Navigate the Cortex XSIAM docs ↗

Cortex XSIAM unifies detection, investigation, response, endpoint security, and cloud security in one platform.

Use this page to jump into the right docs area fast.

Use the table of contents when you know the exact page.

Use this page when you need a quick overview of the main Cortex XSIAM areas.


Product overview Learn about the basics and architecture.	get-started-cortex-xsiam
Agentic AI Explore AI-powered investigation, response, and workflows.	agentic-ai-in-cortex-xsiam
Licensing Review plans, add-ons, and retention.	cortex-xsiam-product-licenses
Interface Navigate pages, filters, views, and exports.	use-the-interface


Plan and prepare Consider storage, region, XDR agent, and data sources requirements.	plan-and-prepare
Deployment checklist Follow the key steps to deploy and onboard.	cortex-xsiam-onboarding-checklist
Post-deployment Validate your deployment and complete initial tasks.	post-deployment
Cortex XSIAM Data Sources Connect data sources, including CSP, and Cloud Posture and Runtime Security data sources.	cortex-xsiam-data-sources
Analytics Set up analytics and enable the analytics engine.	cortex-xsiam-analytics


Data management Manage ingestion, retention, and data access.	data-management
Configure the Cortex Agentic Assistant Set up assistant access and capabilities.	configure-the-cortex-agentic-assistant-1
Cortex MCP server Connect external AI clients through the MCP server.	cortex-mcp-server
Automations Automate recurring security tasks and responses.	automations
Customize cases and issues Tailor case and issue workflows to your needs.	customize-cases-and-issues
Multi-Tenant Manage tenants and their security operations.	multi-tenant
Managed Services configuration in Cortex Configure services for managed security operations.	managed-services-configuration-in-cortex


Endpoint security Prevent, detect, and respond to endpoint threats.	endpoint-security
Endpoint DLP Protect sensitive data on managed endpoints.	endpoint-dlp

Endpoint security

Prevent, detect, and respond to endpoint threats.

Endpoint DLP

Protect sensitive data on managed endpoints.


Monitor dashboards and reports Track security operations, trends, and outcomes.	monitor-dashboards-and-reports
Investigation and response Investigate cases/issues and respond to threats.	investigation-and-response
Agentic Assistant chat Use natural language to investigate security data.	agentic-assistant-chat
Asset management Inventory and monitor assets across your environment.	asset-management
Threats Prioritize and manage threats affecting your organization.	threat-management
Attack Surface Management Discover and assess internet-facing attack surface risks.	attack-surface-management
Vulnerability management Identify, prioritize, and remediate vulnerabilities.	vulnerability-management
Exposure management Understand and reduce your overall cyber exposure.	exposure-management


Data Security Discover and protect sensitive cloud data.	cortex-data-security
Monitor and track compliance adherence Measure cloud compliance against supported standards.	monitor-and-track-compliance-adherence
Cloud Security Rules and Policies Configure policies and rules for cloud protection.	cloud-security-rules-and-policies
Cloud Data Classification Classify cloud data using sensitive data profiles.	cortex-cloud-data-classification
Cloud Identity Security Secure cloud identities and their permissions.	cortex-cloud-identity-security
Network exposure detection Identify cloud network paths that create exposure.	network-exposure-detection
Cloud AI Security Secure AI services and workloads in the cloud.	cortex-cloud-ai-security
Serverless function posture security Assess configuration risks in serverless functions.	serverless-function-posture-security
Cloud Application Security Protect cloud-native applications across their lifecycle.	cortex-cloud-application-security
Cloud workload policies and rules Define controls for cloud workloads and resources.	cloud-workload-policies-and-rules
Web and API Security (WAAS) Protect web applications and APIs from attacks.	overview
Serverless function runtime security Detect runtime threats in serverless functions.	overview-1
Cortex Advanced Email Security Protect users from email-based threats.	cortex-advanced-email-security


XQL Query and analyze security data with XQL.	cortex-agentix-xql
Graph Search Explore relationships between entities and events.	graph-search
Cortex CLI Manage Cortex XSIAM from the command line.	about-cortex-cli
Role-Based Access Control Control access with roles and permissions.	role-based-access-control
API documentation Integrate Cortex XSIAM with its public APIs.	api-documentation