Data management

[optimize-data-management-in-cortex-xsiam](data-management/optimize-data-management-in-cortex-xsiam)

[configure-cortex-data-lake-tier](data-management/configure-cortex-data-lake-tier)

[broker-vm](data-management/broker-vm)

[dataset-management](data-management/dataset-management)

[archived-data](data-management/archived-data)

[parsing-rules](data-management/parsing-rules)

[data-model-rules](data-management/data-model-rules)

[manage-event-forwarding](data-management/manage-event-forwarding)

[manage-compute-units](data-management/manage-compute-units)

Sub-topics

• Optimize data management in Cortex XSIAM
• Configure Cortex Data Lake tier
• Broker VM
  • What is the Broker VM?
  • Set up and configure Broker VM
    • Broker VM image installations
      • Set up Broker VM on Alibaba Cloud
      • Set up Broker VM on Amazon Web Services
      • Set up Broker VM on Google Cloud Platform (GCP)
      • Set up Broker VM on KVM using Ubuntu
      • Set up Broker VM on Microsoft Azure
      • Set up Broker VM on Microsoft Hyper-V
      • Set up Broker VM on Nutanix Hypervisor
      • Set up Broker VM on VMware ESXi using vSphere Client
    • Broker VM data collector applets
  • Manage Broker VM
    • Edit Broker VM Configuration
    • Increase Broker VM storage allocated for data caching
    • Monitor Broker VM using Prometheus
    • Collect Broker VM Logs
    • Upgrade Broker VM
    • Update Broker VM applets independently
    • Import Broker VM Configuration
    • Open Live Terminal
    • Add Broker VM to cluster
    • Switchover Primary Node in Cluster
    • Remove from Cluster
  • Manage Broker VM data collector applets
  • Broker VM High Availability Cluster
    • Configure High Availability Cluster
    • Manage Broker VM clusters
      • View cluster details
      • Edit cluster
      • Add applet to cluster
      • Add Broker VM to cluster
      • Remove cluster
  • Broker VM notifications
  • Monitor Broker VM activity
  • Troubleshoot Broker VM applet errors
• Dataset management
  • What are datasets?
  • Lookup datasets
    • Import a lookup dataset
    • Download JSON file of lookup dataset
    • Set time to live for lookup datasets
  • Monitor datasets and dataset views activity
• Archived data
  • Import historical data into cold storage
  • Building XQL archived data queries
  • Success and failure code responses to your HTTP POST requests
• Parsing Rules
  • Parsing Rules editor views
  • Parsing Rules file structure and syntax
    • INGEST
      • fields
      • parse_cef
      • parse_cisco
      • parse_json
    • COLLECT
    • CONST
    • RULE
    • EXTEND
  • Create Parsing Rules
  • Troubleshooting Parsing rules errors
  • Parsing Rules Raw Dataset
• Data Model Rules
  • Data Model Rules editor views
  • Data Model Rules file structure and syntax
    • MODEL
    • RULE
    • Field structure
  • How to map authentication events for analytics
  • Generate data model rules with AI (preview)
  • Create Data Model Rules
  • Troubleshooting Data Model Rules
  • Using data enrichment
  • Data Model Rules notifications
  • Monitor Data Model Rules activity
• Manage Event Forwarding
  • Endpoints Event Forwarding - included/excluded fields by event type
• Manage compute units
  • Compute units usage