Threat management

[detection-rules](threat-management/detection-rules)

[analytics](threat-management/analytics)

[extended-threat-intelligence](threat-management/extended-threat-intelligence)

[threat-intel-management](threat-management/threat-intel-management)

Sub-topics

• Detection rules
  • What are detection rules?
    • What's an IOC?
      • IOC rule details
      • Create an IOC rule
    • What's a BIOC?
      • BIOC rule details
      • Create a BIOC rule
      • Manage Global BIOC Rules
    • What's a correlation rule?
      • Correlation rule details
      • Create a correlation rule
      • Field replacement syntax in correlation rules
      • Manage correlation rules
      • Monitor correlation rules
      • Troubleshoot server errors in scheduled correlation rules
    • Manage IOC and BIOC rules
• Analytics
  • Analytics overview
  • Analytics engine
  • Analytics sensors
  • Coverage of MITRE Attack tactics
  • Review MITRE ATT&CK framework coverage
  • Analytics detection time intervals
  • Analytics issues and Analytics BIOCs
  • Identity Analytics
  • View and manage Analytics rules
  • AI Detection & Response in Cortex XSIAM
    • Data sources and supported services
    • Collect prompt logs
      • Prompt log collection in AWS
      • Enable prompt log collection in Azure
        • Configure the Azure Event Hub collection in Cortex XSIAM
        • Set up prompt logging
        • Log HTTP data
        • Configure diagnostic settings
• Extended Threat Intelligence
  • XTI Threat Intel Library
  • XTI Indicators
  • Threat intel context in cases and issues
  • XTI indicator rules
  • Threat intel investigation through XQL
  • Threat Intel Dashboard
  • Using XTI with Threat Intel Agent
  • Using XTI in playbooks
• Threat Intel Management
  • Get started with Threat Intel Management
    • What is Threat Intel Management?
    • Threat Intel Management use cases
    • Roles and responsibilities in Threat Intel Management
    • Indicator concepts
    • Indicator lifecycle
  • Indicator configuration
    • Configure Threat Intelligence feed integrations
    • Customize indicator fields and types
      • Create an indicator type
        • Indicator type profile
        • Formatting scripts
        • Enhancement scripts
        • Reputation scripts
        • Reputation commands
        • Map custom indicator fields
      • Create an indicator field
        • Indicator field structure
        • Indicator field trigger scripts
    • Indicator classification and mapping
    • Indicator extraction
      • Set the indicator extraction mode for a playbook task
      • Disable indicator extraction for scripts or integrations
    • Configure Threat Intelligence feed integrations
    • Exclude indicators from enrichment
    • Generate issues from indicators using indicator rules for prevention and detection
    • Export indicators
  • Indicator management
  • Indicator investigation
    • Indicator verdict
    • Extract and enrich an indicator
    • Expire an indicator
    • Manage indicator relationships
    • Delete and exclude indicators