is not enabled for global tables misconfiguration detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/storage/appsec-aws-165.md) - [Backup Vault is not encrypted at rest using KMS CMK misconfiguration detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/storage/appsec-aws-166.md) - [QLDB ledger permissions mode is not set to STANDARD misconfiguration detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/storage/appsec-aws-170.md) - [AWS EMR cluster is not configured with SSE KMS for data at rest encryption (Amazon S3 with EMRFS) mi](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/storage/appsec-aws-171.md) - [AWS QLDB ledger has deletion protection is disabled misconfiguration detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/storage/appsec-aws-172.md) - [AWS Lambda encryption settings environmental variable is not set properly misconfiguration detected](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/storage/appsec-aws-173.md) - [AWS Kinesis Video Stream not encrypted using Customer Managed Key misconfiguration detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/storage/appsec-aws-177.md) - [AWS fx ontap file system not encrypted using Customer Managed Key misconfiguration detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/storage/appsec-aws-178.md) - [AWS FSX Windows filesystem not encrypted using Customer Managed Key misconfiguration detected in cod](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/storage/appsec-aws-179.md) - [AWS Image Builder component not encrypted using Customer Managed Key misconfiguration detected in co](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/storage/appsec-aws-180.md) - [AWS S3 Object Copy not encrypted using Customer Managed Key misconfiguration detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/storage/appsec-aws-181.md) - [AWS Doc DB not encrypted using Customer Managed Key misconfiguration detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/storage/appsec-aws-182.md) - [AWS EBS Snapshot Copy not encrypted using Customer Managed Key misconfiguration detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/storage/appsec-aws-183.md) - [AWS Elastic File System (EFS) is not encrypted using Customer Managed Key misconfiguration detected](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/storage/appsec-aws-184.md) - [AWS Kinesis streams encryption is using default KMS keys instead of Customer's Managed Master Keys m](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/storage/appsec-aws-185.md) - [AWS S3 bucket Object not encrypted using Customer Managed Key misconfiguration detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/storage/appsec-aws-186.md) - [AWS EBS Volume not encrypted using Customer Managed Key misconfiguration detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/storage/appsec-aws-189.md) - [AWS lustre file system not configured with CMK key misconfiguration detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/storage/appsec-aws-190.md) - [AWS Elasticache replication group not configured with CMK key misconfiguration detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/storage/appsec-aws-191.md) - [AWS Glue component is not associated with a security configuration misconfiguration detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/storage/appsec-aws-195.md) - [AWS Image Builder Distribution Configuration is not encrypting AMI by Key Management Service (KMS) u](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/storage/appsec-aws-199.md) - [AWS Image Recipe EBS Disk are not encrypted using a Customer Managed Key (CMK) misconfiguration dete](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/storage/appsec-aws-200.md) - [AWS MemoryDB is not encrypted at rest by AWS' Key Management Service KMS using CMKs misconfiguration](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/storage/appsec-aws-201.md) - [AWS MemoryDB data is not encrypted in transit misconfiguration detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/storage/appsec-aws-202.md) - [AWS FSX openzfs is not encrypted by AWS' Key Management Service (KMS) using a Customer Managed Key (](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/storage/appsec-aws-203.md) - [AWS AMIs are not encrypted by Key Management Service (KMS) using Customer Managed Keys (CMKs) miscon](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/storage/appsec-aws-204.md) - [AWS MQ Broker is not encrypted by Customer Managed Key (CMK) misconfiguration detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/storage/appsec-aws-209.md) - [AWS RDS does not use a modern CaCert misconfiguration detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/storage/appsec-aws-211.md) - [AWS EBS Volume is not encrypted by Key Management Service (KMS) using a Customer Managed Key (CMK) m](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/storage/appsec-aws-212.md) - [AWS Appsync API Cache is not encrypted at rest misconfiguration detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/storage/appsec-aws-214.md) - [AWS Appsync API Cache is not encrypted in transit misconfiguration detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/storage/appsec-aws-215.md) - [AWS CodePipeline artifactStore is not encrypted by Key Management Service (KMS) using a Customer Man](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/storage/appsec-aws-219.md) - [AWS Code Artifact Domain is not encrypted by KMS using a Customer Managed Key (CMK) misconfiguration](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/storage/appsec-aws-221.md) - [AWS copied AMIs are not encrypted misconfiguration detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/storage/appsec-aws-235.md) - [AWS AMI copying does not use a Customer Managed Key (CMK) misconfiguration detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/storage/appsec-aws-236.md) - [AWS Kinesis Firehose's delivery stream is not encrypted misconfiguration detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/storage/appsec-aws-240.md) - [AWS Kinesis Firehose Delivery Streams are not encrypted with CMK misconfiguration detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/storage/appsec-aws-241.md) - [AWS replicated backups are not encrypted at rest by Key Management Service (KMS) using a Customer Ma](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/storage/appsec-aws-245.md) - [AWS RDS Cluster activity streams are not encrypted by Key Management Service (KMS) using Customer Ma](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/storage/appsec-aws-246.md) - [AWS all data stored in the Elasticsearch domain is not encrypted using a Customer Managed Key (CMK)](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/storage/appsec-aws-247.md) - [AWS RDS PostgreSQL exposed to local file read vulnerability misconfiguration detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/storage/appsec-aws-250.md) - [AWS DLM cross-region events are not encrypted misconfiguration detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/storage/appsec-aws-253.md) - [AWS DLM cross-region events are not encrypted with a Customer Managed Key (CMK) misconfiguration det](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/storage/appsec-aws-254.md) - [AWS DLM-cross region schedules are not encrypted misconfiguration detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/storage/appsec-aws-255.md) - [AWS DLM cross-region schedules are not encrypted using a Customer Managed Key (CMK) misconfiguration](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/storage/appsec-aws-256.md) - [AWS App Flow flow does not use Customer Managed Keys (CMKs) misconfiguration detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/storage/appsec-aws-263.md) - [AWS App Flow connector profile does not use Customer Managed Keys (CMKs) misconfiguration detected i](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/storage/appsec-aws-264.md) - [AWS Keyspace Table does not use Customer Managed Keys (CMKs) misconfiguration detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/storage/appsec-aws-265.md) - [AWS RDS DB snapshot does not use Customer Managed Keys (CMKs) misconfiguration detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/storage/appsec-aws-266.md) - [Comprehend Entity Recognizer's model is not encrypted by KMS using a customer managed Key (CMK) misc](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/storage/appsec-aws-267.md) - [Comprehend Entity Recognizer's volume is not encrypted by KMS using a customer managed Key (CMK) mis](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/storage/appsec-aws-268.md) - [Connect Instance Kinesis Video Stream Storage Config is not using CMK for encryption misconfiguratio](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/storage/appsec-aws-269.md) - [The Connect Instance S3 Storage Configuration utilizes Customer Managed Key. misconfiguration detect](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/storage/appsec-aws-270.md) - [DynamoDB table replica does not use CMK KMS encryption misconfiguration detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/storage/appsec-aws-271.md) - [MemoryDB snapshot is not encrypted by KMS using a customer managed Key (CMK) misconfiguration detect](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/storage/appsec-aws-278.md) - [Neptune snapshot is not securely encrypted misconfiguration detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/storage/appsec-aws-279.md) - [Neptune snapshot is encrypted by KMS using a customer managed Key (CMK) misconfiguration detected in](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/storage/appsec-aws-280.md) - [RedShift snapshot copy is not encrypted by KMS using a customer managed Key (CMK). misconfiguration](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/storage/appsec-aws-281.md) - [Redshift Serverless namespace is not encrypted by KMS using a customer managed key (CMK) misconfigur](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/storage/appsec-aws-282.md) - [DocDB Global Cluster is not encrypted at rest misconfiguration detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/storage/appsec-aws-292.md) - [AWS database instances do not have deletion protection enabled misconfiguration detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/storage/appsec-aws-293.md) - [CloudTrail Event Data Store does not use Customer Managed Keys (CMKs) misconfiguration detected in c](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/storage/appsec-aws-294.md) - [DataSync Location Object Storage exposes secrets misconfiguration detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/storage/appsec-aws-295.md) - [DMS endpoint is not using a Customer Managed Key (CMK) misconfiguration detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/storage/appsec-aws-296.md) - [EventBridge Scheduler Schedule is not using a Customer Managed Key (CMK) misconfiguration detected i](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/storage/appsec-aws-297.md) - [The DMS S3 does not use a Customer Managed Key (CMK) misconfiguration detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/storage/appsec-aws-298.md) - [S3 lifecycle configuration does not set a period for aborting failed uploads misconfiguration detect](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/storage/appsec-aws-300.md) - [Secrets Manager secrets are not rotated within 90 days misconfiguration detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/storage/appsec-aws-304.md) - [CodeBuild S3 logs are not encrypted misconfiguration detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/storage/appsec-aws-311.md) - [RDS Aurora Clusters do not have backtracking enabled misconfiguration detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/storage/appsec-aws-326.md) - [AWS RDS DB cluster is encrypted using default KMS key instead of CMK misconfiguration detected in co](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/storage/appsec-aws-327.md) - [EFS Access Points are not enforcing a root directory misconfiguration detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/storage/appsec-aws-329.md) - [User identity should be enforced by EFS access points misconfiguration detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/storage/appsec-aws-330.md) - [SSM parameters are not utilizing KMS CMK. misconfiguration detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/storage/appsec-aws-337.md) - [Amazon Redshift clusters do not have automatic snapshots enabled misconfiguration detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/storage/appsec-aws-343.md) - [Network firewall encryption does not use a CMK misconfiguration detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/storage/appsec-aws-345.md) - [Network Firewall Policy does not define an encryption configuration that uses a CMK misconfiguration](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/storage/appsec-aws-346.md) - [Neptune is not encrypted with KMS using a customer managed Key (CMK) misconfiguration detected in co](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/storage/appsec-aws-347.md) - [AWS EMR cluster is not enabled with local disk encryption misconfiguration detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/storage/appsec-aws-349.md) - [Security configuration of the EMR Cluster does not ensure the encryption of EBS disks misconfigurati](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/storage/appsec-aws-350.md) - [AWS EMR cluster is not enabled with data encryption in transit misconfiguration detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/storage/appsec-aws-351.md) - [RDS Performance Insights are not encrypted using KMS CMKs misconfiguration detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/storage/appsec-aws-354.md) - [AWS DocumentDB clusters have backup retention period less than 7 days misconfiguration detected in c](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/storage/appsec-aws-360.md) - [AWS Neptune DB clusters have backup retention period less than 7 days misconfiguration detected in c](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/storage/appsec-aws-361.md) - [Clusters of Neptune DB do not replicate tags to snapshots misconfiguration detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/storage/appsec-aws-362.md) - [Bedrock Agent not encrypted with Customer Master Key (CMK) misconfiguration detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/storage/appsec-aws-373.md) - [AWS S3 bucket has global view ACL permissions enabled misconfiguration detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/storage/appsec-aws-375.md) - [AWS CodeGuru Reviewer repository association does not use a Customer Managed Key (CMK) misconfigurat](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/storage/appsec-aws-381.md) - [Not all data stored in the EBS snapshot is securely encrypted misconfiguration detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/storage/appsec-aws-custom-3.md) - [Azure VM data disk is not encrypted with ADE/CMK misconfiguration detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/storage/appsec-azure-2.md) - [Azure Storage Account without Secure transfer enabled misconfiguration detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/storage/appsec-azure-3.md) - [Azure PostgreSQL database server with log checkpoints parameter disabled misconfiguration detected i](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/storage/appsec-azure-30.md) - [Azure PostgreSQL database server with log connections parameter disabled misconfiguration detected i](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/storage/appsec-azure-31.md) - [Azure PostgreSQL database server with connection throttling parameter is disabled misconfiguration d](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/storage/appsec-azure-32.md) - [Azure Storage Account 'Trusted Microsoft Services' access not enabled misconfiguration detected in c](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/storage/appsec-azure-36.md) - [Azure Key Vault Keys does not have expiration date misconfiguration detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/storage/appsec-azure-40.md) - [Azure Key Vault secrets does not have expiration date misconfiguration detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/storage/appsec-azure-41.md) - [Azure Key Vault is not recoverable misconfiguration detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/storage/appsec-azure-42.md) - [Storage Account name does not follow naming rules misconfiguration detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/storage/appsec-azure-43.md) - [Azure Storage Account using insecure TLS version misconfiguration detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/storage/appsec-azure-44.md) - [MSSQL is not using the latest version of TLS encryption misconfiguration detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/storage/appsec-azure-52.md) - [Azure Automation account variables are not encrypted misconfiguration detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/storage/appsec-azure-73.md) - [Azure Data Explorer cluster disk encryption is disabled misconfiguration detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/storage/appsec-azure-74.md) - [Azure Data Explorer cluster double encryption is disabled misconfiguration detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/storage/appsec-azure-75.md) - [Azure Batch account does not use key vault to encrypt data misconfiguration detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/storage/appsec-azure-76.md) - [App services do not use Azure files misconfiguration detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/storage/appsec-azure-88.md) - [Not only SSL are enabled for cache for Redis misconfiguration detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/storage/appsec-azure-91.md) - [Managed disks do not use a specific set of disk encryption sets for customer-managed key encryption](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/storage/appsec-azure-93.md) - [My SQL server disables geo-redundant backups misconfiguration detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/storage/appsec-azure-94.md) - [MySQL server disables infrastructure encryption misconfiguration detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/storage/appsec-azure-96.md) - [Virtual machine scale sets do not have encryption at host enabled misconfiguration detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/storage/appsec-azure-97.md) - [Cosmos DB Accounts do not have CMKs encrypting data at rest misconfiguration detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/storage/appsec-azure-100.md) - [PostgreSQL server enables geo-redundant backups misconfiguration detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/storage/appsec-azure-102.md) - [Unencrypted Data Lake Store accounts misconfiguration detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/storage/appsec-azure-105.md) - [Azure Key Vault Purge protection is not enabled misconfiguration detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/storage/appsec-azure-110.md) - [Key vault does not enable soft-delete misconfiguration detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/storage/appsec-azure-111.md) - [Key vault key is not backed by HSM misconfiguration detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/storage/appsec-azure-112.md) - [Key vault secrets do not have content\_type set misconfiguration detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/storage/appsec-azure-114.md) - [Azure AKS cluster is not configured with disk encryption set misconfiguration detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/storage/appsec-azure-117.md) - [MariaDB server does not enable geo-redundant backups misconfiguration detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/storage/appsec-azure-129.md) - [PostgreSQL server does not enable infrastructure encryption misconfiguration detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/storage/appsec-azure-130.md) - [Azure Cosmos DB key based authentication is enabled misconfiguration detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/storage/appsec-azure-132.md) - [Azure PostgreSQL Flexible Server does not enable geo-redundant backups misconfiguration detected in](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/storage/appsec-azure-136.md) - [Azure PostgreSQL does not use the latest version of TLS encryption misconfiguration detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/storage/appsec-azure-147.md) - [Azure Windows VM does not enable encryption misconfiguration detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/storage/appsec-azure-151.md) - [Geo-Replicated Not Enabled for Azure Container Registry (ACR) misconfiguration detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/storage/appsec-azure-165.md) - [Azure Container Registry (ACR) Does Not Have a Quarantine Policy Enabled misconfiguration detected i](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/storage/appsec-azure-166.md) - [Azure Container Registry (ACR) Doesn't Have a Retention Policy Set misconfiguration detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/storage/appsec-azure-167.md) - [AKS Secrets Store Without Auto-Rotation misconfiguration detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/storage/appsec-azure-172.md) - [Azure Data Explorer without SLA misconfiguration detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/storage/appsec-azure-180.md) - [App Configuration Encryption Block Not Set misconfiguration detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/storage/appsec-azure-186.md) - [App Configuration Without Purge Protection Enabled misconfiguration detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/storage/appsec-azure-187.md) - [Azure Service Bus Doesn't Use Double Encryption misconfiguration detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/storage/appsec-azure-199.md) - [Azure Service Bus Doesn't Use Customer-Managed Key Encryption misconfiguration detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/storage/appsec-azure-201.md) - [Azure Storage Accounts Without Proper Replication misconfiguration detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/storage/appsec-azure-206.md) - [Azure Cognitive Search Without SLA Index Updates misconfiguration detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/storage/appsec-azure-208.md) - [Azure Cognitive Search Without SLA for Search Index Queries misconfiguration detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/storage/appsec-azure-209.md) - [App Service Plan is not zone redundant misconfiguration detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/storage/appsec-azure-225.md) - [AKS cluster not encrypting temp disks, caches, and data flows misconfiguration detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/storage/appsec-azure-227.md) - [Azure Event Hub Namespace is not zone redundant misconfiguration detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/storage/appsec-azure-228.md) - [Azure SQL Database Namespace is not zone redundant misconfiguration detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/storage/appsec-azure-229.md) - [Standard Replication is not enabled misconfiguration detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/storage/appsec-azure-230.md) - [App Service Environment is not zone redundant misconfiguration detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/storage/appsec-azure-231.md) - [Azure Container Registry (ACR) not zone redundant misconfiguration detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/storage/appsec-azure-233.md) - [GCP SQL database instance does not have backup configuration enabled misconfiguration detected in co](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/storage/appsec-gcp-14.md) - [GCP cloud storage bucket with uniform bucket-level access disabled misconfiguration detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/storage/appsec-gcp-29.md) - [GCP VM disks not encrypted with Customer-Supplied Encryption Keys (CSEK) misconfiguration detected i](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/storage/appsec-gcp-37.md) - [Boot disks for instances do not use CSEKs misconfiguration detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/storage/appsec-gcp-38.md) - [GCP KMS Symmetric key not rotating in every 90 days misconfiguration detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/storage/appsec-gcp-43.md) - [GCP MySQL instance with local\_infile database flag is not disabled misconfiguration detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/storage/appsec-gcp-50.md) - [GCP SQL Server instance database flag 'cross db ownership chaining' is enabled misconfiguration dete](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/storage/appsec-gcp-58.md) - [GCP SQL Server instance database flag 'contained database authentication' is enabled misconfiguratio](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/storage/appsec-gcp-59.md) - [GCP Storage Bucket does not have Access and Storage Logging enabled misconfiguration detected in cod](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/storage/appsec-gcp-62.md) - [GCP storage bucket is logging to itself misconfiguration detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/storage/appsec-gcp-63.md) - [GCP Cloud storage does not have versioning enabled misconfiguration detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/storage/appsec-gcp-78.md) - [GCP Big Query Tables are not encrypted with Customer Supplied Encryption Keys (CSEK) misconfiguratio](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/storage/appsec-gcp-80.md) - [GCP Big Query Datasets are not encrypted with Customer Supplied Encryption Keys (CSEK) misconfigurat](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/storage/appsec-gcp-81.md) - [GCP KMS keys are not protected from deletion misconfiguration detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/storage/appsec-gcp-82.md) - [GCP Pub/Sub Topics are not encrypted with Customer Supplied Encryption Keys (CSEK) misconfiguration](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/storage/appsec-gcp-83.md) - [GCP Artifact Registry repositories are not encrypted with Customer Supplied Encryption Keys (CSEK) m](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/storage/appsec-gcp-84.md) - [GCP Big Table Instances are not encrypted with Customer Supplied Encryption Keys (CSEKs) misconfigur](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/storage/appsec-gcp-85.md) - [GCP data flow jobs are not encrypted with Customer Supplied Encryption Keys (CSEK) misconfiguration](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/storage/appsec-gcp-90.md) - [GCP Dataproc Cluster not configured with Customer-Managed Encryption Key (CMEK) misconfiguration det](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/storage/appsec-gcp-91.md) - [GCP Spanner Database is not encrypted with Customer Supplied Encryption Keys (CSEKs) misconfiguratio](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/storage/appsec-gcp-93.md) - [GCP Memorystore for Redis does not use intransit encryption misconfiguration detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/storage/appsec-gcp-97.md) - [Deletion protection for Spanner Database is disabled misconfiguration detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/storage/appsec-gcp-119.md) - [Spanner Database does not have drop protection enabled misconfiguration detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/storage/appsec-gcp-120.md) - [BigQuery tables do not have deletion protection enabled misconfiguration detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/storage/appsec-gcp-121.md) - [Big Table Instances do not have deletion protection enabled misconfiguration detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/storage/appsec-gcp-122.md) - [GitHub Actions Environment Secrets defined in Terraform are not encrypted misconfiguration detected](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/storage/appsec-git-4.md) - [Gitlab project defined in Terraform does not prevent secrets misconfiguration detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/storage/appsec-glb-3.md) - [The --etcd-certfile and --etcd-keyfile arguments are not set appropriately misconfiguration detected](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/storage/appsec-k8s-99.md) - [Encryption providers are not appropriately configured misconfiguration detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/storage/appsec-k8s-104.md) - [The --cert-file and --key-file arguments are not set appropriately misconfiguration detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/storage/appsec-k8s-116.md) - [The --peer-cert-file and --peer-key-file arguments are not set appropriately misconfiguration detect](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/storage/appsec-k8s-119.md) - [OCI Block Storage Block Volume does not have backup enabled misconfiguration detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/storage/appsec-oci-2.md) - [OCI Block Storage Block Volumes are not encrypted with a Customer Managed Key (CMK) misconfiguration](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/storage/appsec-oci-3.md) - [OCI Object Storage bucket does not emit object events misconfiguration detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/storage/appsec-oci-7.md) - [OCI Object Storage Bucket has object Versioning disabled misconfiguration detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/storage/appsec-oci-8.md) - [OCI Object Storage Bucket is not encrypted with a Customer Managed Key (CMK) misconfiguration detect](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/storage/appsec-oci-9.md) - [OCI Object Storage bucket is publicly accessible misconfiguration detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/storage/appsec-oci-10.md) - [OCI File Storage File Systems are not encrypted with a Customer Managed Key (CMK) misconfiguration d](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/storage/appsec-oci-15.md) - [Not only encrypted EBS volumes are attached to EC2 instances misconfiguration detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/storage/appsec2-aws-2.md) - [RDS clusters do not have an AWS Backup backup plan misconfiguration detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/storage/appsec2-aws-8.md) - [EBS does not have an AWS Backup backup plan misconfiguration detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/storage/appsec2-aws-9.md) - [AWS DynamoDB table Auto Scaling not enabled misconfiguration detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/storage/appsec2-aws-16.md) - [Amazon EFS does not have an AWS Backup backup plan misconfiguration detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/storage/appsec2-aws-18.md) - [AWS SSM Parameter is not encrypted misconfiguration detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/storage/appsec2-aws-34.md) - [AWS ElastiCache Redis cluster with Multi-AZ Automatic Failover feature set to disabled misconfigurat](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/storage/appsec2-aws-50.md) - [AWS EMR cluster is not configured with security configuration misconfiguration detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/storage/appsec2-aws-55.md) - [AWS Secret Manager Automatic Key Rotation is not enabled misconfiguration detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/storage/appsec2-aws-57.md) - [AWS Neptune cluster deletion protection is disabled misconfiguration detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/storage/appsec2-aws-58.md) - [AWS S3 bucket access control lists (ACLs) in use misconfiguration detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/storage/appsec2-aws-65.md) - [AWS RDS database instance not configured with encryption in transit misconfiguration detected in cod](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/storage/appsec2-aws-69.md) - [AWS SQS queue encryption using default KMS key instead of CMK misconfiguration detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/storage/appsec2-aws-73.md) - [Storage for critical data are not encrypted with Customer Managed Key misconfiguration detected in c](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/storage/appsec2-azure-1.md) - [Azure Data Explorer encryption at rest does not use a customer-managed key misconfiguration detected](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/storage/appsec2-azure-11.md) - [Virtual Machines are not backed up using Azure Backup misconfiguration detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/storage/appsec2-azure-12.md) - [Unattached disks are not encrypted misconfiguration detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/storage/appsec2-azure-14.md) - [Azure data factories are not encrypted with a customer-managed key misconfiguration detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/storage/appsec2-azure-15.md) - [MySQL server does not enable customer-managed key for encryption misconfiguration detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/storage/appsec2-azure-16.md) - [PostgreSQL server does not enable customer-managed key for encryption misconfiguration detected in c](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/storage/appsec2-azure-17.md) - [Azure Storage account Encryption CMKs Disabled misconfiguration detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/storage/appsec2-azure-18.md) - [Azure SQL database Transparent Data Encryption (TDE) encryption disabled misconfiguration detected i](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/storage/appsec2-azure-25.md) - [Azure MariaDB database server not using latest TLS version misconfiguration detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/storage/appsec2-azure-37.md) - [Azure Storage account soft delete is disabled misconfiguration detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/storage/appsec2-azure-38.md) - [GCP SQL MySQL DB instance point-in-time recovery backup (Binary logs) is not enabled misconfiguratio](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/storage/appsec2-gcp-20.md) - [Vertex AI instance disks not encrypted with a Customer Managed Key (CMK) misconfiguration detected i](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/storage/appsec2-gcp-21.md) - [Document AI Processors not encrypted with a Customer Managed Key (CMK) misconfiguration detected in](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/storage/appsec2-gcp-22.md) - [Document AI Warehouse Location is not configured to use a Customer Managed Key (CMK) misconfiguratio](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/storage/appsec2-gcp-23.md) - [Vertex AI workbench instance disks not encrypted with a Customer Managed Key (CMK) misconfiguration](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/storage/appsec2-gcp-27.md) - [OCI File Storage File System access is not restricted to root users misconfiguration detected in cod](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/storage/appsec2-oci-4.md) - [OCI Kubernetes Engine Cluster boot volume is not configured with in-transit data encryption misconfi](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/storage/appsec2-oci-5.md) - [CI/CD Security](https://cortex-docs.paloaltonetworks.com/appsec-rules/ci-cd-security.md) - [Artifact Integrity Validation](https://cortex-docs.paloaltonetworks.com/appsec-rules/ci-cd-security/artifact-integrity-validation.md) - [Missing integrity check for downloaded executable in pipeline](https://cortex-docs.paloaltonetworks.com/appsec-rules/ci-cd-security/artifact-integrity-validation/appsec-cicd-106.md) - [Missing integrity check for downloaded executable in CircleCI pipeline](https://cortex-docs.paloaltonetworks.com/appsec-rules/ci-cd-security/artifact-integrity-validation/appsec-cicd-107.md) - [Missing integrity check for downloaded executable in GitHub Actions pipeline](https://cortex-docs.paloaltonetworks.com/appsec-rules/ci-cd-security/artifact-integrity-validation/appsec-cicd-108.md) - [Auto-merge configured in pipeline](https://cortex-docs.paloaltonetworks.com/appsec-rules/ci-cd-security/artifact-integrity-validation/appsec-cicd-118.md) - [Missing integrity check for downloaded executable in GitLab CI pipeline](https://cortex-docs.paloaltonetworks.com/appsec-rules/ci-cd-security/artifact-integrity-validation/appsec-cicd-123.md) - [Unpinned GitHub actions](https://cortex-docs.paloaltonetworks.com/appsec-rules/ci-cd-security/artifact-integrity-validation/appsec-cicd-125.md) - [Missing integrity check for downloaded executable in Azure Pipelines pipeline](https://cortex-docs.paloaltonetworks.com/appsec-rules/ci-cd-security/artifact-integrity-validation/appsec-cicd-189.md) - [Pipeline uses an unpinned container image](https://cortex-docs.paloaltonetworks.com/appsec-rules/ci-cd-security/artifact-integrity-validation/appsec-cicd-253.md) - [CircleCI pipeline uses an unpinned container image](https://cortex-docs.paloaltonetworks.com/appsec-rules/ci-cd-security/artifact-integrity-validation/appsec-cicd-254.md) - [Artifact signing operation failure detected in pipeline](https://cortex-docs.paloaltonetworks.com/appsec-rules/ci-cd-security/artifact-integrity-validation/appsec-attest-1.md) - [Signed image without a prior build scan found](https://cortex-docs.paloaltonetworks.com/appsec-rules/ci-cd-security/artifact-integrity-validation/appsec-attest-2.md) - [Image signature verification failed due to untrusted public key in pipeline](https://cortex-docs.paloaltonetworks.com/appsec-rules/ci-cd-security/artifact-integrity-validation/appsec-attest-3.md) - [Image signature verification failed due to invalid signature in pipeline](https://cortex-docs.paloaltonetworks.com/appsec-rules/ci-cd-security/artifact-integrity-validation/appsec-attest-4.md) - [Unsigned artifact push to registry detected in pipeline](https://cortex-docs.paloaltonetworks.com/appsec-rules/ci-cd-security/artifact-integrity-validation/appsec-attest-5.md) - [Invalid artifact signature detected in registry](https://cortex-docs.paloaltonetworks.com/appsec-rules/ci-cd-security/artifact-integrity-validation/appsec-attest-6.md) - [Unsigned image detected in registry](https://cortex-docs.paloaltonetworks.com/appsec-rules/ci-cd-security/artifact-integrity-validation/appsec-attest-7.md) - [Image signed by an untrusted public key found](https://cortex-docs.paloaltonetworks.com/appsec-rules/ci-cd-security/artifact-integrity-validation/appsec-attest-8.md) - [Image signed by a recently removed trusted public key found](https://cortex-docs.paloaltonetworks.com/appsec-rules/ci-cd-security/artifact-integrity-validation/appsec-attest-9.md) - [Expired signing key found](https://cortex-docs.paloaltonetworks.com/appsec-rules/ci-cd-security/artifact-integrity-validation/appsec-attest-10.md) - [Key has not been rotated within the required period](https://cortex-docs.paloaltonetworks.com/appsec-rules/ci-cd-security/artifact-integrity-validation/appsec-attest-11.md) - [Credential Hygiene](https://cortex-docs.paloaltonetworks.com/appsec-rules/ci-cd-security/credential-hygiene.md) - [Jenkins credentials stored with global scope](https://cortex-docs.paloaltonetworks.com/appsec-rules/ci-cd-security/credential-hygiene/appsec-cicd-38.md) - [Variable is not scoped to an environment](https://cortex-docs.paloaltonetworks.com/appsec-rules/ci-cd-security/credential-hygiene/appsec-cicd-74.md) - [Accesses to cloud providers using insecure long-term credentials](https://cortex-docs.paloaltonetworks.com/appsec-rules/ci-cd-security/credential-hygiene/appsec-cicd-75.md) - [GitLab CI/CD accesses cloud provider using insecure long-term credentials](https://cortex-docs.paloaltonetworks.com/appsec-rules/ci-cd-security/credential-hygiene/appsec-cicd-78.md) - [Secrets detected in pipeline's console output](https://cortex-docs.paloaltonetworks.com/appsec-rules/ci-cd-security/credential-hygiene/appsec-cicd-84.md) - [Secrets found in console output of a CircleCI pipeline](https://cortex-docs.paloaltonetworks.com/appsec-rules/ci-cd-security/credential-hygiene/appsec-cicd-85.md) - [CircleCI accesses cloud provider using insecure long-term credentials](https://cortex-docs.paloaltonetworks.com/appsec-rules/ci-cd-security/credential-hygiene/appsec-cicd-87.md) - [Jenkins environment variables exposed when printed to log](https://cortex-docs.paloaltonetworks.com/appsec-rules/ci-cd-security/credential-hygiene/appsec-cicd-132.md) - [Secrets found in console output of a GitHub Actions pipeline](https://cortex-docs.paloaltonetworks.com/appsec-rules/ci-cd-security/credential-hygiene/appsec-cicd-133.md) - [Environment variables exposed when printed to log](https://cortex-docs.paloaltonetworks.com/appsec-rules/ci-cd-security/credential-hygiene/appsec-cicd-134.md) - [CircleCI environment variables exposed when printed to log](https://cortex-docs.paloaltonetworks.com/appsec-rules/ci-cd-security/credential-hygiene/appsec-cicd-135.md) - [GitLab CI environment variables exposed when printed to log](https://cortex-docs.paloaltonetworks.com/appsec-rules/ci-cd-security/credential-hygiene/appsec-cicd-136.md) - [Secrets found in webhook URL](https://cortex-docs.paloaltonetworks.com/appsec-rules/ci-cd-security/credential-hygiene/appsec-cicd-148.md) - [Secrets found in GitLab webhook URL](https://cortex-docs.paloaltonetworks.com/appsec-rules/ci-cd-security/credential-hygiene/appsec-cicd-149.md) - [Secrets found in BitBucket webhook URL](https://cortex-docs.paloaltonetworks.com/appsec-rules/ci-cd-security/credential-hygiene/appsec-cicd-150.md) - [GitHub Organization secret not scoped](https://cortex-docs.paloaltonetworks.com/appsec-rules/ci-cd-security/credential-hygiene/appsec-cicd-178.md) - [Insecure definition of secret variable in pipeline](https://cortex-docs.paloaltonetworks.com/appsec-rules/ci-cd-security/credential-hygiene/appsec-cicd-192.md) - [Environment variables exposed when printed to log in Azure Pipelines](https://cortex-docs.paloaltonetworks.com/appsec-rules/ci-cd-security/credential-hygiene/appsec-cicd-193.md) - [Secrets found in console output of an Azure pipeline](https://cortex-docs.paloaltonetworks.com/appsec-rules/ci-cd-security/credential-hygiene/appsec-cicd-242.md) - [Unrotated GitHub Organization secrets](https://cortex-docs.paloaltonetworks.com/appsec-rules/ci-cd-security/credential-hygiene/appsec-cicd-247.md) - [Unrotated repository secrets](https://cortex-docs.paloaltonetworks.com/appsec-rules/ci-cd-security/credential-hygiene/appsec-cicd-248.md) - [Secrets found in logs of a GitLab CI pipeline](https://cortex-docs.paloaltonetworks.com/appsec-rules/ci-cd-security/credential-hygiene/appsec-cicd-256.md) - [Pipeline uploads the GITHUB\_TOKEN in an artifact](https://cortex-docs.paloaltonetworks.com/appsec-rules/ci-cd-security/credential-hygiene/appsec-cicd-340.md) - [Data Protection](https://cortex-docs.paloaltonetworks.com/appsec-rules/ci-cd-security/data-protection.md) - [Webhooks sent over unencrypted channel detected](https://cortex-docs.paloaltonetworks.com/appsec-rules/ci-cd-security/data-protection/appsec-cicd-12.md) - [GitLab Webhooks sent over unencrypted channel](https://cortex-docs.paloaltonetworks.com/appsec-rules/ci-cd-security/data-protection/appsec-cicd-13.md) - [BitBucket webhooks sent over unencrypted channel](https://cortex-docs.paloaltonetworks.com/appsec-rules/ci-cd-security/data-protection/appsec-cicd-14.md) - [Forking of a private repository is allowed](https://cortex-docs.paloaltonetworks.com/appsec-rules/ci-cd-security/data-protection/appsec-cicd-19.md) - [Forking of BitBucket private repository is allowed](https://cortex-docs.paloaltonetworks.com/appsec-rules/ci-cd-security/data-protection/appsec-cicd-20.md) - [Organization webhook SSL verification is disabled](https://cortex-docs.paloaltonetworks.com/appsec-rules/ci-cd-security/data-protection/appsec-cicd-30.md) - [Force push to default branch is allowed](https://cortex-docs.paloaltonetworks.com/appsec-rules/ci-cd-security/data-protection/appsec-cicd-31.md) - [BitBucket repository webhook SSL verification is disabled](https://cortex-docs.paloaltonetworks.com/appsec-rules/ci-cd-security/data-protection/appsec-cicd-37.md) - [Repository webhook SSL verification is disabled](https://cortex-docs.paloaltonetworks.com/appsec-rules/ci-cd-security/data-protection/appsec-cicd-39.md) - [Organization members can create public repositories](https://cortex-docs.paloaltonetworks.com/appsec-rules/ci-cd-security/data-protection/appsec-cicd-44.md) - [Project webhook SSL verification disabled](https://cortex-docs.paloaltonetworks.com/appsec-rules/ci-cd-security/data-protection/appsec-cicd-72.md) - [Force push to default branch is allowed in GitLab](https://cortex-docs.paloaltonetworks.com/appsec-rules/ci-cd-security/data-protection/appsec-cicd-82.md) - [Private repository made public](https://cortex-docs.paloaltonetworks.com/appsec-rules/ci-cd-security/data-protection/appsec-cicd-88.md) - [Certificate not verified by pipeline command](https://cortex-docs.paloaltonetworks.com/appsec-rules/ci-cd-security/data-protection/appsec-cicd-92.md) - [Pipeline commands transmit data over an unencrypted channel](https://cortex-docs.paloaltonetworks.com/appsec-rules/ci-cd-security/data-protection/appsec-cicd-93.md) - [Certificate not verified by GitHub Actions pipeline command](https://cortex-docs.paloaltonetworks.com/appsec-rules/ci-cd-security/data-protection/appsec-cicd-109.md) - [Certificate not verified by CircleCI pipeline command](https://cortex-docs.paloaltonetworks.com/appsec-rules/ci-cd-security/data-protection/appsec-cicd-110.md) - [GitHub Actions pipeline commands transmit data over an unencrypted channel](https://cortex-docs.paloaltonetworks.com/appsec-rules/ci-cd-security/data-protection/appsec-cicd-111.md) - [CircleCI pipeline commands transmit data over an unencrypted channel](https://cortex-docs.paloaltonetworks.com/appsec-rules/ci-cd-security/data-protection/appsec-cicd-112.md) - [Certificate not verified by GitLab CI pipeline command](https://cortex-docs.paloaltonetworks.com/appsec-rules/ci-cd-security/data-protection/appsec-cicd-121.md) - [GitLab CI pipeline commands transmit data over an unencrypted channel](https://cortex-docs.paloaltonetworks.com/appsec-rules/ci-cd-security/data-protection/appsec-cicd-122.md) - [Forking of private repositories in the organization is allowed](https://cortex-docs.paloaltonetworks.com/appsec-rules/ci-cd-security/data-protection/appsec-cicd-153.md) - [Forking of a private GitHub repository is allowed](https://cortex-docs.paloaltonetworks.com/appsec-rules/ci-cd-security/data-protection/appsec-cicd-154.md) - [Private repository forks can lead to code leakage](https://cortex-docs.paloaltonetworks.com/appsec-rules/ci-cd-security/data-protection/appsec-cicd-157.md) - [Project service hook SSL verification is disabled](https://cortex-docs.paloaltonetworks.com/appsec-rules/ci-cd-security/data-protection/appsec-cicd-182.md) - [Project service hook sent over unencrypted channel](https://cortex-docs.paloaltonetworks.com/appsec-rules/ci-cd-security/data-protection/appsec-cicd-183.md) - [Forking of a private Azure repository is allowed](https://cortex-docs.paloaltonetworks.com/appsec-rules/ci-cd-security/data-protection/appsec-cicd-191.md) - [Certificate not verified by Azure Pipelines pipeline command](https://cortex-docs.paloaltonetworks.com/appsec-rules/ci-cd-security/data-protection/appsec-cicd-194.md) - [Azure Pipelines commands transmit data over an unencrypted channel](https://cortex-docs.paloaltonetworks.com/appsec-rules/ci-cd-security/data-protection/appsec-cicd-195.md) - [Public repository created](https://cortex-docs.paloaltonetworks.com/appsec-rules/ci-cd-security/data-protection/appsec-cicd-239.md) - [BitBucket private repository made public](https://cortex-docs.paloaltonetworks.com/appsec-rules/ci-cd-security/data-protection/appsec-cicd-245.md) - [Dependency Chains](https://cortex-docs.paloaltonetworks.com/appsec-rules/ci-cd-security/dependency-chains.md) - [Packages insecurely installed through “npm install” command in GitHub Actions pipeline](https://cortex-docs.paloaltonetworks.com/appsec-rules/ci-cd-security/dependency-chains/appsec-cicd-137.md) - [Packages insecurely installed through “npm install” command in GitLab CI pipeline](https://cortex-docs.paloaltonetworks.com/appsec-rules/ci-cd-security/dependency-chains/appsec-cicd-139.md) - [Packages insecurely installed through "npm install" command](https://cortex-docs.paloaltonetworks.com/appsec-rules/ci-cd-security/dependency-chains/appsec-cicd-140.md) - [Packages insecurely installed through “npm install” command in Circle CI pipeline](https://cortex-docs.paloaltonetworks.com/appsec-rules/ci-cd-security/dependency-chains/appsec-cicd-141.md) - [Repository missing NPM lock file package-lock.json](https://cortex-docs.paloaltonetworks.com/appsec-rules/ci-cd-security/dependency-chains/appsec-cicd-158.md) - [Unencrypted channel used to download dependencies from NPM registry](https://cortex-docs.paloaltonetworks.com/appsec-rules/ci-cd-security/dependency-chains/appsec-cicd-159.md) - [Internal NPM package is not scoped](https://cortex-docs.paloaltonetworks.com/appsec-rules/ci-cd-security/dependency-chains/appsec-cicd-160.md) - [Secrets found in NPM dependency download URL](https://cortex-docs.paloaltonetworks.com/appsec-rules/ci-cd-security/dependency-chains/appsec-cicd-161.md) - [GitLab repository missing NPM lock file](https://cortex-docs.paloaltonetworks.com/appsec-rules/ci-cd-security/dependency-chains/appsec-cicd-162.md) - [Unencrypted channel used in GitLab repository to download dependencies from NPM registry](https://cortex-docs.paloaltonetworks.com/appsec-rules/ci-cd-security/dependency-chains/appsec-cicd-163.md) - [Internal NPM package is not scoped in GitLab repository](https://cortex-docs.paloaltonetworks.com/appsec-rules/ci-cd-security/dependency-chains/appsec-cicd-164.md) - [Secrets found in NPM dependency download URL in GitLab repository](https://cortex-docs.paloaltonetworks.com/appsec-rules/ci-cd-security/dependency-chains/appsec-cicd-165.md) - [BitBucket repository missing NPM lock file](https://cortex-docs.paloaltonetworks.com/appsec-rules/ci-cd-security/dependency-chains/appsec-cicd-166.md) - [Unencrypted channel used in BitBucket repository to download dependencies from NPM registry](https://cortex-docs.paloaltonetworks.com/appsec-rules/ci-cd-security/dependency-chains/appsec-cicd-167.md) - [Internal NPM package is not scoped in BitBucket repository](https://cortex-docs.paloaltonetworks.com/appsec-rules/ci-cd-security/dependency-chains/appsec-cicd-168.md) - [Secrets found in NPM dependency download URL in BitBucket repository](https://cortex-docs.paloaltonetworks.com/appsec-rules/ci-cd-security/dependency-chains/appsec-cicd-169.md) - [Azure repository missing NPM lock file](https://cortex-docs.paloaltonetworks.com/appsec-rules/ci-cd-security/dependency-chains/appsec-cicd-170.md) - [Unencrypted channel used in Azure repository to download dependencies from NPM registry](https://cortex-docs.paloaltonetworks.com/appsec-rules/ci-cd-security/dependency-chains/appsec-cicd-171.md) - [Internal NPM package is not scoped in Azure repository](https://cortex-docs.paloaltonetworks.com/appsec-rules/ci-cd-security/dependency-chains/appsec-cicd-172.md) - [Secrets found in NPM dependency download URL in Azure repository](https://cortex-docs.paloaltonetworks.com/appsec-rules/ci-cd-security/dependency-chains/appsec-cicd-173.md) - [NPM package lock file verifies integrity with weak hash algorithm](https://cortex-docs.paloaltonetworks.com/appsec-rules/ci-cd-security/dependency-chains/appsec-cicd-174.md) - [NPM package lock file verifies integrity with weak hash algorithm (Gitlab)](https://cortex-docs.paloaltonetworks.com/appsec-rules/ci-cd-security/dependency-chains/appsec-cicd-175.md) - [NPM package lock file verifies integrity with weak hash algorithm (BitBucket)](https://cortex-docs.paloaltonetworks.com/appsec-rules/ci-cd-security/dependency-chains/appsec-cicd-176.md) - [NPM package lock file verifies in Azure repository integrity with weak hash algorithm](https://cortex-docs.paloaltonetworks.com/appsec-rules/ci-cd-security/dependency-chains/appsec-cicd-177.md) - [Packages insecurely installed through “npm install” command in Azure Pipelines pipeline](https://cortex-docs.paloaltonetworks.com/appsec-rules/ci-cd-security/dependency-chains/appsec-cicd-190.md) - [Possible Python typosquatting detected](https://cortex-docs.paloaltonetworks.com/appsec-rules/ci-cd-security/dependency-chains/appsec-cicd-200.md) - [Possible Python typosquatting detected in a GitLab repository](https://cortex-docs.paloaltonetworks.com/appsec-rules/ci-cd-security/dependency-chains/appsec-cicd-201.md) - [Possible Python typosquatting detected in a Bitbucket repository](https://cortex-docs.paloaltonetworks.com/appsec-rules/ci-cd-security/dependency-chains/appsec-cicd-202.md) - [Possible Python typosquatting detected in an Azure repository](https://cortex-docs.paloaltonetworks.com/appsec-rules/ci-cd-security/dependency-chains/appsec-cicd-203.md) - [Missing '.npmrc' file in repository](https://cortex-docs.paloaltonetworks.com/appsec-rules/ci-cd-security/dependency-chains/appsec-cicd-265.md) - [Secret exposed in proxy URL within '.npmrc' file](https://cortex-docs.paloaltonetworks.com/appsec-rules/ci-cd-security/dependency-chains/appsec-cicd-266.md) - [Secret exposed in registry URL within '.npmrc' file](https://cortex-docs.paloaltonetworks.com/appsec-rules/ci-cd-security/dependency-chains/appsec-cicd-267.md) - [Deprecated package used in NPM project](https://cortex-docs.paloaltonetworks.com/appsec-rules/ci-cd-security/dependency-chains/appsec-cicd-268.md) - [Potential dependency confusion due to package name or scope available in registry](https://cortex-docs.paloaltonetworks.com/appsec-rules/ci-cd-security/dependency-chains/appsec-cicd-269.md) - [Unencrypted channel used by '.npmrc' file to download dependencies from proxy](https://cortex-docs.paloaltonetworks.com/appsec-rules/ci-cd-security/dependency-chains/appsec-cicd-270.md) - [Unencrypted channel used by '.npmrc' file of a GitHub repository to download dependencies from regis](https://cortex-docs.paloaltonetworks.com/appsec-rules/ci-cd-security/dependency-chains/appsec-cicd-271.md) - [Missing '.npmrc' file in GitLab repository](https://cortex-docs.paloaltonetworks.com/appsec-rules/ci-cd-security/dependency-chains/appsec-cicd-272.md) - [Secret exposed in proxy URL within '.npmrc' file of a Gitlab repository](https://cortex-docs.paloaltonetworks.com/appsec-rules/ci-cd-security/dependency-chains/appsec-cicd-273.md) - [Secret exposed in registry URL within '.npmrc' file of a GitLab repository](https://cortex-docs.paloaltonetworks.com/appsec-rules/ci-cd-security/dependency-chains/appsec-cicd-274.md) - [Deprecated package used in NPM project of a GitLab repository](https://cortex-docs.paloaltonetworks.com/appsec-rules/ci-cd-security/dependency-chains/appsec-cicd-275.md) - [Potential dependency confusion in a GitLab repository due to package name or scope available in regi](https://cortex-docs.paloaltonetworks.com/appsec-rules/ci-cd-security/dependency-chains/appsec-cicd-276.md) - [Unencrypted channel used by '.npmrc' file of a GitLab repository to download dependencies from proxy](https://cortex-docs.paloaltonetworks.com/appsec-rules/ci-cd-security/dependency-chains/appsec-cicd-277.md) - [Unencrypted channel used by '.npmrc' file of a GitLab repository to download dependencies from regis](https://cortex-docs.paloaltonetworks.com/appsec-rules/ci-cd-security/dependency-chains/appsec-cicd-278.md) - [Missing '.npmrc' file in Bitbucket repository](https://cortex-docs.paloaltonetworks.com/appsec-rules/ci-cd-security/dependency-chains/appsec-cicd-279.md) - [Secret exposed in proxy URL within '.npmrc' file of a Bitbucket repository](https://cortex-docs.paloaltonetworks.com/appsec-rules/ci-cd-security/dependency-chains/appsec-cicd-280.md) - [Secret exposed in registry URL within '.npmrc' file of a Bitbucket repository](https://cortex-docs.paloaltonetworks.com/appsec-rules/ci-cd-security/dependency-chains/appsec-cicd-281.md) - [Deprecated package used in NPM project of a Bitbucket repository](https://cortex-docs.paloaltonetworks.com/appsec-rules/ci-cd-security/dependency-chains/appsec-cicd-282.md) - [Potential dependency confusion in a Bitbucket repository due to package name or scope available in r](https://cortex-docs.paloaltonetworks.com/appsec-rules/ci-cd-security/dependency-chains/appsec-cicd-283.md) - [Unencrypted channel used by '.npmrc' file of a Bitbucket repository to download dependencies from pr](https://cortex-docs.paloaltonetworks.com/appsec-rules/ci-cd-security/dependency-chains/appsec-cicd-284.md) - [Unencrypted channel used by '.npmrc' file of a bitbucket repository to download dependencies from re](https://cortex-docs.paloaltonetworks.com/appsec-rules/ci-cd-security/dependency-chains/appsec-cicd-285.md) - [Missing '.npmrc' file in Azure repository](https://cortex-docs.paloaltonetworks.com/appsec-rules/ci-cd-security/dependency-chains/appsec-cicd-286.md) - [Secret exposed in proxy URL within '.npmrc' file of an Azure repository](https://cortex-docs.paloaltonetworks.com/appsec-rules/ci-cd-security/dependency-chains/appsec-cicd-287.md) - [Secret exposed in registry URL within '.npmrc' file of an Azure repository](https://cortex-docs.paloaltonetworks.com/appsec-rules/ci-cd-security/dependency-chains/appsec-cicd-288.md) - [Deprecated package used in NPM project of an Azure repository](https://cortex-docs.paloaltonetworks.com/appsec-rules/ci-cd-security/dependency-chains/appsec-cicd-289.md) - [Potential dependency confusion in an Azure repository due to package name or scope available in regi](https://cortex-docs.paloaltonetworks.com/appsec-rules/ci-cd-security/dependency-chains/appsec-cicd-290.md) - [Unencrypted channel used by '.npmrc' file of an Azure repository to download dependencies from proxy](https://cortex-docs.paloaltonetworks.com/appsec-rules/ci-cd-security/dependency-chains/appsec-cicd-291.md) - [Unencrypted channel used by '.npmrc' file of an Azure repository to download dependencies from regis](https://cortex-docs.paloaltonetworks.com/appsec-rules/ci-cd-security/dependency-chains/appsec-cicd-292.md) - [NPM project contains unused dependencies](https://cortex-docs.paloaltonetworks.com/appsec-rules/ci-cd-security/dependency-chains/appsec-cicd-301.md) - [NPM project contains unused dependencies in a GitLab repository](https://cortex-docs.paloaltonetworks.com/appsec-rules/ci-cd-security/dependency-chains/appsec-cicd-302.md) - [NPM project contains unused dependencies in a Bitbucket repository](https://cortex-docs.paloaltonetworks.com/appsec-rules/ci-cd-security/dependency-chains/appsec-cicd-303.md) - [NPM project contains unused dependencies in an Azure Repos repository](https://cortex-docs.paloaltonetworks.com/appsec-rules/ci-cd-security/dependency-chains/appsec-cicd-304.md) - [NPM package downloaded from git without commit hash reference](https://cortex-docs.paloaltonetworks.com/appsec-rules/ci-cd-security/dependency-chains/appsec-cicd-313.md) - [NPM package downloaded from git without commit hash reference in a GitLab repository](https://cortex-docs.paloaltonetworks.com/appsec-rules/ci-cd-security/dependency-chains/appsec-cicd-314.md) - [NPM package downloaded from git without commit hash reference in a Bitbucket repository](https://cortex-docs.paloaltonetworks.com/appsec-rules/ci-cd-security/dependency-chains/appsec-cicd-315.md) - [NPM package downloaded from git without commit hash reference in an Azure Repos repository](https://cortex-docs.paloaltonetworks.com/appsec-rules/ci-cd-security/dependency-chains/appsec-cicd-316.md) - [Flow Control Mechanism](https://cortex-docs.paloaltonetworks.com/appsec-rules/ci-cd-security/flow-control-mechanism.md) - [Actively used repository lacks branch protection rules](https://cortex-docs.paloaltonetworks.com/appsec-rules/ci-cd-security/flow-control-mechanism/appsec-cicd-2.md) - [Actively used GitLab repository lacks branch protection rules](https://cortex-docs.paloaltonetworks.com/appsec-rules/ci-cd-security/flow-control-mechanism/appsec-cicd-3.md) - [Actively used BitBucket repository lacks branch protection rules](https://cortex-docs.paloaltonetworks.com/appsec-rules/ci-cd-security/flow-control-mechanism/appsec-cicd-4.md) - [Branch protection not enforced on administrators](https://cortex-docs.paloaltonetworks.com/appsec-rules/ci-cd-security/flow-control-mechanism/appsec-cicd-33.md) - [Pull request reviews not required before merging to the default branch](https://cortex-docs.paloaltonetworks.com/appsec-rules/ci-cd-security/flow-control-mechanism/appsec-cicd-34.md) - [Required reviews can be bypassed using GitHub Actions](https://cortex-docs.paloaltonetworks.com/appsec-rules/ci-cd-security/flow-control-mechanism/appsec-cicd-53.md) - [Pull request reviews in BitBucket not required before merging code to default branch](https://cortex-docs.paloaltonetworks.com/appsec-rules/ci-cd-security/flow-control-mechanism/appsec-cicd-68.md) - [Push restrictions not enforced on the default branch](https://cortex-docs.paloaltonetworks.com/appsec-rules/ci-cd-security/flow-control-mechanism/appsec-cicd-69.md) - [Merge request approvals not required for default branch](https://cortex-docs.paloaltonetworks.com/appsec-rules/ci-cd-security/flow-control-mechanism/appsec-cicd-79.md) - [GitLab branch protection rule allows push to default branch](https://cortex-docs.paloaltonetworks.com/appsec-rules/ci-cd-security/flow-control-mechanism/appsec-cicd-83.md) - ["Require review from Code Owners" Branch Protection rule was disabled](https://cortex-docs.paloaltonetworks.com/appsec-rules/ci-cd-security/flow-control-mechanism/appsec-cicd-116.md) - [Reviews may no longer be required before merging](https://cortex-docs.paloaltonetworks.com/appsec-rules/ci-cd-security/flow-control-mechanism/appsec-cicd-142.md) - [Repository does not dismiss pull request approvals on the default branch when new commits are pushed](https://cortex-docs.paloaltonetworks.com/appsec-rules/ci-cd-security/flow-control-mechanism/appsec-cicd-152.md) - [Pull request reviews are not required in Azure Repos before merging to the default branch](https://cortex-docs.paloaltonetworks.com/appsec-rules/ci-cd-security/flow-control-mechanism/appsec-cicd-179.md) - [Requestors allowed to self-approve pull requests on default branch](https://cortex-docs.paloaltonetworks.com/appsec-rules/ci-cd-security/flow-control-mechanism/appsec-cicd-180.md) - [Code owners reviews not required before merging to the default branch](https://cortex-docs.paloaltonetworks.com/appsec-rules/ci-cd-security/flow-control-mechanism/appsec-cicd-187.md) - [Merging to default branch with outdated code allowed](https://cortex-docs.paloaltonetworks.com/appsec-rules/ci-cd-security/flow-control-mechanism/appsec-cicd-197.md) - [Azure repository does not dismiss pull request approvals on the default branch when new commits are](https://cortex-docs.paloaltonetworks.com/appsec-rules/ci-cd-security/flow-control-mechanism/appsec-cicd-262.md) - [Identity Access Management](https://cortex-docs.paloaltonetworks.com/appsec-rules/ci-cd-security/identity-access-management.md) - [2FA is not enforced in SCM](https://cortex-docs.paloaltonetworks.com/appsec-rules/ci-cd-security/identity-access-management/appsec-cicd-1.md) - [Unrotated deploy keys](https://cortex-docs.paloaltonetworks.com/appsec-rules/ci-cd-security/identity-access-management/appsec-cicd-6.md) - [Unrotated GitLab deploy keys](https://cortex-docs.paloaltonetworks.com/appsec-rules/ci-cd-security/identity-access-management/appsec-cicd-7.md) - [Unrotated access keys detected](https://cortex-docs.paloaltonetworks.com/appsec-rules/ci-cd-security/identity-access-management/appsec-cicd-8.md) - [Inactive SCM user accounts](https://cortex-docs.paloaltonetworks.com/appsec-rules/ci-cd-security/identity-access-management/appsec-cicd-16.md) - [Jenkins provides full access to anonymous visitors](https://cortex-docs.paloaltonetworks.com/appsec-rules/ci-cd-security/identity-access-management/appsec-cicd-17.md) - [Jenkins provides full access to authenticated user accounts](https://cortex-docs.paloaltonetworks.com/appsec-rules/ci-cd-security/identity-access-management/appsec-cicd-18.md) - [User account is missing 2FA](https://cortex-docs.paloaltonetworks.com/appsec-rules/ci-cd-security/identity-access-management/appsec-cicd-22.md) - [Permissive organization base permissions](https://cortex-docs.paloaltonetworks.com/appsec-rules/ci-cd-security/identity-access-management/appsec-cicd-29.md) - [Outside collaborators have admin access to a repository](https://cortex-docs.paloaltonetworks.com/appsec-rules/ci-cd-security/identity-access-management/appsec-cicd-35.md) - [Deploy key has a weak SSH signature](https://cortex-docs.paloaltonetworks.com/appsec-rules/ci-cd-security/identity-access-management/appsec-cicd-36.md) - [Weak authentication service in use](https://cortex-docs.paloaltonetworks.com/appsec-rules/ci-cd-security/identity-access-management/appsec-cicd-49.md) - [Jenkins provides read access to anonymous visitors](https://cortex-docs.paloaltonetworks.com/appsec-rules/ci-cd-security/identity-access-management/appsec-cicd-50.md) - [No authentication is configured](https://cortex-docs.paloaltonetworks.com/appsec-rules/ci-cd-security/identity-access-management/appsec-cicd-51.md) - [Access key with a weak SSH signature was detected in SCM](https://cortex-docs.paloaltonetworks.com/appsec-rules/ci-cd-security/identity-access-management/appsec-cicd-70.md) - [Excessive user permissions to a repository](https://cortex-docs.paloaltonetworks.com/appsec-rules/ci-cd-security/identity-access-management/appsec-cicd-89.md) - [Excessive user permissions to a project](https://cortex-docs.paloaltonetworks.com/appsec-rules/ci-cd-security/identity-access-management/appsec-cicd-95.md) - [Excessive user permissions to a BitBucket repository](https://cortex-docs.paloaltonetworks.com/appsec-rules/ci-cd-security/identity-access-management/appsec-cicd-96.md) - [User account credentials (access token and/or SSH Keys) are inactive in GitHub](https://cortex-docs.paloaltonetworks.com/appsec-rules/ci-cd-security/identity-access-management/appsec-cicd-105.md) - [Any organization member can create internal repositories](https://cortex-docs.paloaltonetworks.com/appsec-rules/ci-cd-security/identity-access-management/appsec-cicd-184.md) - [Any organization member can create private repositories](https://cortex-docs.paloaltonetworks.com/appsec-rules/ci-cd-security/identity-access-management/appsec-cicd-185.md) - [Default branch does not require signed commits](https://cortex-docs.paloaltonetworks.com/appsec-rules/ci-cd-security/identity-access-management/appsec-cicd-206.md) - [Input Validation](https://cortex-docs.paloaltonetworks.com/appsec-rules/ci-cd-security/input-validation.md) - [Pipeline vulnerable to command injection](https://cortex-docs.paloaltonetworks.com/appsec-rules/ci-cd-security/input-validation/appsec-cicd-138.md) - [Possible command injection detected in user event](https://cortex-docs.paloaltonetworks.com/appsec-rules/ci-cd-security/input-validation/appsec-cicd-146.md) - [Workflow allows command execution through the standard output stream](https://cortex-docs.paloaltonetworks.com/appsec-rules/ci-cd-security/input-validation/appsec-cicd-186.md) - [CirceCI pipeline vulnerable to command injection](https://cortex-docs.paloaltonetworks.com/appsec-rules/ci-cd-security/input-validation/appsec-cicd-207.md) - [Logging And Visibility](https://cortex-docs.paloaltonetworks.com/appsec-rules/ci-cd-security/logging-and-visibility.md) - [Audit log not installed on Jenkins](https://cortex-docs.paloaltonetworks.com/appsec-rules/ci-cd-security/logging-and-visibility/appsec-cicd-9.md) - [Pipeline Based Access Controls](https://cortex-docs.paloaltonetworks.com/appsec-rules/ci-cd-security/pipeline-based-access-controls.md) - [Deploy keys assigned with write permissions](https://cortex-docs.paloaltonetworks.com/appsec-rules/ci-cd-security/pipeline-based-access-controls/appsec-cicd-26.md) - [GitLab deploy keys assigned with write permissions](https://cortex-docs.paloaltonetworks.com/appsec-rules/ci-cd-security/pipeline-based-access-controls/appsec-cicd-27.md) - [All instance jobs run with high privileges](https://cortex-docs.paloaltonetworks.com/appsec-rules/ci-cd-security/pipeline-based-access-controls/appsec-cicd-46.md) - [Jobs are allowed to run on the Jenkins Controller](https://cortex-docs.paloaltonetworks.com/appsec-rules/ci-cd-security/pipeline-based-access-controls/appsec-cicd-52.md) - [Jenkins jobs are executed with high privileges by default](https://cortex-docs.paloaltonetworks.com/appsec-rules/ci-cd-security/pipeline-based-access-controls/appsec-cicd-54.md) - [Jenkins jobs can be executed with high privileges](https://cortex-docs.paloaltonetworks.com/appsec-rules/ci-cd-security/pipeline-based-access-controls/appsec-cicd-55.md) - [GitLab project job token authorized to access other projects](https://cortex-docs.paloaltonetworks.com/appsec-rules/ci-cd-security/pipeline-based-access-controls/appsec-cicd-71.md) - [Default workflow permissions in the repository set to 'read and write'](https://cortex-docs.paloaltonetworks.com/appsec-rules/ci-cd-security/pipeline-based-access-controls/appsec-cicd-127.md) - [Default workflow permissions in the organization set to 'read and write'](https://cortex-docs.paloaltonetworks.com/appsec-rules/ci-cd-security/pipeline-based-access-controls/appsec-cicd-128.md) - [Excessive pipeline permissions on the repository](https://cortex-docs.paloaltonetworks.com/appsec-rules/ci-cd-security/pipeline-based-access-controls/appsec-cicd-156.md) - [Project configured for group-wide access using job token](https://cortex-docs.paloaltonetworks.com/appsec-rules/ci-cd-security/pipeline-based-access-controls/appsec-cicd-238.md) - [Pipeline Configuration](https://cortex-docs.paloaltonetworks.com/appsec-rules/ci-cd-security/pipeline-configuration.md) - [An archived GitHub action is used](https://cortex-docs.paloaltonetworks.com/appsec-rules/ci-cd-security/pipeline-configuration/appsec-cicd-343.md) - [A GitHub workflow is using action with CRITICAL severity CVE](https://cortex-docs.paloaltonetworks.com/appsec-rules/ci-cd-security/pipeline-configuration/appsec-cicd-344.md) - [A pipeline is using rejected Supply Chain Tool](https://cortex-docs.paloaltonetworks.com/appsec-rules/ci-cd-security/pipeline-configuration/appsec-cicd-345.md) - [A pipeline is using an unapproved Supply Chain Tool](https://cortex-docs.paloaltonetworks.com/appsec-rules/ci-cd-security/pipeline-configuration/appsec-cicd-346.md) - [Jenkins instance is using rejected plugin](https://cortex-docs.paloaltonetworks.com/appsec-rules/ci-cd-security/pipeline-configuration/appsec-cicd-347.md) - [Jenkins instance is using an unapproved plugin](https://cortex-docs.paloaltonetworks.com/appsec-rules/ci-cd-security/pipeline-configuration/appsec-cicd-348.md) - [A deprecated Jenkins plugin is used on a Jenkins Instance](https://cortex-docs.paloaltonetworks.com/appsec-rules/ci-cd-security/pipeline-configuration/appsec-cicd-349.md) - [A Jenkins plugin with CRITICAL severity CVE is installed on a Jenkins Instance](https://cortex-docs.paloaltonetworks.com/appsec-rules/ci-cd-security/pipeline-configuration/appsec-cicd-350.md) - [A pipeline is using a rejected tool within a Remote Script](https://cortex-docs.paloaltonetworks.com/appsec-rules/ci-cd-security/pipeline-configuration/appsec-cicd-351.md) - [A pipeline is using an unapproved tool within a Remote Script](https://cortex-docs.paloaltonetworks.com/appsec-rules/ci-cd-security/pipeline-configuration/appsec-cicd-352.md) - [A GitHub workflow is using action with HIGH severity CVE](https://cortex-docs.paloaltonetworks.com/appsec-rules/ci-cd-security/pipeline-configuration/appsec-cicd-355.md) - [A Jenkins plugin with HIGH severity CVE is installed on a Jenkins Instance](https://cortex-docs.paloaltonetworks.com/appsec-rules/ci-cd-security/pipeline-configuration/appsec-cicd-356.md) - [Unverified MCP Server Vendor is detected in an SCM Repository](https://cortex-docs.paloaltonetworks.com/appsec-rules/ci-cd-security/pipeline-configuration/appsec-cicd-357.md) - [Non-Containerized MCP Server is detected in an SCM Repository](https://cortex-docs.paloaltonetworks.com/appsec-rules/ci-cd-security/pipeline-configuration/appsec-cicd-358.md) - [Unmaintained MCP Server is detected in an SCM Repository](https://cortex-docs.paloaltonetworks.com/appsec-rules/ci-cd-security/pipeline-configuration/appsec-cicd-359.md) - [Archived or Deprecated MCP Server in use, detected in SCM repository](https://cortex-docs.paloaltonetworks.com/appsec-rules/ci-cd-security/pipeline-configuration/appsec-cicd-360.md) - [MCP Server with Dangerous Capability Request is detected in SCM Repository](https://cortex-docs.paloaltonetworks.com/appsec-rules/ci-cd-security/pipeline-configuration/appsec-cicd-361.md) - [A Rejected MCP Server is in-use (recognized in SCM Repository config file)](https://cortex-docs.paloaltonetworks.com/appsec-rules/ci-cd-security/pipeline-configuration/appsec-cicd-362.md) - [An Unapproved MCP Server is in-use (recognized in SCM Repository config file)](https://cortex-docs.paloaltonetworks.com/appsec-rules/ci-cd-security/pipeline-configuration/appsec-cicd-363.md) - [Unverified MCP Server Vendor is detected in a Pipeline](https://cortex-docs.paloaltonetworks.com/appsec-rules/ci-cd-security/pipeline-configuration/appsec-cicd-364.md) - [Non-Containerized MCP Server is detected in a Pipeline](https://cortex-docs.paloaltonetworks.com/appsec-rules/ci-cd-security/pipeline-configuration/appsec-cicd-365.md) - [Unmaintained MCP Server is detected in a Pipeline](https://cortex-docs.paloaltonetworks.com/appsec-rules/ci-cd-security/pipeline-configuration/appsec-cicd-366.md) - [Archived or Deprecated MCP Server is detected in a Pipeline](https://cortex-docs.paloaltonetworks.com/appsec-rules/ci-cd-security/pipeline-configuration/appsec-cicd-367.md) - [MCP Server with Dangerous Capability Request is detected in a Pipeline](https://cortex-docs.paloaltonetworks.com/appsec-rules/ci-cd-security/pipeline-configuration/appsec-cicd-368.md) - [Rejected MCP Server in Use in the Pipeline](https://cortex-docs.paloaltonetworks.com/appsec-rules/ci-cd-security/pipeline-configuration/appsec-cicd-369.md) - [Unapproved MCP Server in Use in the Pipeline](https://cortex-docs.paloaltonetworks.com/appsec-rules/ci-cd-security/pipeline-configuration/appsec-cicd-370.md) - [Unverified MCP Server Vendor is detected in IDE](https://cortex-docs.paloaltonetworks.com/appsec-rules/ci-cd-security/pipeline-configuration/appsec-cicd-371.md) - [Non-Containerized MCP Server is detected in IDE](https://cortex-docs.paloaltonetworks.com/appsec-rules/ci-cd-security/pipeline-configuration/appsec-cicd-372.md) - [Unmaintained MCP Server is detected in IDE](https://cortex-docs.paloaltonetworks.com/appsec-rules/ci-cd-security/pipeline-configuration/appsec-cicd-373.md) - [Archived or Deprecated MCP Server in Use is detected in IDE](https://cortex-docs.paloaltonetworks.com/appsec-rules/ci-cd-security/pipeline-configuration/appsec-cicd-374.md) - [MCP Server with Dangerous Capability Request is detected in IDE](https://cortex-docs.paloaltonetworks.com/appsec-rules/ci-cd-security/pipeline-configuration/appsec-cicd-375.md) - [Contributor is using Rejected MCP Server in their IDE](https://cortex-docs.paloaltonetworks.com/appsec-rules/ci-cd-security/pipeline-configuration/appsec-cicd-376.md) - [Contributor is using an Unapproved MCP Server in their IDE](https://cortex-docs.paloaltonetworks.com/appsec-rules/ci-cd-security/pipeline-configuration/appsec-cicd-377.md) - [PPE](https://cortex-docs.paloaltonetworks.com/appsec-rules/ci-cd-security/ppe.md) - [Direct Poisoned Pipeline Execution](https://cortex-docs.paloaltonetworks.com/appsec-rules/ci-cd-security/ppe/appsec-cicd-40.md) - [Direct Poisoned Pipeline Execution by outside collaborators](https://cortex-docs.paloaltonetworks.com/appsec-rules/ci-cd-security/ppe/appsec-cicd-144.md) - [SCM System Configuration](https://cortex-docs.paloaltonetworks.com/appsec-rules/ci-cd-security/scm-system-configuration.md) - [GitHub is using rejected Application](https://cortex-docs.paloaltonetworks.com/appsec-rules/ci-cd-security/scm-system-configuration/appsec-cicd-341.md) - [GitHub is using an unapproved Application](https://cortex-docs.paloaltonetworks.com/appsec-rules/ci-cd-security/scm-system-configuration/appsec-cicd-342.md) - [SCM is using a rejected Webhook](https://cortex-docs.paloaltonetworks.com/appsec-rules/ci-cd-security/scm-system-configuration/appsec-cicd-353.md) - [SCM is using an unapproved Webhook](https://cortex-docs.paloaltonetworks.com/appsec-rules/ci-cd-security/scm-system-configuration/appsec-cicd-354.md) - [System Configurations](https://cortex-docs.paloaltonetworks.com/appsec-rules/ci-cd-security/system-configurations.md) - [Vulnerable Jenkins plugins](https://cortex-docs.paloaltonetworks.com/appsec-rules/ci-cd-security/system-configurations/appsec-cicd-10.md) - [Vulnerable Jenkins version in use](https://cortex-docs.paloaltonetworks.com/appsec-rules/ci-cd-security/system-configurations/appsec-cicd-11.md) - [Throttling is not enabled in SCM](https://cortex-docs.paloaltonetworks.com/appsec-rules/ci-cd-security/system-configurations/appsec-cicd-15.md) - [Access to resources on the GitLab server from GitLab services is not restricted](https://cortex-docs.paloaltonetworks.com/appsec-rules/ci-cd-security/system-configurations/appsec-cicd-25.md) - [LDAP is configured to use an unencrypted channel](https://cortex-docs.paloaltonetworks.com/appsec-rules/ci-cd-security/system-configurations/appsec-cicd-47.md) - [Jenkins instance traffic sent over an unencrypted channel](https://cortex-docs.paloaltonetworks.com/appsec-rules/ci-cd-security/system-configurations/appsec-cicd-48.md) - [GitHub Actions is enabled and not used in a repository](https://cortex-docs.paloaltonetworks.com/appsec-rules/ci-cd-security/system-configurations/appsec-cicd-60.md) - [Self-hosted runner group allows public repositories](https://cortex-docs.paloaltonetworks.com/appsec-rules/ci-cd-security/system-configurations/appsec-cicd-181.md) - [Organization's identity not confirmed with a verified badge](https://cortex-docs.paloaltonetworks.com/appsec-rules/ci-cd-security/system-configurations/appsec-cicd-188.md) - [Push restrictions are not enforced on the default branch in GitHub](https://cortex-docs.paloaltonetworks.com/appsec-rules/ci-cd-security/system-configurations/appsec-cicd-208.md) - [Third Party Services](https://cortex-docs.paloaltonetworks.com/appsec-rules/ci-cd-security/third-party-services.md) - [Excessive GitHub App permissions](https://cortex-docs.paloaltonetworks.com/appsec-rules/ci-cd-security/third-party-services/appsec-cicd-97.md) - [Unrestricted usage of GitHub Actions allowed in the repository](https://cortex-docs.paloaltonetworks.com/appsec-rules/ci-cd-security/third-party-services/appsec-cicd-129.md) - [Unrestricted usage of GitHub Actions allowed across the organization](https://cortex-docs.paloaltonetworks.com/appsec-rules/ci-cd-security/third-party-services/appsec-cicd-130.md) - [Mutable orb used in the pipeline](https://cortex-docs.paloaltonetworks.com/appsec-rules/ci-cd-security/third-party-services/appsec-cicd-196.md) - [Secrets Security](https://cortex-docs.paloaltonetworks.com/appsec-rules/secrets-security.md) - [GitHub repository defined in Terraform is not Private](https://cortex-docs.paloaltonetworks.com/appsec-rules/secrets-security/appsec-git-1.md) - [Artifactory Credentials detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/secrets-security/appsec-secret-1.md) - [AWS Credentials detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/secrets-security/appsec-secret-2.md) - [Azure Storage Account Access Key detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/secrets-security/appsec-secret-3.md) - [Basic Auth Credential detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/secrets-security/appsec-secret-4.md) - [Cloudant Credential detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/secrets-security/appsec-secret-5.md) - [Base64 High Entropy String detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/secrets-security/appsec-secret-6.md) - [IBM Cloud IAM Key detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/secrets-security/appsec-secret-7.md) - [IBM COS HMAC credential detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/secrets-security/appsec-secret-8.md) - [JSON Web Token detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/secrets-security/appsec-secret-9.md) - [Mailchimp Access Key detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/secrets-security/appsec-secret-11.md) - [NPM Token detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/secrets-security/appsec-secret-12.md) - [Private Key detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/secrets-security/appsec-secret-13.md) - [Slack Token detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/secrets-security/appsec-secret-14.md) - [SoftLayer Credential detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/secrets-security/appsec-secret-15.md) - [Square OAuth Secret detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/secrets-security/appsec-secret-16.md) - [Stripe Access Key detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/secrets-security/appsec-secret-17.md) - [Twilio Access Key detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/secrets-security/appsec-secret-18.md) - [Hex High Entropy String detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/secrets-security/appsec-secret-19.md) - [Airtable API Key detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/secrets-security/appsec-secret-21.md) - [Algolia Key detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/secrets-security/appsec-secret-22.md) - [Alibaba Cloud Key detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/secrets-security/appsec-secret-23.md) - [Asana Key detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/secrets-security/appsec-secret-24.md) - [Atlassian Oauth2 Key detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/secrets-security/appsec-secret-25.md) - [Auth0 Key detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/secrets-security/appsec-secret-26.md) - [Bitbucket Key detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/secrets-security/appsec-secret-27.md) - [Buildkite Agent Token detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/secrets-security/appsec-secret-28.md) - [CircleCI Personal Token detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/secrets-security/appsec-secret-29.md) - [Codecov API key detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/secrets-security/appsec-secret-30.md) - [Coinbase Key detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/secrets-security/appsec-secret-31.md) - [Confluent Key detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/secrets-security/appsec-secret-32.md) - [Databricks Authentication Token detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/secrets-security/appsec-secret-33.md) - [DigitalOcean Token detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/secrets-security/appsec-secret-34.md) - [Discord Token detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/secrets-security/appsec-secret-35.md) - [Doppler API Key detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/secrets-security/appsec-secret-36.md) - [DroneCI Token detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/secrets-security/appsec-secret-37.md) - [Dropbox App Credential detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/secrets-security/appsec-secret-38.md) - [Dynatrace token detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/secrets-security/appsec-secret-39.md) - [Elastic Email Key detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/secrets-security/appsec-secret-40.md) - [Fastly Personal Token detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/secrets-security/appsec-secret-41.md) - [FullStory API Key detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/secrets-security/appsec-secret-42.md) - [GitHub Token detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/secrets-security/appsec-secret-43.md) - [GitLab Token detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/secrets-security/appsec-secret-44.md) - [Google API Key detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/secrets-security/appsec-secret-45.md) - [Grafana Token detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/secrets-security/appsec-secret-46.md) - [Terraform Cloud API Token detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/secrets-security/appsec-secret-47.md) - [Heroku Platform Key detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/secrets-security/appsec-secret-48.md) - [HubSpot API Key detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/secrets-security/appsec-secret-49.md) - [Intercom Access Token detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/secrets-security/appsec-secret-50.md) - [Jira Token detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/secrets-security/appsec-secret-51.md) - [LaunchDarkly Personal Token detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/secrets-security/appsec-secret-52.md) - [Netlify Token detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/secrets-security/appsec-secret-53.md) - [New Relic Key detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/secrets-security/appsec-secret-54.md) - [Notion Integration Token detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/secrets-security/appsec-secret-55.md) - [Okta Token detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/secrets-security/appsec-secret-56.md) - [PagerDuty Authorization Token detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/secrets-security/appsec-secret-57.md) - [PlanetScale Token detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/secrets-security/appsec-secret-58.md) - [Postman API Key detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/secrets-security/appsec-secret-59.md) - [Pulumi Access Token detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/secrets-security/appsec-secret-60.md) - [Python Package Index Key detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/secrets-security/appsec-secret-61.md) - [RapidAPI Key detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/secrets-security/appsec-secret-62.md) - [Readme API Key detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/secrets-security/appsec-secret-63.md) - [RubyGems API Key detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/secrets-security/appsec-secret-64.md) - [Sentry Token detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/secrets-security/appsec-secret-65.md) - [Splunk User Credential detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/secrets-security/appsec-secret-66.md) - [Sumo Logic Key detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/secrets-security/appsec-secret-67.md) - [Telegram Bot Token detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/secrets-security/appsec-secret-68.md) - [Travis Personal Token detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/secrets-security/appsec-secret-69.md) - [Typeform API Token detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/secrets-security/appsec-secret-70.md) - [Vault Unseal Key detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/secrets-security/appsec-secret-71.md) - [Yandex Predictor API key detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/secrets-security/appsec-secret-72.md) - [Cloudflare API Credential detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/secrets-security/appsec-secret-73.md) - [Vercel API Token detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/secrets-security/appsec-secret-74.md) - [Webflow API Token detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/secrets-security/appsec-secret-75.md) - [Scalr API Token detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/secrets-security/appsec-secret-76.md) - [MongoDB Connection String detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/secrets-security/appsec-secret-77.md) - [Braintree Access Token detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/secrets-security/appsec-secret-78.md) - [GCP Service Account Auth Key detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/secrets-security/appsec-secret-79.md) - [Random High Entropy String detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/secrets-security/appsec-secret-80.md) - [Braintree Payments Key detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/secrets-security/appsec-secret-81.md) - [AWS MWS Auth Token detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/secrets-security/appsec-secret-82.md) - [PayPal Token ID detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/secrets-security/appsec-secret-83.md) - [PayPal Token Key detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/secrets-security/appsec-secret-84.md) - [Braintree Payments Id detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/secrets-security/appsec-secret-85.md) - [SonarQube Token detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/secrets-security/appsec-secret-86.md) - [SendGrid Key detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/secrets-security/appsec-secret-87.md) - [Firebase Cloud Messaging API key detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/secrets-security/appsec-secret-88.md) - [Docker Swarm Join Token detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/secrets-security/appsec-secret-89.md) - [Shopify Generic App Token detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/secrets-security/appsec-secret-90.md) - [Mapbox Token detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/secrets-security/appsec-secret-91.md) - [PubNub Subscription Key detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/secrets-security/appsec-secret-92.md) - [PubNub Publish Key detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/secrets-security/appsec-secret-93.md) - [Mailgun Primary Account API key detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/secrets-security/appsec-secret-94.md) - [SendinBlue Key detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/secrets-security/appsec-secret-95.md) - [Crates API Token detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/secrets-security/appsec-secret-96.md) - [Shopify Private App Token detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/secrets-security/appsec-secret-97.md) - [Flutterwave API Key detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/secrets-security/appsec-secret-98.md) - [NuGet API Key detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/secrets-security/appsec-secret-99.md) - [Checkout.com API Key detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/secrets-security/appsec-secret-100.md) - [Square Access Token detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/secrets-security/appsec-secret-101.md) - [Square Access Token V2 detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/secrets-security/appsec-secret-102.md) - [Typeform Personal Access Token detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/secrets-security/appsec-secret-103.md) - [Mailgun Domain Sending Key detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/secrets-security/appsec-secret-104.md) - [Frame IO Token detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/secrets-security/appsec-secret-105.md) - [Clojars Deploy Token detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/secrets-security/appsec-secret-106.md) - [OpenAI API Key detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/secrets-security/appsec-secret-107.md) - [Samsara API Key detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/secrets-security/appsec-secret-108.md) - [Anthropic API key detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/secrets-security/appsec-secret-109.md) - [Hugging Face token detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/secrets-security/appsec-secret-110.md) - [Microsoft Teams webhook detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/secrets-security/appsec-secret-111.md) - [Azure Functions HTTP Trigger Key detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/secrets-security/appsec-secret-112.md) - [MonkeyLearn API Key detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/secrets-security/appsec-secret-113.md) - [Clarifai API Key detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/secrets-security/appsec-secret-114.md) - [Azure Machine Learning web service API key detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/secrets-security/appsec-secret-115.md) - [MongoDB Atlas Keys Secret detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/secrets-security/appsec-secret-116.md) - [MongoDB Atlas Keys ID detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/secrets-security/appsec-secret-117.md) - [Customer.io Track Keys detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/secrets-security/appsec-secret-118.md) - [Databricks Authentication Token With Hostname detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/secrets-security/appsec-secret-119.md) - [GitGuardian Public Monitoring API Key detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/secrets-security/appsec-secret-121.md) - [Mandrill API Key detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/secrets-security/appsec-secret-122.md) - [Elastic Cloud Credentials detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/secrets-security/appsec-secret-123.md) - [OpenWeatherMap Token detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/secrets-security/appsec-secret-124.md) - [Mailjet Keys ID detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/secrets-security/appsec-secret-125.md) - [Mailjet Keys Secret detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/secrets-security/appsec-secret-126.md) - [Pusher Channels Key detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/secrets-security/appsec-secret-127.md) - [Pusher Channels Secret detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/secrets-security/appsec-secret-128.md) - [LinkedIn OAuth2 Keys detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/secrets-security/appsec-secret-129.md) - [LinkedIn OAuth2 Secrets detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/secrets-security/appsec-secret-130.md) - [WeChat App User ID detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/secrets-security/appsec-secret-131.md) - [WeChat App Keys detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/secrets-security/appsec-secret-132.md) - [Webex App Keys detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/secrets-security/appsec-secret-133.md) - [Webex App Secrets detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/secrets-security/appsec-secret-134.md) - [Lacework API Keys detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/secrets-security/appsec-secret-135.md) - [Lacework API Secrets detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/secrets-security/appsec-secret-136.md) - [Zendesk Token detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/secrets-security/appsec-secret-137.md) - [Zoom API JWT Keys detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/secrets-security/appsec-secret-138.md) - [Zoom API JWT Secrets detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/secrets-security/appsec-secret-139.md) - [Zoom API Keys detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/secrets-security/appsec-secret-141.md) - [Zoom API Secrets detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/secrets-security/appsec-secret-142.md) - [Contentful Content Delivery API Key detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/secrets-security/appsec-secret-143.md) - [MariaDB Credentials detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/secrets-security/appsec-secret-144.md) - [AWS SES client secret detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/secrets-security/appsec-secret-145.md) - [reCAPTCHA key detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/secrets-security/appsec-secret-146.md) - [Adobe API ID detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/secrets-security/appsec-secret-147.md) - [Adobe API Secret detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/secrets-security/appsec-secret-148.md) - [DB2 Credentials detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/secrets-security/appsec-secret-149.md) - [Pingdom Token detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/secrets-security/appsec-secret-150.md) - [Redis Credentials detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/secrets-security/appsec-secret-151.md) - [Coveralls Token detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/secrets-security/appsec-secret-152.md) - [Azure Active Directory Client Secret detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/secrets-security/appsec-secret-153.md) - [DataDog Token detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/secrets-security/appsec-secret-154.md) - [GitHub OAuth App Key detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/secrets-security/appsec-secret-155.md) - [GitHub OAuth App Client ID detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/secrets-security/appsec-secret-156.md) - [LDAP Credentials detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/secrets-security/appsec-secret-157.md) - [MySQL User Name detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/secrets-security/appsec-secret-158.md) - [MySQL Password detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/secrets-security/appsec-secret-159.md) - [FTP User Name detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/secrets-security/appsec-secret-162.md) - [FTP Password detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/secrets-security/appsec-secret-163.md) - [AMQP User Name detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/secrets-security/appsec-secret-164.md) - [AMQP Password detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/secrets-security/appsec-secret-165.md) - [Stripe Webhook Secret detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/secrets-security/appsec-secret-166.md) - [Rails Secret Key Base detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/secrets-security/appsec-secret-167.md) - [Salesforce Refresh Token detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/secrets-security/appsec-secret-168.md) - [Azure Service Management Certificate detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/secrets-security/appsec-secret-169.md) - [Codeclimate key detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/secrets-security/appsec-secret-170.md) - [Docker Swarm Unlock Key detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/secrets-security/appsec-secret-171.md) - [Facebook Access Token detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/secrets-security/appsec-secret-172.md) - [Putty Private Key detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/secrets-security/appsec-secret-173.md) - [Tableau Personal Access Token detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/secrets-security/appsec-secret-174.md) - [Zillow Key detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/secrets-security/appsec-secret-175.md) - [Line Messaging OAuth2 Keys detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/secrets-security/appsec-secret-176.md) - [Google Bard API Key detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/secrets-security/appsec-secret-177.md) - [Azure Subscription Key detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/secrets-security/appsec-secret-178.md) - [Authentication Tuple detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/secrets-security/appsec-secret-179.md) - [Okta Keys Client Secret detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/secrets-security/appsec-secret-180.md) - [Generic Terraform Variable Secret detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/secrets-security/appsec-secret-181.md) - [SMTP credentials Password detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/secrets-security/appsec-secret-182.md) - [SMTP credentials - Secret detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/secrets-security/appsec-secret-183.md) - [Yahoo OAuth2 Keys detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/secrets-security/appsec-secret-184.md) - [Eventbrite OAuth2 Keys detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/secrets-security/appsec-secret-185.md) - [Octopus Deploy API key detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/secrets-security/appsec-secret-191.md) - [Bearer token detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/secrets-security/appsec-secret-192.md) - [Django secret key detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/secrets-security/appsec-secret-194.md) - [Salesforce OAuth2 ID detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/secrets-security/appsec-secret-195.md) - [Salesforce OAuth2 secret detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/secrets-security/appsec-secret-196.md) - [Azure DevOps personal access token detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/secrets-security/appsec-secret-197.md) - [Splunk authentication token detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/secrets-security/appsec-secret-198.md) - [HashiCorp Vault token detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/secrets-security/appsec-secret-199.md) - [Kubernetes cluster credentials detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/secrets-security/appsec-secret-200.md) - [Jira basic authentication credentials detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/secrets-security/appsec-secret-201.md) - [Neo4j credentials detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/secrets-security/appsec-secret-202.md) - [Keycloak API key detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/secrets-security/appsec-secret-203.md) - [Oracle credentials detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/secrets-security/appsec-secret-204.md) - [Thycotic Secret Server credentials detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/secrets-security/appsec-secret-205.md) - [Gemfury access token detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/secrets-security/appsec-secret-206.md) - [Zoho OAuth2 keys detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/secrets-security/appsec-secret-207.md) - [Zoom SDK keys detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/secrets-security/appsec-secret-208.md) - [Cloudera model key detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/secrets-security/appsec-secret-209.md) - [Akamai API client secret detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/secrets-security/appsec-secret-210.md) - [Generic database assignment detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/secrets-security/appsec-secret-211.md) - [Generic CLI key detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/secrets-security/appsec-secret-212.md) - [Akamai API client token detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/secrets-security/appsec-secret-213.md) - [ODBC connection string detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/secrets-security/appsec-secret-214.md) - [Sauce Labs keys detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/secrets-security/appsec-secret-215.md) - [OVH keys detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/secrets-security/appsec-secret-216.md) - [PingIdentity keys detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/secrets-security/appsec-secret-217.md) - [Slack Application secret detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/secrets-security/appsec-secret-218.md) - [Slack Application ID detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/secrets-security/appsec-secret-219.md) - [Grafana service account token detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/secrets-security/appsec-secret-220.md) - [Redis server password detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/secrets-security/appsec-secret-221.md) - [Slack signing secret detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/secrets-security/appsec-secret-222.md) - [SSH Password detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/secrets-security/appsec-secret-223.md) - [Encrypted Private Key detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/secrets-security/appsec-secret-224.md) - [Duo key detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/secrets-security/appsec-secret-225.md) - [Slack bot token detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/secrets-security/appsec-secret-226.md) - [Slack application credentials detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/secrets-security/appsec-secret-227.md) - [Base64 AWS SES keys detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/secrets-security/appsec-secret-228.md) - [Base64 AWS IAM Secret Key detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/secrets-security/appsec-secret-229.md) - [Slack app token detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/secrets-security/appsec-secret-230.md) - [Razorpay API key detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/secrets-security/appsec-secret-231.md) - [PGP Private Key detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/secrets-security/appsec-secret-232.md) - [Twitter access keys detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/secrets-security/appsec-secret-233.md) - [Base64 basic authentication detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/secrets-security/appsec-secret-234.md) - [GitHub App Keys detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/secrets-security/appsec-secret-235.md) - [Snowflake credentials detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/secrets-security/appsec-secret-236.md) - [Azure OpenAI API endpoint detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/secrets-security/appsec-secret-237.md) - [Azure OpenAI API key detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/secrets-security/appsec-secret-238.md) - [Fernet key detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/secrets-security/appsec-secret-239.md) - [New Relic APM license key detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/secrets-security/appsec-secret-240.md) - [NX Cloud token detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/secrets-security/appsec-secret-241.md) - [Plaid access token detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/secrets-security/appsec-secret-242.md) - [Redshift credentials detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/secrets-security/appsec-secret-243.md) - [Replicate user access token detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/secrets-security/appsec-secret-244.md) - [Solr credentials detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/secrets-security/appsec-secret-245.md) - [Discord OAuth2 secret detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/secrets-security/appsec-secret-246.md) - [Kubernetes Docker secret detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/secrets-security/appsec-secret-247.md) - [Sourcegraph access token detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/secrets-security/appsec-secret-248.md) - [Workato API key detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/secrets-security/appsec-secret-249.md) - [Google OAuth2 secret detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/secrets-security/appsec-secret-250.md) - [DigitalOcean Spaces secret detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/secrets-security/appsec-secret-251.md) - [DigitalOcean Spaces connection string detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/secrets-security/appsec-secret-252.md) - [LaunchDarkly SDK key detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/secrets-security/appsec-secret-253.md) - [Zapier webhook url detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/secrets-security/appsec-secret-254.md) - [GitLab enterprise server key detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/secrets-security/appsec-secret-255.md) - [Rails Master Key detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/secrets-security/appsec-secret-256.md) - [PubNub Secret Key detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/secrets-security/appsec-secret-257.md) - [Shopify Keys detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/secrets-security/appsec-secret-258.md) - [New Relic Agent Token detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/secrets-security/appsec-secret-259.md) - [New Relic API Key detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/secrets-security/appsec-secret-260.md) - [HashiCorp Vault Unseal Key detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/secrets-security/appsec-secret-261.md) - [Slack Webhook URL detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/secrets-security/appsec-secret-262.md) - [Samsara API token detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/secrets-security/appsec-secret-263.md) - [Dropbox Key token detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/secrets-security/appsec-secret-264.md) - [Figma Personal Access Token detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/secrets-security/appsec-secret-265.md) - [Azure Functions App Key Header detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/secrets-security/appsec-secret-266.md) - [Azure Functions App Key Query Parameter detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/secrets-security/appsec-secret-267.md) - [Jenkins API Token detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/secrets-security/appsec-secret-268.md) - [Nessus Agent Key detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/secrets-security/appsec-secret-269.md) - [VISA Basic Authentication Credentials detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/secrets-security/appsec-secret-270.md) - [OpenAI Project API Key detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/secrets-security/appsec-secret-271.md) - [Midtrans API Key detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/secrets-security/appsec-secret-272.md) - [Base64 Midtrans API Key detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/secrets-security/appsec-secret-273.md) - [Atlassian Access Token detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/secrets-security/appsec-secret-274.md) - [New Relic Insights Query Key detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/secrets-security/appsec-secret-275.md) - [ASPNet Validation Key detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/secrets-security/appsec-secret-276.md) - [ASPNet Decryption Key detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/secrets-security/appsec-secret-277.md) - [InfluxDB Token detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/secrets-security/appsec-secret-278.md) - [New Relic Insights Insert Key detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/secrets-security/appsec-secret-279.md) - [Prefixed New Relic Insights Insert Key detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/secrets-security/appsec-secret-280.md) - [MSSQL Credentials detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/secrets-security/appsec-secret-281.md) - [MSSQL Connection String detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/secrets-security/appsec-secret-282.md) - [Cloudinary API Key URL detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/secrets-security/appsec-secret-283.md) - [Cloudinary API Key Config detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/secrets-security/appsec-secret-284.md) - [Google OAuth2 token detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/secrets-security/appsec-secret-285.md) - [Freshdesk API Token detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/secrets-security/appsec-secret-286.md) - [Grafana Cloud API Key detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/secrets-security/appsec-secret-287.md) - [Base64 AWS IAM Access Key detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/secrets-security/appsec-secret-288.md) - [Aiven API Key detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/secrets-security/appsec-secret-289.md) - [Anthropic Admin Key detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/secrets-security/appsec-secret-290.md) - [CircleCI Project Token detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/secrets-security/appsec-secret-291.md) - [Tencent Cloud Secret ID detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/secrets-security/appsec-secret-292.md) - [Azure API Management Repository Key detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/secrets-security/appsec-secret-293.md) - [Azure API Management Subscription Key detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/secrets-security/appsec-secret-294.md) - [Azure App Configuration Connection String detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/secrets-security/appsec-secret-295.md) - [Azure Communication Services Connection String detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/secrets-security/appsec-secret-296.md) - [Azure Batch Key Identifiable detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/secrets-security/appsec-secret-297.md) - [Azure Cosmosdb Key Identifiable detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/secrets-security/appsec-secret-298.md) - [Azure SignalR Connection String detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/secrets-security/appsec-secret-299.md) - [Azure Entra ID Token detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/secrets-security/appsec-secret-300.md) - [Azure Search Admin Key detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/secrets-security/appsec-secret-301.md) - [EasyPost API Key detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/secrets-security/appsec-secret-303.md) - [MongoDB credentials detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/secrets-security/appsec-secret-304.md) - [Trendmicro Cloudone Apikey v2 detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/secrets-security/appsec-secret-305.md) - [Slack Configuration Refresh Token detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/secrets-security/appsec-secret-306.md) - [DigitalOcean OAuth Application Token v1 detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/secrets-security/appsec-secret-307.md) - [DigitalOcean Personal Access Token v1 detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/secrets-security/appsec-secret-308.md) - [DigitalOcean Refresh Token v1 detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/secrets-security/appsec-secret-309.md) - [FTP Credentials Assignment detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/secrets-security/appsec-secret-310.md) - [Amqp Assignment detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/secrets-security/appsec-secret-311.md) - [Sourcegraph Access Token v1 detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/secrets-security/appsec-secret-312.md) - [Sourcegraph Access Token v3 detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/secrets-security/appsec-secret-313.md) - [Dropbox Access Token detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/secrets-security/appsec-secret-314.md) - [PostgreSQL Connection String detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/secrets-security/appsec-secret-315.md) - [Slack Workflow Webhook URL detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/secrets-security/appsec-secret-316.md) - [Google OAuth2 ID detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/secrets-security/appsec-secret-317.md) - [HashiCorp Vault Batch Token detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/secrets-security/appsec-secret-318.md) - [HashiCorp Vault Recovery token detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/secrets-security/appsec-secret-319.md) - [Groq API Key detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/secrets-security/appsec-secret-320.md) - [Artifactory Access Token detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/secrets-security/appsec-secret-321.md) - [Google OAuth Refresh token detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/secrets-security/appsec-secret-322.md) - [GitLab Deploy Token was detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/secrets-security/appsec-secret-323.md) - [GitLab Runner Authentication Token was detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/secrets-security/appsec-secret-324.md) - [GitGuardian Internal Monitoring Key was detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/secrets-security/appsec-secret-325.md) - [Shippo API token was detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/secrets-security/appsec-secret-326.md) - [Infracost API Key was detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/secrets-security/appsec-secret-327.md) - [Vapi API Key was detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/secrets-security/appsec-secret-328.md) - [Brave Search API Key detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/secrets-security/appsec-secret-329.md) - [Dify API Key was detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/secrets-security/appsec-secret-330.md) - [Linear Personal API key was detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/secrets-security/appsec-secret-331.md) - [Trendmicro Cloudone Apikey v1 detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/secrets-security/appsec-secret-332.md) - [Airtable API Key v1 detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/secrets-security/appsec-secret-333.md) - [Gitlab Personal Token detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/secrets-security/appsec-secret-334.md) - [Artifactory Reference Token With Host detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/secrets-security/appsec-secret-336.md) - [New Relic API Service Key detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/secrets-security/appsec-secret-337.md) - [Artifactory Basic Auth Credentials detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/secrets-security/appsec-secret-338.md) - [Datadog Secret detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/secrets-security/appsec-secret-339.md) - [Hashicorp Vault AppRole Authentication detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/secrets-security/appsec-secret-340.md) - [Snowflake Connector Credentials detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/secrets-security/appsec-secret-341.md) - [Artifactory Reference Token detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/secrets-security/appsec-secret-342.md) - [Azure Logic App Shared Access Signature detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/secrets-security/appsec-secret-343.md) - [Gitlab Trigger Token detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/secrets-security/appsec-secret-344.md) - [Laravel App Key detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/secrets-security/appsec-secret-345.md) - [Langfuse Credentials detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/secrets-security/appsec-secret-346.md) - [Alchemy API Key detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/secrets-security/appsec-secret-347.md) - [Alchemy API Key V2 detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/secrets-security/appsec-secret-348.md) - [Azure DevOps Personal Access Token with Organization detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/secrets-security/appsec-secret-349.md) - [Azure Event Grid Access Key detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/secrets-security/appsec-secret-350.md) - [ASP.NET Decryption Key detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/secrets-security/appsec-secret-351.md) - [Firecrawl API Key detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/secrets-security/appsec-secret-352.md) - [GitLab Feature Flags Client Token detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/secrets-security/appsec-secret-353.md) - [IBM API Connect credentials detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/secrets-security/appsec-secret-354.md) - [IBM COS HMAC credentials detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/secrets-security/appsec-secret-355.md) - [Checkout.com Sandbox API Secret Key detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/secrets-security/appsec-secret-356.md) - [Contributed Systems Sidekiq API Key detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/secrets-security/appsec-secret-357.md) - [Duffel API Key detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/secrets-security/appsec-secret-358.md) - [Elliptic Curve Private Key Base64 detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/secrets-security/appsec-secret-359.md) - [Elliptic Curve Private Key detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/secrets-security/appsec-secret-360.md) - [Okta OAuth 2.0 Client Credentials with Host detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/secrets-security/appsec-secret-361.md) - [Llama Cloud API Key detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/secrets-security/appsec-secret-362.md) - [OpenAI Project API Key V2 detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/secrets-security/appsec-secret-363.md) - [OpenRouter API Key detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/secrets-security/appsec-secret-364.md) - [PayPal OAuth2 Keys detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/secrets-security/appsec-secret-365.md) - [VirusTotal API Key detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/secrets-security/appsec-secret-366.md) - [Ubidots API Key detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/secrets-security/appsec-secret-367.md) - [Resend API Key detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/secrets-security/appsec-secret-368.md) - [Cursor API Key detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/secrets-security/appsec-secret-369.md) - [E2B API Key detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/secrets-security/appsec-secret-370.md) - [GitLab Runner Registration Token detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/secrets-security/appsec-secret-371.md) - [PostHog Private API Key detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/secrets-security/appsec-secret-372.md) - [PostHog Public API Key detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/secrets-security/appsec-secret-373.md) - [Clerk Secret Key detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/secrets-security/appsec-secret-374.md) - [Mercado Pago Access Token detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/secrets-security/appsec-secret-375.md) - [Discord Webhook URL detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/secrets-security/appsec-secret-376.md) - [GitHub Fine-Grained Personal Access Token detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/secrets-security/appsec-secret-377.md) - [Anthropic API Key detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/secrets-security/appsec-secret-378.md) - [Oracle Credentials detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/secrets-security/appsec-secret-379.md) - [Azure SAS URL detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/secrets-security/appsec-secret-382.md) - [Coveo API Key detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/secrets-security/appsec-secret-383.md) - [Elasticsearch API Key detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/secrets-security/appsec-secret-384.md) - [Zoho OAuth token detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/secrets-security/appsec-secret-385.md) - [SAST](https://cortex-docs.paloaltonetworks.com/appsec-rules/sast.md) - [3rd party security weakness found in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/sast/appsec-sast-1.md) - [Vulnerabilities](https://cortex-docs.paloaltonetworks.com/appsec-rules/vulnerabilities.md) - [Vulnerability found in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/vulnerabilities/appsec-vul-1.md) - [Vulnerability found in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/vulnerabilities/appsec-vul-2.md) - [License Compliance](https://cortex-docs.paloaltonetworks.com/appsec-rules/license-compliance.md) - [Weak copyleft license found in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/license-compliance/appsec-lic-3.md) - [Strong copyleft license found in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/license-compliance/appsec-lic-4.md) - [Non permissive license found in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/license-compliance/appsec-lic-5.md) - [Malicious Packages](https://cortex-docs.paloaltonetworks.com/appsec-rules/malicious-packages.md) - [Malicious open-source package detected in code](https://cortex-docs.paloaltonetworks.com/appsec-rules/malicious-packages/appsec-mal-1.md) ## XSPM Rules ## Attack Path Rules ## Discovery Catalog - [Cortex Cloud discovery catalog](https://cortex-docs.paloaltonetworks.com/discovery-catalog/cortex-cloud-discovery-catalog.md) - [Alibaba Cloud Services](https://cortex-docs.paloaltonetworks.com/discovery-catalog/cortex-cloud-discovery-catalog/alibaba-cloud-services.md) - [AWS Services](https://cortex-docs.paloaltonetworks.com/discovery-catalog/cortex-cloud-discovery-catalog/aws-services.md) - [Azure Services](https://cortex-docs.paloaltonetworks.com/discovery-catalog/cortex-cloud-discovery-catalog/azure-services.md) - [GCP Services](https://cortex-docs.paloaltonetworks.com/discovery-catalog/cortex-cloud-discovery-catalog/gcp-services.md) - [OCI Services](https://cortex-docs.paloaltonetworks.com/discovery-catalog/cortex-cloud-discovery-catalog/oci-services.md) - [Event-based Asset Ingestion (EAI)](https://cortex-docs.paloaltonetworks.com/discovery-catalog/cortex-cloud-discovery-catalog/event-based-asset-ingestion-eai.md) ## Compliance - [Cortex Compliance](https://cortex-docs.paloaltonetworks.com/compliance/cortex-compliance.md): Access compliance dashboards, reports, certifications, and marketplace content packs. ## Gateway Guide - [About the Cortex Gateway](https://cortex-docs.paloaltonetworks.com/gateway-guide/cortex-gateway.md): Learn how Cortex Gateway centrally manages tenants, users, roles, and user groups. - [Activate a tenant](https://cortex-docs.paloaltonetworks.com/gateway-guide/activate-a-tenant.md): Learn how to activate your Cortex tenant. - [Activate Cortex XDR tenant](https://cortex-docs.paloaltonetworks.com/gateway-guide/activate-a-tenant/activate-cortex-xdr-tenant.md): Learn how to activate your Cortex XDR tenant. - [Activate Cortex XSIAM tenant](https://cortex-docs.paloaltonetworks.com/gateway-guide/activate-a-tenant/activate-cortex-xsiam-tenant.md): Learn how to activate your Cortex XSIAM tenant. - [Activate Cortex XSOAR tenant](https://cortex-docs.paloaltonetworks.com/gateway-guide/activate-a-tenant/activate-cortex-xsoar-tenant.md): Learn how to activate your Cortex XSOAR tenant. - [Activate Cortex AgentiX](https://cortex-docs.paloaltonetworks.com/gateway-guide/activate-a-tenant/activate-cortex-agentix.md): Activate a Cortex AgentiX tenant through Cortex Gateway and configure its name, region, and subdomain. - [Users and roles in Cortex](https://cortex-docs.paloaltonetworks.com/gateway-guide/users-and-roles-in-cortex.md): Set up and configure roles and user groups in the Cortex tenant and Cortex Gateway. Configure authentication and manage users. - [User management](https://cortex-docs.paloaltonetworks.com/gateway-guide/user-management.md): Manage users in Cortex Gateway or the Cortex tenant. - [Manage users in Cortex Gateway](https://cortex-docs.paloaltonetworks.com/gateway-guide/user-management/manage-users-in-cortex-gateway.md): Add user roles, disable users, hide users, and deactivate users in Cortex Gateway. - [FedRAMP security configuration for top-level admin accounts](https://cortex-docs.paloaltonetworks.com/gateway-guide/fedramp-security-configuration-for-top-level-admin-accounts.md): Configure FedRAMP administrative roles, privileged access, and security controls in Cortex Gateway. - [Roles management](https://cortex-docs.paloaltonetworks.com/gateway-guide/roles-management.md): Configure roles in the Cortex tenant or Cortex Gateway. - [Next steps](https://cortex-docs.paloaltonetworks.com/gateway-guide/roles-management/next-steps.md): Configure roles in the Cortex tenant or Cortex Gateway. - [Predefined roles in Cortex Gateway](https://cortex-docs.paloaltonetworks.com/gateway-guide/roles-management/predefined-roles-in-cortex-gateway.md): Review the predefined roles in the Cortex Gateway. - [Manage roles in Cortex Gateway](https://cortex-docs.paloaltonetworks.com/gateway-guide/roles-management/manage-roles-in-cortex-gateway.md): View, create, edit, and delete roles in Cortex Gateway. - [User group management](https://cortex-docs.paloaltonetworks.com/gateway-guide/user-group-management.md): Create user groups, and assign roles and users to further refine your requirements, in Cortex Gateway. - [Egress configurations](https://cortex-docs.paloaltonetworks.com/gateway-guide/egress-configurations.md): Configure, approve, and manage tenant egress paths for external services in Cortex Gateway. ## Cortex Commands Guide - [Cortex Commands Overview](https://cortex-docs.paloaltonetworks.com/cortex-commands-guide/cortex-commands-overview.md): Use Cortex commands to investigate, respond, and manage Cortex platform data. - [Action Commands](https://cortex-docs.paloaltonetworks.com/cortex-commands-guide/action-commands.md) - [Analytics Commands](https://cortex-docs.paloaltonetworks.com/cortex-commands-guide/analytics-commands.md) - [API Keys Commands](https://cortex-docs.paloaltonetworks.com/cortex-commands-guide/api-keys-commands.md) - [AppSec Commands](https://cortex-docs.paloaltonetworks.com/cortex-commands-guide/appsec-commands.md) - [Asset Commands](https://cortex-docs.paloaltonetworks.com/cortex-commands-guide/asset-commands.md) - [Audit Commands](https://cortex-docs.paloaltonetworks.com/cortex-commands-guide/audit-commands.md) - [BIOC Commands](https://cortex-docs.paloaltonetworks.com/cortex-commands-guide/bioc-commands.md) - [Case Commands](https://cortex-docs.paloaltonetworks.com/cortex-commands-guide/case-commands.md) - [Correlation Rule Commands](https://cortex-docs.paloaltonetworks.com/cortex-commands-guide/correlation-rule-commands.md) - [Coverage Commands](https://cortex-docs.paloaltonetworks.com/cortex-commands-guide/coverage-commands.md) - [Dataset Commands](https://cortex-docs.paloaltonetworks.com/cortex-commands-guide/dataset-commands.md) - [Distribution Commands](https://cortex-docs.paloaltonetworks.com/cortex-commands-guide/distribution-commands.md) - [Endpoint Commands](https://cortex-docs.paloaltonetworks.com/cortex-commands-guide/endpoint-commands.md) - [Exceptions Commands](https://cortex-docs.paloaltonetworks.com/cortex-commands-guide/exceptions-commands.md) - [Exclusions Commands](https://cortex-docs.paloaltonetworks.com/cortex-commands-guide/exclusions-commands.md) - [File Commands](https://cortex-docs.paloaltonetworks.com/cortex-commands-guide/file-commands.md) - [Findings Commands](https://cortex-docs.paloaltonetworks.com/cortex-commands-guide/findings-commands.md) - [Groups Commands](https://cortex-docs.paloaltonetworks.com/cortex-commands-guide/groups-commands.md) - [Hash Exceptions Commands](https://cortex-docs.paloaltonetworks.com/cortex-commands-guide/hash-exceptions-commands.md) - [Indicators Commands](https://cortex-docs.paloaltonetworks.com/cortex-commands-guide/indicators-commands.md) - [Issues Commands](https://cortex-docs.paloaltonetworks.com/cortex-commands-guide/issues-commands.md) - [Playbooks Commands](https://cortex-docs.paloaltonetworks.com/cortex-commands-guide/playbooks-commands.md) - [RCS Commands](https://cortex-docs.paloaltonetworks.com/cortex-commands-guide/rcs-commands.md) - [Risk Commands](https://cortex-docs.paloaltonetworks.com/cortex-commands-guide/risk-commands.md) - [Scanner Commands](https://cortex-docs.paloaltonetworks.com/cortex-commands-guide/scanner-commands.md) - [Script Commands](https://cortex-docs.paloaltonetworks.com/cortex-commands-guide/script-commands.md) - [System Commands](https://cortex-docs.paloaltonetworks.com/cortex-commands-guide/system-commands.md) - [Timeline Commands](https://cortex-docs.paloaltonetworks.com/cortex-commands-guide/timeline-commands.md) - [Triage Commands](https://cortex-docs.paloaltonetworks.com/cortex-commands-guide/triage-commands.md) - [User Commands](https://cortex-docs.paloaltonetworks.com/cortex-commands-guide/user-commands.md) - [Vulnerability Commands](https://cortex-docs.paloaltonetworks.com/cortex-commands-guide/vulnerability-commands.md) - [War Room Commands](https://cortex-docs.paloaltonetworks.com/cortex-commands-guide/war-room-commands.md) - [XQL Commands](https://cortex-docs.paloaltonetworks.com/cortex-commands-guide/xql-commands.md) - [XQL Library Commands](https://cortex-docs.paloaltonetworks.com/cortex-commands-guide/xql-library-commands.md) ## MCP Integration Contributor Guide - [Get started with MCP integration development](https://cortex-docs.paloaltonetworks.com/mcp-integration-contributor-guide/get-started-with-mcp-integration-development.md) - [Required MCP commands](https://cortex-docs.paloaltonetworks.com/mcp-integration-contributor-guide/required-mcp-commands.md) - [MCPApiModule](https://cortex-docs.paloaltonetworks.com/mcp-integration-contributor-guide/mcpapimodule.md) - [Python implementation](https://cortex-docs.paloaltonetworks.com/mcp-integration-contributor-guide/python-implementation.md) - [Authentication patterns](https://cortex-docs.paloaltonetworks.com/mcp-integration-contributor-guide/authentication-patterns.md) - [Vendor-specific customizations](https://cortex-docs.paloaltonetworks.com/mcp-integration-contributor-guide/vendor-specific-customizations.md) - [Test your integration](https://cortex-docs.paloaltonetworks.com/mcp-integration-contributor-guide/test-your-integration.md) ## Google Cloud Platform Manual Onboarding - [GCP Manual Onboarding](https://cortex-docs.paloaltonetworks.com/google-cloud-platform-manual-onboarding/gcp-manual-onboarding.md) - [GCP Manual Onboarding Guide - Project Scope](https://cortex-docs.paloaltonetworks.com/google-cloud-platform-manual-onboarding/gcp-manual-onboarding/gcp-manual-onboarding-guide-project-scope.md) - [Overview of the Onboarding Process](https://cortex-docs.paloaltonetworks.com/google-cloud-platform-manual-onboarding/gcp-manual-onboarding/gcp-manual-onboarding-guide-project-scope/overview-of-the-onboarding-process.md) - [Prerequisites](https://cortex-docs.paloaltonetworks.com/google-cloud-platform-manual-onboarding/gcp-manual-onboarding/gcp-manual-onboarding-guide-project-scope/prerequisites.md) - [Phase 1: GCP onboarding wizard](https://cortex-docs.paloaltonetworks.com/google-cloud-platform-manual-onboarding/gcp-manual-onboarding/gcp-manual-onboarding-guide-project-scope/phase-1-gcp-onboarding-wizard.md) - [Phase 2: Platform service accounts](https://cortex-docs.paloaltonetworks.com/google-cloud-platform-manual-onboarding/gcp-manual-onboarding/gcp-manual-onboarding-guide-project-scope/phase-2-platform-service-accounts.md) - [Phase 3: Scanner Service Account](https://cortex-docs.paloaltonetworks.com/google-cloud-platform-manual-onboarding/gcp-manual-onboarding/gcp-manual-onboarding-guide-project-scope/phase-3-scanner-service-account.md) - [Phase 4: Audit Logs](https://cortex-docs.paloaltonetworks.com/google-cloud-platform-manual-onboarding/gcp-manual-onboarding/gcp-manual-onboarding-guide-project-scope/phase-4-audit-logs.md) - [Phase 5: Complete the GCP onboarding wizard in Cortex](https://cortex-docs.paloaltonetworks.com/google-cloud-platform-manual-onboarding/gcp-manual-onboarding/gcp-manual-onboarding-guide-project-scope/phase-5-complete-the-gcp-onboarding-wizard-in-cortex.md) - [Manage configuration changes](https://cortex-docs.paloaltonetworks.com/google-cloud-platform-manual-onboarding/gcp-manual-onboarding/gcp-manual-onboarding-guide-project-scope/manage-configuration-changes.md) - [Configuration values reference](https://cortex-docs.paloaltonetworks.com/google-cloud-platform-manual-onboarding/gcp-manual-onboarding/gcp-manual-onboarding-guide-project-scope/configuration-values-reference.md) - [GCP Manual Onboarding Guide - Folder Scope](https://cortex-docs.paloaltonetworks.com/google-cloud-platform-manual-onboarding/gcp-manual-onboarding/gcp-manual-onboarding-guide-folder-scope.md) - [Overview of the onboarding process](https://cortex-docs.paloaltonetworks.com/google-cloud-platform-manual-onboarding/gcp-manual-onboarding/gcp-manual-onboarding-guide-folder-scope/overview-of-the-onboarding-process.md) - [Prerequisites](https://cortex-docs.paloaltonetworks.com/google-cloud-platform-manual-onboarding/gcp-manual-onboarding/gcp-manual-onboarding-guide-folder-scope/prerequisites.md) - [Phase 1: GCP onboarding wizard](https://cortex-docs.paloaltonetworks.com/google-cloud-platform-manual-onboarding/gcp-manual-onboarding/gcp-manual-onboarding-guide-folder-scope/phase-1-gcp-onboarding-wizard.md) - [Phase 2: Platform service accounts](https://cortex-docs.paloaltonetworks.com/google-cloud-platform-manual-onboarding/gcp-manual-onboarding/gcp-manual-onboarding-guide-folder-scope/phase-2-platform-service-accounts.md) - [Phase 3: Scanner Service Account](https://cortex-docs.paloaltonetworks.com/google-cloud-platform-manual-onboarding/gcp-manual-onboarding/gcp-manual-onboarding-guide-folder-scope/phase-3-scanner-service-account.md) - [Phase 4: Audit Logs](https://cortex-docs.paloaltonetworks.com/google-cloud-platform-manual-onboarding/gcp-manual-onboarding/gcp-manual-onboarding-guide-folder-scope/phase-4-audit-logs.md) - [Phase 5: Complete the GCP onboarding wizard in Cortex](https://cortex-docs.paloaltonetworks.com/google-cloud-platform-manual-onboarding/gcp-manual-onboarding/gcp-manual-onboarding-guide-folder-scope/phase-5-complete-the-gcp-onboarding-wizard-in-cortex.md) - [Manage configuration changes](https://cortex-docs.paloaltonetworks.com/google-cloud-platform-manual-onboarding/gcp-manual-onboarding/gcp-manual-onboarding-guide-folder-scope/manage-configuration-changes.md) - [Configuration values reference](https://cortex-docs.paloaltonetworks.com/google-cloud-platform-manual-onboarding/gcp-manual-onboarding/gcp-manual-onboarding-guide-folder-scope/configuration-values-reference.md) - [GCP Manual Onboarding Guide - Organization Scope](https://cortex-docs.paloaltonetworks.com/google-cloud-platform-manual-onboarding/gcp-manual-onboarding/gcp-manual-onboarding-guide-organization-scope.md) - [Overview of the onboarding process](https://cortex-docs.paloaltonetworks.com/google-cloud-platform-manual-onboarding/gcp-manual-onboarding/gcp-manual-onboarding-guide-organization-scope/overview-of-the-onboarding-process.md) - [Prerequisites](https://cortex-docs.paloaltonetworks.com/google-cloud-platform-manual-onboarding/gcp-manual-onboarding/gcp-manual-onboarding-guide-organization-scope/prerequisites.md) - [Phase 1: GCP onboarding wizard](https://cortex-docs.paloaltonetworks.com/google-cloud-platform-manual-onboarding/gcp-manual-onboarding/gcp-manual-onboarding-guide-organization-scope/phase-1-gcp-onboarding-wizard.md) - [Phase 2: Platform service accounts](https://cortex-docs.paloaltonetworks.com/google-cloud-platform-manual-onboarding/gcp-manual-onboarding/gcp-manual-onboarding-guide-organization-scope/phase-2-platform-service-accounts.md) - [Phase 3: Scanner Service Account](https://cortex-docs.paloaltonetworks.com/google-cloud-platform-manual-onboarding/gcp-manual-onboarding/gcp-manual-onboarding-guide-organization-scope/phase-3-scanner-service-account.md) - [Phase 4: Audit Logs](https://cortex-docs.paloaltonetworks.com/google-cloud-platform-manual-onboarding/gcp-manual-onboarding/gcp-manual-onboarding-guide-organization-scope/phase-4-audit-logs.md) - [Phase 5: Complete the GCP onboarding wizard in Cortex](https://cortex-docs.paloaltonetworks.com/google-cloud-platform-manual-onboarding/gcp-manual-onboarding/gcp-manual-onboarding-guide-organization-scope/phase-5-complete-the-gcp-onboarding-wizard-in-cortex.md) - [Manage configuration changes](https://cortex-docs.paloaltonetworks.com/google-cloud-platform-manual-onboarding/gcp-manual-onboarding/gcp-manual-onboarding-guide-organization-scope/manage-configuration-changes.md) - [Configuration values reference](https://cortex-docs.paloaltonetworks.com/google-cloud-platform-manual-onboarding/gcp-manual-onboarding/gcp-manual-onboarding-guide-organization-scope/configuration-values-reference.md) ## Amazon Web Services Manual Onboarding - [AWS Manual Onboarding Guide](https://cortex-docs.paloaltonetworks.com/amazon-web-services-manual-onboarding/aws-manual-onboarding-guide.md) - [Overview of the Onboarding Process](https://cortex-docs.paloaltonetworks.com/amazon-web-services-manual-onboarding/aws-manual-onboarding-guide/overview-of-the-onboarding-process.md) - [Prerequisites](https://cortex-docs.paloaltonetworks.com/amazon-web-services-manual-onboarding/aws-manual-onboarding-guide/prerequisites.md) - [Target AWS Resources Overview](https://cortex-docs.paloaltonetworks.com/amazon-web-services-manual-onboarding/aws-manual-onboarding-guide/target-aws-resources-overview.md) - [Phase 1: Create AWS cloud instance in Cortex](https://cortex-docs.paloaltonetworks.com/amazon-web-services-manual-onboarding/aws-manual-onboarding-guide/phase-1-create-aws-cloud-instance-in-cortex.md) - [Phase 2: Provision the AWS resources](https://cortex-docs.paloaltonetworks.com/amazon-web-services-manual-onboarding/aws-manual-onboarding-guide/phase-2-provision-the-aws-resources.md) - [Phase 3: Complete the onboarding wizard in Cortex](https://cortex-docs.paloaltonetworks.com/amazon-web-services-manual-onboarding/aws-manual-onboarding-guide/phase-3-complete-the-onboarding-wizard-in-cortex.md) - [Manage configuration changes](https://cortex-docs.paloaltonetworks.com/amazon-web-services-manual-onboarding/aws-manual-onboarding-guide/manage-configuration-changes.md) - [Offboarding and resource decommissioning (optional)](https://cortex-docs.paloaltonetworks.com/amazon-web-services-manual-onboarding/aws-manual-onboarding-guide/offboarding-and-resource-decommissioning-optional.md): To decommission all manually created resources, remove them in the reverse order that they were created (Step 2.7 → Step 2.1): ## Microsoft Azure Manual Onboarding - [Azure Manual Onboarding Guide](https://cortex-docs.paloaltonetworks.com/microsoft-azure-manual-onboarding/azure-manual-onboarding-guide.md) - [Azure Manual Onboarding: Subscription Scope](https://cortex-docs.paloaltonetworks.com/microsoft-azure-manual-onboarding/azure-manual-onboarding-guide/azure-manual-onboarding-subscription-scope.md) - [Prerequisites](https://cortex-docs.paloaltonetworks.com/microsoft-azure-manual-onboarding/azure-manual-onboarding-guide/azure-manual-onboarding-subscription-scope/prerequisites.md) - [Phase 1: Create Azure cloud instance in Cortex](https://cortex-docs.paloaltonetworks.com/microsoft-azure-manual-onboarding/azure-manual-onboarding-guide/azure-manual-onboarding-subscription-scope/phase-1-create-azure-cloud-instance-in-cortex.md) - [Phase 2: Platform Identity and Base Role](https://cortex-docs.paloaltonetworks.com/microsoft-azure-manual-onboarding/azure-manual-onboarding-guide/azure-manual-onboarding-subscription-scope/phase-2-platform-identity-and-base-role.md) - [Phase 3: Create security capability roles](https://cortex-docs.paloaltonetworks.com/microsoft-azure-manual-onboarding/azure-manual-onboarding-guide/azure-manual-onboarding-subscription-scope/phase-3-create-security-capability-roles.md) - [Phase 4: Audit Logs](https://cortex-docs.paloaltonetworks.com/microsoft-azure-manual-onboarding/azure-manual-onboarding-guide/azure-manual-onboarding-subscription-scope/phase-4-audit-logs.md) - [Phase 5: Complete the Azure onboarding wizard in Cortex](https://cortex-docs.paloaltonetworks.com/microsoft-azure-manual-onboarding/azure-manual-onboarding-guide/azure-manual-onboarding-subscription-scope/phase-5-complete-the-azure-onboarding-wizard-in-cortex.md) - [Configuration values reference](https://cortex-docs.paloaltonetworks.com/microsoft-azure-manual-onboarding/azure-manual-onboarding-guide/azure-manual-onboarding-subscription-scope/configuration-values-reference.md) - [Offboarding and resource decommissioning (optional)](https://cortex-docs.paloaltonetworks.com/microsoft-azure-manual-onboarding/azure-manual-onboarding-guide/azure-manual-onboarding-subscription-scope/offboarding-and-resource-decommissioning-optional.md) - [Azure Manual Onboarding: Management group or tenant scope](https://cortex-docs.paloaltonetworks.com/microsoft-azure-manual-onboarding/azure-manual-onboarding-guide/azure-manual-onboarding-management-group-or-tenant-scope.md) - [Prerequisites](https://cortex-docs.paloaltonetworks.com/microsoft-azure-manual-onboarding/azure-manual-onboarding-guide/azure-manual-onboarding-management-group-or-tenant-scope/prerequisites.md) - [Phase 1: Create Azure cloud instance in Cortex](https://cortex-docs.paloaltonetworks.com/microsoft-azure-manual-onboarding/azure-manual-onboarding-guide/azure-manual-onboarding-management-group-or-tenant-scope/phase-1-create-azure-cloud-instance-in-cortex.md) - [Phase 2: Platform Identity and Base Role](https://cortex-docs.paloaltonetworks.com/microsoft-azure-manual-onboarding/azure-manual-onboarding-guide/azure-manual-onboarding-management-group-or-tenant-scope/phase-2-platform-identity-and-base-role.md) - [Phase 3: Create security capability roles](https://cortex-docs.paloaltonetworks.com/microsoft-azure-manual-onboarding/azure-manual-onboarding-guide/azure-manual-onboarding-management-group-or-tenant-scope/phase-3-create-security-capability-roles.md) - [Phase 4: Audit Logs](https://cortex-docs.paloaltonetworks.com/microsoft-azure-manual-onboarding/azure-manual-onboarding-guide/azure-manual-onboarding-management-group-or-tenant-scope/phase-4-audit-logs.md) - [Phase 5: Complete the Azure onboarding wizard in Cortex](https://cortex-docs.paloaltonetworks.com/microsoft-azure-manual-onboarding/azure-manual-onboarding-guide/azure-manual-onboarding-management-group-or-tenant-scope/phase-5-complete-the-azure-onboarding-wizard-in-cortex.md) - [Reference: Summary of resources created](https://cortex-docs.paloaltonetworks.com/microsoft-azure-manual-onboarding/azure-manual-onboarding-guide/azure-manual-onboarding-management-group-or-tenant-scope/reference-summary-of-resources-created.md) - [Offboarding and resource decommissioning (optional)](https://cortex-docs.paloaltonetworks.com/microsoft-azure-manual-onboarding/azure-manual-onboarding-guide/azure-manual-onboarding-management-group-or-tenant-scope/offboarding-and-resource-decommissioning-optional.md) ## ADS Support for LVM ## Outposts: Bring Your Own Network (BYON) ## XSIAM Release Notes (Beta) ## XDR 6 Release Note (Beta) ## Cloud Posture 2.3 Release Notes (Beta) ## Cloud Runtime 2.3 Release Notes (Beta) ## AgentiX 1.5 Release Notes (Beta) - [Cortex AgentiX Release Information](https://cortex-docs.paloaltonetworks.com/release-notes-agentix-1.5/cortex-agentix-release-information.md) ## XDR Agent 9.4 Release Notes (Beta) ## XSOAR 8.16 SaaS Release Notes (Beta) ## Xpanse Expander Release Notes (Beta) ## Data Security Release Notes (Beta) --- # Agent Instructions This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com. ## Querying This Documentation This site has an agentic ask interface you may use to query the documentation dynamically by asking a question. Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters: ``` GET https://cortex-docs.paloaltonetworks.com/index.md?ask=&goal= ``` `ask` is the immediate question: it should be specific, self-contained, and written in natural language. `goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.