Detect, Investigate, and respond to threats

Sub-topics

• Monitor dashboards and reports
  • Overview of dashboards and reports
    • Dashboard interface basics
    • Dashboard types
    • Report basics
    • Widget Library
  • Access and visibility for dashboards and reports
    • Visibility settings
    • Access to widgets
    • Sharing icons
    • Access and sharing cheat sheet
  • Manage dashboards and reports
    • Dashboard Manager
    • Reports
    • Duplicate dashboards and reports
    • Share custom dashboards and report templates
    • Change ownership to dashboards and report templates
    • Import and export dashboards and report templates
    • Configure the notification rule for a failed report
    • Deleted content
  • Create dashboards
    • Create a dashboard
  • Create reports
    • Create a report template from scratch
  • Advanced configuration
    • Create custom widgets
      • Create widgets using AI
      • Create XQL widgets
      • Add parameters to a custom XQL widget
      • Create script-based widgets
    • Configure global filters
    • Configure drilldowns
  • Dashboard reference
    • Command Center reference
      • Cortex Command Center
      • Cortex Agentic Assistant dashboard
      • XSIAM Command Center
        • Data Inventory
        • Dynamic View
        • Cases Overview
      • Cloud Detection and Response (CDR) Command Center
      • Cortex Cloud Command Center
    • System dashboards
      • Cortex Cloud Consumption
      • Cloud Security Operations
      • Data Ingestion
• Investigation and response
  • Overview of cases
    • What are cases?
    • Resolving cases with AI
    • Case lifecycle
    • Case thresholds
    • Case scope and impact
    • Case and issue domains
    • Overview of case teams and roles
  • Case concepts
    • Issues, findings, and events
    • Case grouping
    • Case scoring
    • Case starring
    • SLAs and tracking
    • What is Causality?
  • Analyze and resolve cases
    • Review all cases
    • Start case analysis
      • Agentic Assistant- Case Investigation agent
    • Establish case context
      • AI-generated case summaries
      • Assess case severity and score
      • Update case attributes
    • Analyze case details
      • Grouping graph
      • Evidence
      • Issue feed
      • Associated assets and artifacts
      • MITRE ATT&CK tactics and techniques
      • Compliance standards and controls
      • Case timeline
      • Detailed View
    • Resolve the case
      • Resolution Center
      • Collaborative notes and comments
      • How to resolve a case
      • Resolution reasons for cases and issues
      • Monitor and track resolution times
      • Cortex Response and Remediation content pack
        • Investigate an issue using Cortex Response and Remediation playbooks
        • Example use cases
    • Additional case actions
      • Create a case
      • Merge a case
      • Assign a case team and restrict access
        • Playbook examples
      • Unified case view
  • Investigate issues
    • Overview of the Issues page
    • Issue card
    • Resolution actions
    • Link or unlink issues from a case
    • Run an automation on an issue
    • Use the War Room in an investigation
    • Use the Work Plan in an investigation
    • Issue syncing
    • Issue deduplication
    • Causality view
      • Network causality view
      • Cloud causality view
      • Cloud causality view for audit log issues
      • SaaS causality view
      • Timeline
      • Causality icons key
    • Issue investigation actions
      • Copy issues
      • Analyze an issue
      • Update issue fields
      • Query case and issue data
      • Exclude an issue
      • Create a featured field
      • Export issue details to a file
      • Investigate contributing events
      • Retrieve additional issue details
      • View generating BIOC or IOC rule
      • Create profile exceptions
      • Add a file path to a malware profile allow list
      • Close an issue
  • Review findings
    • Findings card
  • Investigate artifacts and assets
    • Investigate an IP address
    • Investigate an asset
    • Investigate a host
    • Investigate a file and process hash
    • Investigate a user
  • Investigate endpoints
    • Overview of the Action Center
      • Initiate and monitor endpoint actions
      • Action Center reference information
    • Manage endpoints
    • Retrieve files from an endpoint
    • Retrieve support logs from an endpoint
    • Retrieve support file password
    • Scan an endpoint for malware
  • Investigate files
    • Manage file execution
    • Manage quarantined files
    • Review WildFire analysis details
    • Import file hash exceptions
  • Cortex Assistant
    • Cortex Assistant layout
    • Cortex Assistant capabilities
  • Response actions
    • Initiate a Live Terminal session
    • Isolate an endpoint
    • Pause endpoint protection
    • Run agent scripts on an endpoint
    • Remediate changes from malicious activity
    • Search and destroy malicious files
    • Manage external dynamic lists
    • Collect a memory image
  • Forensics
    • Forensic investigations
    • Manage an investigation
      • Create a new investigation
      • Edit an investigation
      • Close an investigation
      • User permissions
    • Data collection
      • Hunting
        • Create a hunt
        • Hunt results
        • Hunt status
      • Triage
        • Create a triage
        • Upload an offline triage package
        • Offline triage collection
        • Triage results
        • Triage status
      • Configure collection
    • Analysis and documentation
    • Export
  • Notebooks
    • Manage datasets in Notebooks
    • Notebooks scheduler
  • Build XQL queries
    • About the Query Builder
    • How to build XQL queries
      • Get started with XQL queries
      • Useful XQL user interface features
      • XQL Query best practices
      • Expected results when querying fields
      • Create XQL query
      • Review XQL query results
      • Translate to XQL
      • Graph query results
    • Query Builder templates
      • Get started with Query Builder templates
      • Considerations for using Query Builder templates
      • Create a query from a template
      • Run a free text query
      • Query Builder template examples
    • Overview of the Query Center
      • Edit and run queries in Query Center
      • Query Center reference information
    • Manage scheduled queries
      • Scheduled Queries reference information
    • Manage your personal query library
    • XQL macros
    • Manage your macros
    • Federated Search
      • Federated Search configuration
      • Query using Federated Search
      • Manage external datasets
    • Legacy Query Builder
      • Create authentication query
      • Create event log query
      • Create file query
      • Create image load query
      • Create network connections query
      • Create network query
      • Create process query
      • Create registry query
      • Query across all entities
  • Research a known threat
• Agentic Assistant chat
  • Get started with Agentic Assistant chat
  • Choose an Agentic Assistant agent
  • Chat with an Agentic Assistant agent
  • Chat with the Agentic Assistant from Slack
  • Create and run XQL queries with Agentic Assistant chat
  • Use natural language to query and visualize your data
  • Manage chat history
• Asset management
  • Asset inventory overview
  • All assets
  • All cloud assets
    • Discovery Engine
    • Asset hierarchy
  • Asset classes
    • AI assets
    • API assets
    • Application assets
    • Code and Supply Chain Security assets
      • IaC resources assets
      • Repository assets
      • VCS organization assets
      • CI/CD pipeline assets
      • CI/CD instances assets
      • Software package assets
    • Compute assets
      • Container image assets
      • Serverless functions assets
      • VM images assets
    • Data assets
    • Device assets
    • External Surface assets
      • Website assets
      • Service assets
      • Domain assets
      • Certificate assets
      • External Surface attribution evidence
    • Identity assets
    • Network assets
    • Security services assets
  • Asset groups
  • Manage Risk Scores
  • Asset configurations
    • Network configurations
    • Application criteria
    • Asset Roles
      • Manage Asset Roles for Endpoints
      • Manage Asset Roles for Users
        • Honey user
  • Vulnerability Assessment
  • Query the asset inventory via XQL
• Threat management
  • Detection rules
    • What are detection rules?
      • What's an IOC?
        • IOC rule details
        • Create an IOC rule
      • What's a BIOC?
        • BIOC rule details
        • Create a BIOC rule
        • Manage Global BIOC Rules
      • What's a correlation rule?
        • Correlation rule details
        • Create a correlation rule
        • Field replacement syntax in correlation rules
        • Manage correlation rules
        • Monitor correlation rules
        • Troubleshoot server errors in scheduled correlation rules
      • Manage IOC and BIOC rules
  • Analytics
    • Analytics overview
    • Analytics engine
    • Analytics sensors
    • Coverage of MITRE Attack tactics
    • Review MITRE ATT&CK framework coverage
    • Analytics detection time intervals
    • Analytics issues and Analytics BIOCs
    • Identity Analytics
    • View and manage Analytics rules
    • AI Detection & Response in Cortex XSIAM
      • Data sources and supported services
      • Collect prompt logs
        • Prompt log collection in AWS
        • Enable prompt log collection in Azure
          • Configure the Azure Event Hub collection in Cortex XSIAM
          • Set up prompt logging
          • Log HTTP data
          • Configure diagnostic settings
  • Extended Threat Intelligence
    • XTI Threat Intel Library
    • XTI Indicators
    • Threat intel context in cases and issues
    • XTI indicator rules
    • Threat intel investigation through XQL
    • Threat Intel Dashboard
    • Using XTI with Threat Intel Agent
    • Using XTI in playbooks
  • Threat Intel Management
    • Get started with Threat Intel Management
      • What is Threat Intel Management?
      • Threat Intel Management use cases
      • Roles and responsibilities in Threat Intel Management
      • Indicator concepts
      • Indicator lifecycle
    • Indicator configuration
      • Configure Threat Intelligence feed integrations
      • Customize indicator fields and types
        • Create an indicator type
          • Indicator type profile
          • Formatting scripts
          • Enhancement scripts
          • Reputation scripts
          • Reputation commands
          • Map custom indicator fields
        • Create an indicator field
          • Indicator field structure
          • Indicator field trigger scripts
      • Indicator classification and mapping
      • Indicator extraction
        • Set the indicator extraction mode for a playbook task
        • Disable indicator extraction for scripts or integrations
      • Configure Threat Intelligence feed integrations
      • Exclude indicators from enrichment
      • Generate issues from indicators using indicator rules for prevention and detection
      • Export indicators
    • Indicator management
    • Indicator investigation
      • Indicator verdict
      • Extract and enrich an indicator
      • Expire an indicator
      • Manage indicator relationships
      • Delete and exclude indicators
• Attack surface management
  • Learn about Attack Surface Management
    • Network mapping
    • Scanning
    • GeoIP data collection
  • Attack Surface Management detections
    • Attack surface rules
    • Attack Surface Testing
    • Externally inferred CVEs
    • Digital Risk Protection
  • Attack surface assets
  • Deploy ASM and Exposure Management enrichment and remediation automation
  • ASM enrichment of cloud assets
  • Emerging Vulnerabilities
  • Global Lookup
• Vulnerability management
  • Vulnerability management in Cortex XSIAM
  • Cortex Vulnerability Risk Score
  • Vulnerability policies
  • Investigate and remediate vulnerabilities
  • Vulnerability Intelligence
  • Emerging Vulnerabilities
  • Recast CVSS scores and CVSS severities
• Exposure management
  • Learn about Exposure Management
  • Get started with Exposure Management
  • Ingest assets and vulnerabilities from third-party applications
  • Security controls
  • Cortex Network Scanner
  • Exposure Management Command Center
• Cortex Advanced Email Security
  • Cortex Advanced Email Security module overview
  • Cortex Advanced Email Security module architecture and data flow
  • Getting started with the Cortex Advanced Email Security module
  • Deploy and configure the Email Security module
  • Cortex Advanced Email Security threat detection and issues
    • Email Security Analytics Rules
  • Investigate and respond to email security issues
  • Automate remediation for the Cortex Advanced Email Security module
    • Email Remediation Response Rules
    • Email Security Remediation Action Center
  • Email Command Center
  • Malicious Email Inventory
  • Mailbox Inventory
  • Advanced Email Security module security and compliance
• Identity Threat Detection and Response (ITDR)
  • Get started with ITDR
  • Manage role based access control (RBAC) in ITDR
  • Monitor user risk exposure
  • Investigate user risk
  • Manage user asset roles
  • Improve Active Directory posture with AD-SPM
  • Enforce dynamic access control with CAP
  • Prevent malicious LDAP queries